What Is MITRE ATLAS?

What Is MITRE ATLAS, and Who Maintains It?

MITRE ATLAS, short for Adversarial Threat Landscape for Artificial-Intelligence Systems, is a public knowledge base of adversary tactics and techniques against AI systems, maintained by MITRE, which calls it the MITRE ATLAS framework in its news releases, and built from real-world attacks and AI red team demonstrations. It arranges that knowledge as a matrix of tactics and techniques, with mitigations and case studies linked to each technique. The long form of the name is the one in the citation format on MITRE's ATLAS general information page.

The ATLAS home page describes the project as "a globally accessible, living knowledge base of adversary tactics and techniques involving AI, including attacks against AI-enabled systems, abuse or manipulation of AI capabilities, and harmful autonomous behavior materially enabled by AI." The data files and the atlas-data README use a shorter expansion for the same project, Adversarial Threat Landscape for AI Systems.

MITRE runs the knowledge base with outside contributors, and its ATLAS contribute page names Microsoft, OWASP, NVIDIA, IBM, Bosch, Intel and the Software Engineering Institute at Carnegie Mellon University among them. NIST cites it as well: its adversarial machine learning taxonomy, NIST AI 100-2 E2025 (March 2025), says other evasion attacks demonstrated by researchers in malware classification "are cataloged in the MITRE Adversarial Threat Landscape for Artificial-Intelligence Systems (ATLAS) knowledge base."

ATLAS History and Its Link to MITRE ATT&CK

ATLAS began in October 2020 as the Adversarial ML Threat Matrix, built on the MITRE ATT&CK template, and had taken the ATLAS name by June 2021. The milestones below come from MITRE's own repository, site and news releases.

• Shared structure - the 2020 readme says "We used ATT&CK as a template since security analysts are already familiar with using this type of matrix", which is why both catalogs use tactics, techniques and mitigations.
• Adapted tactics - the ATLAS tactics page says the tactics "include AI-specific objectives" alongside tactics adapted from ATT&CK Enterprise "to reflect the AI context", and the ATLAS site marks adapted tactics and techniques with an ampersand.
• Combined data - the ATLAS general information page offers a STIX bundle, stix-atlas-attack-enterprise.json, that holds ATLAS and ATT&CK Enterprise together.
• The announced AI platform - the October 27, 2026 release presents the platform as an addition to ATT&CK Enterprise, and MITRE's CTO, Charles Clancy, says in it that "ATLAS remains a vital resource for the security of AI systems, providing frequent updates based on real-world attacks and red team demonstrations."

If your detections already carry ATT&CK IDs, keep them for the servers, accounts and networks around the model, and use ATLAS IDs for the model, prompts, retrieval and agent tools.

How Is the MITRE ATLAS Matrix Organized?

The ATLAS matrix puts tactics in columns and lists under each one the techniques and sub-techniques that reach it. The ATLAS glossary calls tactics the "why" of a technique and techniques the "how" an adversary reaches a tactical objective. Mitigations (AML.M) and case studies (AML.CS) are separate lists that reference techniques by ID.

The ID patterns are the "ID conventions" of the atlas-data README, which also defines entities (AML.E####) and software (AML.S####), object types new in the v2026.10 data format with 44 and 37 records. The ATLAS home page adds techniques and sub-techniques into one counter of 221. Each entry also carries fields worth filtering on, counted here from the v2026.10 data on 2026-11-05:

• Maturity - Feasible, Demonstrated or Realized. The glossary defines Realized as "Observed in real-world incidents, adversarial operations, or unintended consequences involving AI-enabled systems"; of the 221 entries, 117 are Realized, 78 Demonstrated and 26 Feasible.
• Platforms - Predictive AI, Generative AI, Agentic AI and Enterprise. The glossary describes Agentic AI as components that "autonomously plan, decide, and execute multi-step actions"; 30 entries carry that tag and no other.
• Tactics served - the README notes that "The same technique can support multiple tactical objectives", and in v2026.10, 19 entries serve more than one tactic: 10 techniques and 9 of their sub-techniques.
• Mitigation category - each mitigation is tagged Policy, Technical - AI or Technical - Cyber, and a mitigation can carry several: 24 carry Technical - AI, 15 Technical - Cyber and 10 Policy.

Maturity and platform are the two fields to filter on first. A threat model for a chat assistant can start with entries tagged Generative AI, while one for an agent that calls tools adds the Agentic AI entries, and the Realized ones have been seen outside a lab.

MITRE ATLAS Tactics in Matrix Order

ATLAS v2026.10 has 16 tactics. The table lists them in the order of the ATLAS matrix, with MITRE's one-line goal for each and the techniques and sub-techniques listed under it; the technique counts match the matrix column headers as read on 2026-11-05.

A technique listed under two tactics counts in both columns, so the columns add up to more than 221.

• Order is for display - the atlas-data README says "Matrix order is a presentation order; the procedure sequence for a specific activity is recorded in a Case Study." The IDs do not follow it either: AML.TA0001 sits third and AML.TA0000 fifth.
• Resource Development is the largest column - 35 entries, 24 of them sub-techniques, such as Obtain Capabilities: AI Agent Tools (AML.T0016.004) and Develop Capabilities: AI Agent Tools (AML.T0017.002).
• Defense Evasion has the most parent techniques - 21 techniques with a single sub-technique among them, so most evasion entries are separate methods.
• Execution holds the prompt injection entries - AML.T0051 and its three sub-techniques count toward Execution's 6 techniques and 7 sub-techniques.
• One tactic was renamed in 2026 - the v2026.08 release notes list AML.TA0001 as AI Attack Adaptation, "Previously 'AI Attack Staging'", so guides written before September 2026 use the old name.

ATLAS Release Data and How to Check the Counts

The ATLAS data lives in MITRE's atlas-data repository on GitHub, and each content release gets a tag there. Its README says "ATLAS releases monthly content updates" and that the content version "follows YYYY.MM.N versioning"; the ATLAS Versions page counts v2026.10 as the 38th release and lists ten releases dated 2026, from January 30 to October 28.

• Read the v6 file - at tag v2026.10, the first line of dist/ATLAS.yaml reads "This version of the ATLAS data is deprecated and is no longer being updated with new content", and the file still holds version 5.6.0. The current data is dist/v6/ATLAS-2026.10.yaml (format 6.1.0), the same file as the release asset MITRE links from its general information page.
• Pick a format - the general information page offers the YAML file, four STIX 2.1 bundles (including variants filtered to Realized techniques) and Excel workbooks.
• Cite the release - the same page asks: "When referencing ATLAS, include the release you used, the relevant object IDs, and your access date."
• Expect moved IDs - the v2026.10 release notes move Extract LLM System Prompt (AML.T0056) to AML.T0085.003, Data from AI Services: System Instructions, and LLM Data Leakage (AML.T0057) to AML.T0085.002, Conversation Context and Memory. Neither old ID is in the v2026.10 data, so a test plan that cites them needs updating.
• Diff each release - against v2026.09, v2026.10 grows the totals by nine techniques and four sub-techniques (its release notes list 11 new techniques and 7 new sub-techniques, some moved from retired IDs) and adds four mitigations (AML.M0040 to AML.M0043) and four case studies (AML.CS0073 to AML.CS0076).

The counts in this guide come from one run on 2026-11-05 against ATLAS-2026.10.yaml:

• Runtime - Node.js v25.5.0 with the yaml package, version 2.8.2.
• File - the v2026.10 release asset, whose SHA-256 hash begins ac41ee9f99a4.
• Relationships counted - achieves (technique to tactic), specializes (sub-technique to parent), employs (case study to technique) and mitigates (mitigation to technique).
• Other counts - maturity, platform tags and mitigation reach were read from the same file the same day.

To check the headline count yourself, save this script as count-t0051.mjs:

import { readFileSync } from 'node:fs';
import YAML from 'yaml';
const text = readFileSync(process.argv[2], 'utf8');
const d = YAML.parse(text, { maxAliasCount: -1 });
const ids = Object.keys(d['case-studies']);
const uses = (id) => (d.relationships[id]?.employs || [])
  .some((r) => r.target.startsWith('AML.T0051'));
const n = ids.filter(uses).length;
console.log(`${n} of ${ids.length} case studies`);

Then download the release file, install the yaml package and run the script in the same folder:

curl -LO https://github.com/mitre-atlas/atlas-data/\
releases/download/v2026.10/ATLAS-2026.10.yaml
npm install yaml
node count-t0051.mjs ATLAS-2026.10.yaml

It prints 33 of 77 case studies, the count this guide opens with. The longer summary script behind the other counts is not published; it reads the same file, makes no network calls and printed the output below.

MITRE ATLAS release data, version 2026.10
Collection modified 2026-10-28
Format 6.1.0
16 tactics, 129 techniques, 92 sub-techniques
44 mitigations, 77 case studies

Tactics in matrix order (T = techniques, S = subs)
#   ID          Tactic                  T   S  T+S
1   AML.TA0002  Reconnaissance          9   9   18
2   AML.TA0003  Resource Development   11  24   35
3   AML.TA0001  AI Attack Adaptation   11  14   25
4   AML.TA0004  Initial Access         10   8   18
5   AML.TA0000  AI Model Access         4   0    4
6   AML.TA0005  Execution               6   7   13
7   AML.TA0006  Persistence            13   9   22
8   AML.TA0012  Privilege Escalation    4   0    4
9   AML.TA0007  Defense Evasion        21   1   22
10  AML.TA0013  Credential Access       7   0    7
11  AML.TA0008  Discovery              11   7   18
12  AML.TA0015  Lateral Movement        6   4   10
13  AML.TA0009  Collection              9   8   17
14  AML.TA0014  Command and Control     5   0    5
15  AML.TA0010  Exfiltration            5   0    5
16  AML.TA0011  Impact                 10  10   20
A technique listed under two tactics counts in both.

AML.T0051 LLM Prompt Injection
Tactic: Execution (AML.TA0005)
Maturity: Realized
Platforms: Generative AI, Agentic AI
  AML.T0051.000  Direct
  AML.T0051.001  Indirect
  AML.T0051.002  Triggered

Case studies using AML.T0051 or a sub-technique:
  33 of 77
  AML.T0051      LLM Prompt Injection    1
  AML.T0051.000  Direct                 11
  AML.T0051.001  Indirect               19
  AML.T0051.002  Triggered               5
A case study can use more than one sub-technique.

Rank by case studies (subs rolled into parent):
  AML.T0051 is #2 of 119 techniques with a case study
  36  AML.T0048  External Harms
  33  AML.T0051  LLM Prompt Injection
  28  AML.T0065  LLM Prompt Crafting
  20  AML.T0010  Supply Chain Compromise
  20  AML.T0017  Develop Capabilities

Mitigations that list AML.T0051 (* = also all subs):
  AML.M0008  Validate AI Model
  AML.M0019  Control Access to AI Models and Data in
              Production
  AML.M0020  Generative AI Guardrails
  AML.M0021  Generative AI Guidelines
  AML.M0022  Generative AI Model Alignment
  AML.M0024* AI Telemetry Logging and Monitoring
  AML.M0033* Input and Output Validation for AI Agent
              Components
  AML.M0035* AI Red Team

The totals in the first lines match the v2026.10 release notes, and the per-tactic technique counts match the matrix column headers on the ATLAS site. When a new release lands, rerun the same counts and compare the tactic rows and the AML.T0051 block before you update a test plan.

AML.T0051: The MITRE ATLAS Prompt Injection Technique

AML.T0051 is the MITRE ATLAS prompt injection technique, named LLM Prompt Injection. The AML.T0051 technique page defines it this way: "An adversary may craft malicious prompts as inputs to an LLM that cause the LLM to act in unintended ways. These 'prompt injections' are often designed to cause the model to ignore aspects of its original instructions and follow the adversary's instructions instead."

The entry has changed since it was added. In release 2023.10 it sat under four tactics (Initial Access, Persistence, Privilege Escalation and Defense Evasion) with two sub-techniques; in v2026.10 it sits under Execution only, with three. Its description still notes that prompt injections "can be an initial access vector to the LLM that provides the adversary with a foothold to carry out other steps in their operation."

ATLAS Techniques That Target AI Agents

In the v2026.10 data, 29 techniques and sub-techniques have "agent" in their own names, and 148 of the 221 entries are tagged for the Agentic AI platform. The agent entries reach across the matrix, from probing an agent's trigger channels during Reconnaissance to destroying data through its tools under Impact. This selection spans the tactics, with names as released and sub-technique names or notes in parentheses:

• AI Agent Tool Invocation - MITRE writes that "Adversaries may use their access to an AI agent to invoke tools the agent has access to." In v2026.10, 13 mitigations reference AML.T0053 and 18 case studies use it; in release 2023.10 the same ID was named LLM Plugin Compromise.
• Tool poisoning names MCP servers - AML.T0110 says poisoned tools "may include built-in integrations, locally installed packages, remotely hosted services, Model Context Protocol (MCP) servers and tools, and agent skills or similar capability packages." Which MCP servers an agent may load, and what each may touch, is the subject of the MCP security guide.
• Write access turns into exfiltration - AML.T0086 reads "AI agent tools capable of performing write operations may be invoked to exfiltrate data to an adversary", and 10 case studies use it.
• Injected instructions spread - AML.T0143 LLM Prompt Propagation, new in v2026.10, covers instructions already planted in an AI environment that are "transferred onward to additional storage locations, agents, applications, or resources where they can influence subsequent AI activity."
• An agent can be the command channel - AML.T0108, released under the bare name AI Agent, covers adversaries who "may abuse AI agents present on the victim's system for command and control."
• Agent mitigations exist too - the catalog includes AML.M0028 Enforce Access Controls for AI Agent Tools, AML.M0029 Human In-the-Loop for AI Agent Actions, AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data and, new in v2026.10, AML.M0043 AI Agent External Resource Lifecycle Management.

To map these entries to your own system, start from an inventory of the agent tools your agent can call: for each tool, note whether it reads untrusted content (AML.T0051.001), writes or sends data (AML.T0086) or deletes it (AML.T0101).

How Security Teams Use ATLAS

Security teams use ATLAS as a shared vocabulary: an ID for every threat in a model, every red team objective, every test and every incident note. MITRE's AI Incident Sharing release describes ATLAS as "a community knowledge base of adversary behaviors that security professionals, developers, and operators use as they protect AI-enabled systems."

The tools MITRE publishes around ATLAS cover visualization, adversary emulation, incident reporting and case study writing.

• ATLAS Navigator - the general information page says it lets you "Visualize and annotate techniques in customizable matrix layers"; its ATLAS Navigator repository describes it as based on the ATT&CK Navigator. Annotate each technique with its test status in a layer to show coverage.
• Arsenal - announced on March 2, 2023, Arsenal is a MITRE CALDERA plug-in that "implements tactics and techniques defined in the MITRE ATLAS framework", according to the MITRE Arsenal release. It was built off Microsoft's Counterfit, and its repository was last updated in August 2023.
• AI Incident Sharing - the October 2024 release says "Anyone can submit an incident via the public incident sharing site."
• Knowledge graph and Case Study Builder - the information page offers a knowledge graph to "Investigate relationships between ATLAS objects", and MITRE's AI Security 101 page takes case study contributions through an "interactive Case Study Builder tool".

MITRE ATLAS vs the OWASP Top 10 for LLM Applications 2025

ATLAS catalogs how adversaries attack AI systems, technique by technique, while the OWASP Top 10 for LLM Applications 2025 names the ten risk categories an LLM application team should address. Use the OWASP list to decide which risks matter most and ATLAS IDs to name the exact attack you will simulate.

OWASP published a 2026 edition, the OWASP GenAI LLM Top 10 2026, on August 3, 2026. This comparison uses the 2025 list, whose entry pages are the source of the ATLAS IDs in the second table below.

The OWASP list names its entries LLM01:2025 Prompt Injection, LLM02:2025 Sensitive Information Disclosure, LLM03:2025 Supply Chain, LLM04:2025 Data and Model Poisoning, LLM05:2025 Improper Output Handling, LLM06:2025 Excessive Agency, LLM07:2025 System Prompt Leakage, LLM08:2025 Vector and Embedding Weaknesses, LLM09:2025 Misinformation and LLM10:2025 Unbounded Consumption. Several entry pages, such as the LLM01:2025 entry page, end with a Related Frameworks and Taxonomies section that names ATLAS IDs. The middle column below gives those IDs; LLM06:2025 Excessive Agency names none, so its row is this guide's reading. OWASP's pages use older ATLAS names (AML.T0018 appears there as Backdoor ML Model, which v2026.10 calls Manipulate AI Model), so check each ID against the current release.

For a test per OWASP risk, and for how each 2025 ID maps to the 2026 edition, see the LLM security guide.

Limits of ATLAS as a Test Plan

ATLAS describes adversary behavior and sets no requirements, so it is not a checklist to finish or a standard to comply with, and no ATLAS page from MITRE offers a certification or an official score. Mapping tests to ATLAS IDs records which attacks you simulated without proving the system secure.

• The catalog keeps moving - with monthly content releases, a plan that touches every technique this month can be short the next, as the v2026.10 additions listed in the release-data section show.
• A mapped test covers what it tried - a test labeled AML.T0051.001 covers only the channels and payloads you used, while an agent may read many more. Record which documents, emails, web pages or tool outputs each test planted instructions in.
• Model-level techniques need model-level tests - Training Data Poisoning (AML.T0020), Replicate AI Model Behavior (AML.T0005), Recover AI Model Internals (AML.T0144) and the data and model repository sub-techniques of Supply Chain Compromise (AML.T0010.002, AML.T0010.003) attack the model, its data or its supply chain. Tests of an application or agent do not reach them, so they need controls and tests at the model, data and supply-chain level.
• Case study counts are not attack rates - most case studies are exercises, so the counts show what researchers and red teams demonstrated and documented; they say nothing about how often an attack happens in production.

Testing AI Agents Against ATLAS Techniques With Agent Assurance

For an agent that calls tools, an ATLAS test should pass or fail on what the agent did, such as whether a data exfiltration attempt actually sent data; its reply can claim either outcome. Agent Assurance from TestMu AI runs scenarios against your agent before release and checks each criterion against observed effects (files, artifacts, read-only checks of records) and the agent's declared tool surface, never against the agent's own account.

• Adversarial scenarios by default - the adversarial scenarios Rook CLI plans carry references to MITRE ATLAS, the OWASP Top 10 for LLM Applications (2025) and the OWASP Top 10 for Agentic Applications (2026). A plain rook generate defaults to --class functional,adversarial, but it can plan no attack for a small agent, so ask for attacks with --class adversarial.
• Standards per attack - from Rook CLI 0.1.11, every generated attack carries a redteam block naming the OWASP LLM entries (LLM01 to LLM10), OWASP Agentic entries (ASI01 to ASI10) and ATLAS techniques it exercises. Per the Agent Assurance scenario docs, those attacks draw on 25 attack patterns.
• An ATLAS ID in a sample run - in the docs' triage-service sample on Rook CLI 0.1.11, a prompt-injection scenario's Attack intent panel lists OWASP LLM01, OWASP ASI01 and MITRE ATLAS AML.T0051.001.
• Gaps stay unverified - runs that include attacks report an OWASP red-team coverage table, plus a Known coverage gaps (unverified) list, and any control without a mapped scenario counts as unverified. That table is organized by OWASP entry alone, so treat any ATLAS technique that no scenario exercised as untested.
• Some patterns need hooks - an attack pattern that depends on seeded data, independently collected evidence (from a collect hook) or a fresh session is skipped until the profile supplies the matching hook, and the run's coverage gaps list each pattern with no runnable scenario, with the reason.
• Verdicts - each criterion closes with Pass, Fail or Unable to Verify; the third never enters the pass rate, and a CI gate can block on the failing adversarial verdicts in the report.

Most eval and observability tools look at what an agent replied and what its traces logged, while Agent Assurance grades what the run changed and keeps apart what it could not verify. Its OWASP and ATLAS mapping is security coverage rather than a compliance report, and Agent Assurance is not a penetration test either: it does not scan code or dependencies, block attacks at runtime or test the underlying model.

The 14-day free trial of Agent Assurance carries the Pro features and 4,000 credits, and the self-serve plans that follow it are on the Agent Assurance pricing page. Rook CLI, its command-line tool, installs from npm on Node.js 20 or newer:

npm install -g @testmuai/rook@latest

The agent you point it at is yours, and its writes are real, so run adversarial scenarios against staging.

A First ATLAS Review for One AI System

Download ATLAS-2026.10.yaml, list the AI components of one system, and ask, tactic by tactic, which component would give an attacker that goal. For an LLM application or agent, put AML.T0051 and its three sub-techniques first and copy AML.M0035's instructions into your test plan, recording each result with its technique ID.

Read each monthly release note for new and moved IDs before you update the plan. If the system is an agent, add Rook CLI (npm install -g @testmuai/rook@latest) to the release process and run its adversarial scenarios against staging each time.

Note: Anubhav Singhmaar, AI Product Manager at TestMu AI with expertise in agentic AI and large language models, reviewed, fact-checked, and approved this article, which was researched and drafted with AI assistance. Our editorial process and AI use policy describes how every claim is verified before publication. Vipul Verma (Group Senior Vice President of Engineering, TestMu AI) reviewed it for technical accuracy. Its claims rest on MITRE's ATLAS site, release data, GitHub repositories and news releases, on OWASP and NIST publications, and on TestMu AI's product documentation.