MITRE ATLAS Framework 2026 – Guide to Securing AI Systems

What is the MITRE ATLAS Framework?

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a knowledge base of adversary tactics, techniques, and real-world case studies targeting AI and machine learning systems. It works the same way MITRE ATT&CK does for traditional IT infrastructure; but applied specifically to ML models, training pipelines, LLMs, and AI agents.

As of 2026, ATLAS documents 16 tactics and over 80 techniques, updated monthly by MITRE and community contributors. The framework is free at atlas.mitre.org.

Practitioners treat ATLAS and ATT&CK as separate when attacks chain both. Similar tactic names mislead them into lazy threat modeling. They over-focus on adversarial examples and ignore the more realistic threats: data poisoning and model theft. Detection engineering breaks down because ML attacks leave no traditional telemetry. And ATLAS case studies get trusted like ATT&CK procedures, when the underlying evidence is much weaker.

How ATLAS differs from ATT&CK

ATLAS inherits 14 tactics from ATT&CK but applies them to AI-specific attack surfaces. It adds 2 tactics with no ATT&CK equivalent.

	MITRE ATT&CK	MITRE ATLAS
Primary target	Enterprise IT, cloud, endpoints	ML models, training pipelines, LLMs, AI agents
Tactic count	14 (Enterprise)	16
Technique count	196+	80+ (updated monthly)
AI-specific tactics	None	ML Model Access (AML.TA0004), ML Attack Staging (AML.TA0012)
Case studies	Threat actor and software profiles	40+ AI-specific incident analyses
Best used fo	Endpoint and network threat modeling	AI system threat modeling, AI red teaming

The 2 AI-specific tactics are worth calling out explicitly:

• ML Model Access (AML.TA0004): how adversaries gain access to the target model; via inference APIs, direct artifact access, or model extraction queries. This has no equivalent in ATT&CK because traditional IT doesn’t have a “query the system to learn how it classifies” attack surface.
• ML Attack Staging (AML.TA0012): how adversaries prepare AI-specific attacks; building proxy models, generating adversarial data, testing attacks in a local environment before hitting production.

Use both frameworks together. ATT&CK covers your infrastructure. ATLAS covers your AI systems. Neither covers the other’s ground.

Framework structure

Every ATLAS entry has the same building blocks as ATT&CK:

• Tactics; the adversary’s goal at that phase of the attack (the “why”)
• Techniques; the specific method used to achieve that goal (the “how”), each with a stable AML.TXXXX ID
• Sub-techniques; variations on a technique (e.g., direct vs indirect prompt injection)
• Mitigations; defensive controls mapped to specific techniques
• Case studies; documented real-world incidents mapped to ATLAS TTPs, labeled either “Incident” (observed in the wild) or “Exercise” (red team or research)

ATLAS data is available in STIX 2.1 format, making it machine-readable for SIEM and threat intelligence platform integration.

The 16 ATLAS tactics

The framework updated from 14 to 16 tactics in 2025. Command and Control was added as AML.TA0015 in the November 2025 v5.1.0 release. The framework is updated monthly; verify current counts at atlas.mitre.org.

ID	Tactic	What the adversary is doing
AML.TA0001	Reconnaissance	Gathering information about the target AI system; its architecture, training data sources, API structure, and known vulnerabilities; before attacking
AML.TA0002	Resource Development	Acquiring tools, infrastructure, or ML artifacts needed to execute the attack; including building proxy models or collecting training data for adversarial use
AML.TA0003	Initial Access	Gaining entry to the AI environment via compromised APIs, prompt injection, supply chain compromise, or phishing
AML.TA0004	ML Model Access	Gaining access to the target ML model itself; via inference API, direct artifact access, or physical access to model weights. This tactic is unique to ATLAS.
AML.TA0005	Execution	Running malicious code or manipulated inputs within the AI environment, including via LLM plugin compromise
AML.TA0006	Persistence	Establishing ongoing access to the AI system through backdoors, malicious prompts embedded in memory, or modified agent configurations that survive detection
AML.TA0007	Privilege Escalation	Gaining higher-level access within the AI environment; moving from standard user access toward controls that affect model behavior or pipeline configuration
AML.TA0008	Defense Evasion	Bypassing or disabling security controls once inside; using adversarial perturbations, obfuscated inputs, or meta-prompt extraction to avoid detection
AML.TA0009	Credential Access	Stealing authentication credentials (API keys, passwords, tokens) that grant access to AI systems or connected services; including from AI agent configuration files
AML.TA0010	Discovery	Mapping the AI system’s architecture, data flows, model types, and sensitive data locations to plan subsequent actions
AML.TA0011	Collection	Harvesting valuable data: training datasets, model parameters, sensitive user data ingested into RAG databases, or outputs that reveal proprietary model behavior
AML.TA0012	ML Attack Staging	Preparing AI-specific attacks; crafting adversarial data, building proxy models, or testing attack efficacy locally before targeting the production system. Unique to ATLAS.
AML.TA0013	Exfiltration	Extracting data from the AI system via inference API, model extraction queries, or by invoking agent tools that write to external destinations
AML.TA0014	Impact	Disrupting the AI system’s functionality; causing misclassification at scale, degrading model performance, or manipulating outputs to cause downstream harm
AML.TA0015	Command and Control	Managing compromised AI systems remotely; using AI service APIs as covert communication channels or issuing instructions that persist through agent memory
AML.TA0016	Lateral Movement	Moving through the network or AI infrastructure to reach additional models, data stores, or downstream systems after initial compromise

CAISP students consistently conflate Evasion and Poisoning because both feel like “tricking the model,” but Evasion requires inference-time access while Poisoning requires training-time access: different attacker positions, different mitigations, and conflating them in a lab produces threat models that defend against the wrong phase entirely.

Key techniques

These are the techniques practitioners encounter most in real environments. Each has a stable AML identifier you can cross-reference in ATLAS Navigator.

Prompt Injection (AML.T0051); Initial Access

Adversaries craft malicious inputs that redirect LLM behavior away from its intended purpose. Direct injection puts the malicious instruction in the user’s input. Indirect injection embeds it in external data the LLM processes (a web page, a document, an email) without the user knowing. Sub-technique AML.T0051.001 = direct; AML.T0051.002 = indirect. Prompt injection maps to OWASP LLM01; it’s the most commonly observed ATLAS technique in production environments.

Data Poisoning (AML.T0020); ML Attack Staging

Adversaries corrupt the training data an ML model learns from, causing it to make systematically wrong predictions. A backdoor variant (see AML.T0018) embeds a hidden trigger: the model behaves normally on clean inputs but produces attacker-controlled output when a specific trigger pattern appears. This is not detectable through inference-time monitoring alone; it requires training data provenance controls.

Model Extraction / Model Inversion (AML.T0035); ML Model Access

Adversaries query the inference API systematically to reconstruct the model’s decision boundaries or recover training data. Model extraction produces a functional copy the adversary can use for further attack planning or IP theft. Model inversion recovers private training data. Both are enabled by unrestricted API access with no anomaly detection on query patterns.

Adversarial Examples (AML.T0043); ML Attack Staging / Impact

Inputs crafted to cause a specific misclassification while appearing normal to humans. The Cylance bypass (covered in the case studies section) is the documented example: malware crafted to appear benign to an ML classifier without any change in actual malicious functionality.

LLM Meta Prompt Extraction (AML.T0056); Defense Evasion

Adversaries extract the system prompt of an LLM-based application to understand its constraints, personas, or hidden instructions. This feeds reconnaissance for subsequent injection attacks.

[INSTRUCTOR INPUT: Which of these techniques have CAISP students run against the lab environment? Note the tool version, OS, and any unexpected behavior; even a one-line observation here is worth more than 3 paragraphs of generic description.]

ATLAS tools: Navigator and Arsenal

ATLAS Navigator

ATLAS Navigator is a free web interface at atlas.mitre.org that lets you visualize the ATLAS matrix, highlight techniques relevant to your environment, and export coverage layers. If you’ve used ATT&CK Navigator, this is the same interface applied to AI threats.

Practical uses for a security team:

• Create a custom layer showing which ATLAS techniques your current controls address
• Export to JSON for SIEM integration, Excel for analyst review, or SVG for stakeholder reports
• Combine ATLAS and ATT&CK layers to get a unified view of your threat coverage across traditional and AI-specific attack surfaces

[INSTRUCTOR INPUT: Screenshot of the ATLAS Navigator from PDSO’s lab with a brief annotation. Even a simple coverage layer showing which techniques CAISP labs test against would make this section uniquely valuable.]

Arsenal

Arsenal is a CALDERA plugin built by MITRE in collaboration with Microsoft, released in 2023. It implements ATLAS techniques as automated adversary emulation sequences, letting red teams run AI-specific attack chains without deep ML expertise.

What you can do with it: run pre-built adversary profiles against your AI systems, map results back to ATLAS technique IDs, and identify which defenses hold and which don’t. It integrates with existing CALDERA deployments, so teams already doing ATT&CK-based red teaming can add AI-specific scenarios without a new toolchain.

Framework crosswalk: ATLAS, OWASP LLM Top 10, and NIST AI RMF

These 3 frameworks cover the same threat landscape from different angles. You need all 3. Choosing one and ignoring the others leaves gaps.

Framework	Audience	Focus	Best applied during
MITRE ATLAS	Security operations, threat hunters	Adversary tactics and techniques against AI systems	Threat modeling, detection, red teaming
OWASP LLM Top 10	Developers, AppSec engineers	Prioritized vulnerability list for LLM applications	Secure development, code review
NIST AI RMF	Risk managers, compliance teams	AI risk governance and organizational controls	Governance, regulatory compliance

How they map on specific threats:

Threat	ATLAS technique	OWASP LLM	NIST AI RMF function
Prompt injection	AML.T0051	LLM01	Map, Measure
Training data poisoning	AML.T0020	LLM03	Manage
Supply chain compromise	ML Supply Chain Compromise	LLM05	Govern
Model theft	AML.T0035	LLM10	Manage
Sensitive data exposure via RAG	AML.T0060	LLM02	Manage

The CAISP course covers all 3 frameworks. This crosswalk reflects the coverage. Full course details here; note that this mapping comes from our own curriculum.

Agentic AI: what changed in 2025-2026

The October 2025 ATLAS update (in collaboration with Zenity Labs) added 14 techniques specifically for autonomous AI agents. This is not an incremental update. It reflects a structural shift in how AI systems are attacked.

The difference matters architecturally. A traditional LLM attack targets inputs and outputs. An agentic AI attack targets the agent’s ability to take actions: read files, send emails, query databases, call APIs. The attack surface is no longer just “what does the model say”; it’s “what does the model do.”

As of September 2026 (ATLAS release v2026.09), 139 of the 208 ATLAS technique entries carry the Agentic AI platform tag, ahead of Generative AI (106), Enterprise (85), and Predictive AI (82). Agentic AI is now the largest single attack surface in the framework.

Key agent-specific techniques to know:

• AI Agent Context Poisoning (AML.T0058): injecting malicious content into agent memory or thread context so that it persists across sessions and influences future actions
• Memory Manipulation: altering the agent’s long-term memory store to ensure malicious changes persist after the conversation ends
• RAG Database Prompting (AML.T0060): prompting an AI to retrieve sensitive internal documents from a Retrieval-Augmented Generation database
• Exfiltration via AI Agent Tool Invocation (AML.T0062): using the agent’s own authorized tools; send email, update CRM, write to storage; to leak data encoded into tool parameters
• Activation Triggers: embedding keywords or conditions that trigger an agent workflow automatically, without user initiation

MCP security and ATLAS

MCP (Model Context Protocol) is the open standard that connects AI agents to external tools and data sources. Since January 2026, MITRE has added 3 case studies covering MCP-specific attacks and several new techniques directly applicable to MCP infrastructure. MCP attack surfaces map to specific ATLAS techniques:

MCP attack type	ATLAS technique	What the adversary does
Tool poisoning	AML.T0061 (AI Agent Tools)	Exploits MCP server config to invoke unauthorized tool actions
Data exfiltration via tools	AML.T0062	Uses legitimate MCP write tools to leak data through sanctioned channels
Poisoned tool publication	Publish Poisoned AI Agent Tool (added Feb 2026)	Creates malicious MCP tool that appears legitimate in registries
C2 via AI service APIs	AML.T0096 (AI Service API, added 2026)	Uses AI orchestration APIs as covert command-and-control channels

MCP-specific security controls: validate all MCP server configurations before connection, apply least privilege to every tool permission, monitor tool invocation patterns for anomalies (unexpected data volumes, off-hours execution, tool calls to destinations outside normal workflow).

Case studies

ATLAS includes 40+ documented case studies at atlas.mitre.org. These are worth reading in full. The 3 below illustrate distinct attack patterns across the tactic lifecycle.

Cylance malware scanner bypass (AML.CS0003)

What happened: Researchers bypassed an ML-based malware detection product using adversarial examples without knowledge of the model’s internal architecture.

Attack chain: Reconnaissance (studying public documentation and API behavior) → ML Model Access (querying the inference API to deduce classification logic) → ML Attack Staging (crafting files with characteristics that reliably caused misclassification) → Defense Evasion (appending the bypass to real malware samples without changing their functionality)

What failed: The model had no adversarial robustness training, no anomaly detection on API query patterns, and no rate limiting that would surface systematic probing.

Fix: Retrain with adversarially crafted samples. Restrict API exposure. Monitor for systematic query patterns that suggest model boundary probing.

iProov deepfake attack on mobile KYC (Added November 2025)

What happened: Adversaries used face-swap AI tools to bypass liveness detection systems used by banking and fintech platforms for identity verification.

Attack chain: Reconnaissance (collecting target identity information via social media) → Resource Development (acquiring Faceswap and Deep Live Cam tools) → Initial Access (OBS virtual camera injection to bypass physical camera requirements) → Defense Evasion (AI-generated deepfakes defeated liveness detection algorithms) → Impact (fraudulent account creation and identity verification bypass)

What this case adds that Cylance doesn’t: The attacker doesn’t need access to the model. They only need to defeat its outputs using AI-generated synthetic media. The entire attack runs from outside the target system.

Fix: Multi-modal verification beyond facial recognition. Device attestation to detect virtual camera injection. Depth sensing for liveness checks.

SesameOp AI agent backdoor (AML.CS0042, Added late 2025)

What happened: Adversaries repurposed legitimate AI assistant APIs as covert command-and-control channels instead of building traditional C2 infrastructure. Malicious activity blended into normal AI workflow traffic.

Why this matters: This attack maps to the new AML.T0096 AI Service API technique (added 2026). It demonstrates a pattern where the attacker’s C2 traffic is indistinguishable from legitimate AI API calls at the network layer. Conventional C2 detection rules don’t catch it.

Fix: Behavioral baselining for AI API usage. Alerting on AI service calls from systems that don’t normally make them. Context-aware inspection of API payloads rather than just network-layer monitoring.

Implementing ATLAS in your organization

3 concrete starting points, in order of effort:

1. Map your AI assets to ATLAS (low effort)

Open ATLAS Navigator at atlas.mitre.org. Walk your AI systems one by one and highlight the techniques that apply based on each system’s architecture. An LLM chatbot with RAG surfaces AML.T0051 (prompt injection) and AML.T0060 (RAG exfiltration). A training pipeline surfaces AML.T0020 (data poisoning) and AML.T0018 (backdoor ML model). Export the layer and share it with your security team as a starting threat model.

2. Add ATLAS technique IDs to your incident tagging (low effort)

When an AI-related incident or near-miss occurs, tag it with the relevant AML.TXXXX ID. This builds an internal incident record mapped to ATLAS that you can use to prioritize detection work and track coverage improvements over time.

3. Run one Arsenal-based red team exercise (medium effort)

Use Arsenal against a non-production AI system to validate that your detection rules catch real attack patterns. Start with prompt injection (AML.T0051); it’s the most commonly observed technique and Arsenal has a pre-built profile for it. Document what fired and what didn’t. Update your detection rules based on results.

For teams building AI security skills from scratch, the CAISP course covers ATLAS alongside OWASP LLM Top 10 through hands-on labs. Disclosure: Practical DevSecOps offers that certification.

Conclusion

MCP attack surfaces map to specific ATLAS techniques:

MITRE ATLAS transforms AI security by addressing unique vulnerabilities like prompt injection and model extraction. The framework’s 14 tactics help organizations anticipate attacks and build resilient defenses. However, theoretical knowledge alone isn’t enough. 

You need practical experience to implement these defenses effectively. Enroll in the Certified AI Security Professional Course to master MITRE ATLAS through hands-on labs and real-world scenarios.

Also read about what AI Security Professionals Do?

FAQs