MITRE ATLAS explained: The complete guide to AI security threat intelligence

Organizations deploying artificial intelligence face a new frontier of security threats that traditional frameworks were never designed to address. AI-enabled adversary attacks surged 89% compared to prior years according to industry threat intelligence research, up from a 72% increase reported in 2025. This escalation demands a structured approach to understanding and defending against adversarial threats to AI systems. Enter MITRE ATLAS — the Adversarial Threat Landscape for Artificial-Intelligence Systems — a comprehensive adversarial ML knowledge base designed specifically to catalog how attackers target machine learning and AI systems.

For security teams already familiar with MITRE ATT&CK, ATLAS (sometimes referenced as Atlas MITRE in search) provides a natural extension into AI security territory. This guide delivers everything security analysts, SOC leaders, and AI engineers need to operationalize ATLAS against adversarial AI attacks — from framework fundamentals to practical detection strategies.

What is MITRE ATLAS?

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a globally accessible adversarial ML knowledge base that documents adversary tactics, techniques, and procedures (TTPs) specifically targeting artificial intelligence and machine learning systems. Modeled after the widely adopted MITRE ATT&CK framework, this adversarial AI knowledge base provides security teams with a structured approach to understanding, detecting, and defending against AI-specific threats. The MITRE ATLAS framework serves as the definitive machine learning security framework for AI threat modeling.

As of version 5.1.0 (November 2025), the framework contains 16 tactics, 84 techniques, 56 sub-techniques, 32 mitigations, and 42 real-world case studies according to the official MITRE ATLAS CHANGELOG, up from 15 tactics and 66 techniques in October 2025. The February 2026 update (v5.4.0) added further agent-focused techniques. This rapid growth reflects the accelerating evolution of AI threats.

Adversarial machine learning — the study of attacks on machine learning systems and defenses against them — encompasses four main attack categories as documented by NIST: evasion, poisoning, privacy, and abuse attacks. ATLAS organizes these attack patterns into a matrix structure that security practitioners can immediately put to use.

MITRE created ATLAS to address a critical gap in the security landscape. While ATT&CK effectively catalogs threats to traditional IT and OT infrastructure, it lacks coverage of attacks that exploit the unique characteristics of machine learning systems. ATLAS fills this void by providing the same rigorous, community-validated approach to AI threat intelligence.

The framework also connects to MITRE D3FEND, which provides defensive countermeasures that organizations can map against ATLAS techniques.

ATLAS vs MITRE ATT&CK: Key differences

Understanding the distinction between ATLAS and ATT&CK helps security teams determine when to apply each framework.

Table: Comparison of MITRE ATT&CK and MITRE ATLAS frameworks

ATLAS inherits 13 tactics from ATT&CK — including Reconnaissance, Initial Access, Execution, and Exfiltration — but applies them specifically to AI contexts. The two AI-specific tactics unique to ATLAS are:

• ML Model Access (AML.TA0004): Describes how adversaries gain access to target ML models through inference APIs or direct artifact access
• ML Attack Staging (AML.TA0012): Covers how adversaries prepare attacks targeting ML models, including training data poisoning and backdoor insertion

Security teams should use both frameworks together for comprehensive coverage — ATT&CK for traditional infrastructure threats and ATLAS for AI-specific attack vectors.

How ATLAS works: Framework structure and the MITRE ATLAS matrix

The MITRE ATLAS official knowledge base organizes threat intelligence using the same matrix structure that made ATT&CK successful. Understanding this structure enables effective threat detection and AI threat modeling.

The MITRE ATLAS matrix (sometimes called the MITRE framework matrix for AI or the AI threat matrix) displays tactics as columns and techniques as rows. Each cell represents a specific method adversaries use to achieve tactical goals against AI systems. This visual organization allows security teams to quickly identify coverage gaps and prioritize defenses.

The framework components work together:

1. Tactics answer the "why" — the adversary's goal at each attack stage
2. Techniques answer the "how" — specific methods to achieve tactical goals
3. Sub-techniques provide granular detail on technique variations
4. Mitigations describe defensive measures that counter specific techniques
5. Case studies document real-world attacks mapped to ATLAS TTPs

ATLAS data is available in STIX 2.1 format, enabling machine-readable integration with security tools and platforms. This standardized format supports automated ingestion into threat intelligence platforms and SIEM systems.

The framework receives regular updates through community contributions and MITRE's ongoing research. The October 2025 update through Zenity Labs collaboration added 14 new agent-focused techniques, followed by the November 2025 v5.1.0 release that expanded the framework to 16 tactics with 84 techniques. The February 2026 v5.4.0 update added further techniques including "Publish Poisoned AI Agent Tool" and "Escape to Host," demonstrating the framework's active evolution.

Understanding tactics, techniques, and procedures (TTPs)

Tactics, techniques, and procedures (TTPs) form the core vocabulary of threat-informed defense. In ATLAS:

• Tactics represent adversary goals at each phase of an attack against AI systems. The 16 ATLAS tactics span from initial reconnaissance through ultimate impact and command and control.
• Techniques describe the specific actions adversaries take to achieve tactical goals. Each technique has a unique identifier in the format AML.TXXXX.
• Sub-techniques break down techniques into more specific variations. For example, prompt injection (AML.T0051) includes sub-techniques for direct and indirect injection methods.
• Procedures appear in case studies, showing exactly how real-world attackers implemented specific techniques.

This hierarchy enables progressively detailed threat modeling. Teams can start with tactic-level coverage analysis and drill down to specific techniques based on their AI system's exposure.

The 16 ATLAS tactics and key techniques

ATLAS organizes 84 techniques across 16 tactics that span the complete adversarial lifecycle, up from 15 tactics and 66 techniques in October 2025. This comprehensive breakdown addresses a significant content gap identified in competitor analysis — no existing guide covers all tactics with detection-focused guidance.

Table: MITRE ATLAS tactics with key techniques

The November 2025 v5.1.0 release added a 16th tactic — Command and Control (AML.TA0015) — along with 18 new techniques and 6 new mitigations focused on AI agent security controls. This brought the total from 66 to 84 techniques and from 33 to 42 case studies.

Reconnaissance through Initial Access (AML.TA0001-AML.TA0003)

The attack lifecycle begins with reconnaissance, where adversaries gather information about target ML systems. Key techniques include:

• Discover ML Artifacts: Adversaries search public repositories, documentation, and APIs to understand model architectures and training data
• ML Supply Chain Compromise: Attackers target supply chain attacks by inserting malicious code or data into ML pipelines
• Prompt Injection (AML.T0051): Adversaries craft malicious inputs to manipulate LLM behavior — this maps to OWASP LLM01

ML Model Access and Execution (AML.TA0004-AML.TA0005)

These AI-specific tactics describe how adversaries interact with and exploit ML models:

• Inference API Access: Gaining access to model prediction interfaces enables reconnaissance and attack staging
• LLM Plugin Compromise: Exploiting vulnerable plugins extends attacker capabilities within AI systems

Persistence through Defense Evasion (AML.TA0006-AML.TA0008)

Threat actors maintain access and avoid detection through:

• Modify AI Agent Configuration (October 2025 addition): Attackers alter agent settings to maintain persistence
• Adversarial Perturbation: Crafting inputs that cause models to misclassify while appearing normal to humans

Collection through Impact (AML.TA0009-AML.TA0014)

Later-stage tactics focus on achieving adversary objectives:

• RAG Database Retrieval: Extracting sensitive information from retrieval-augmented generation systems
• Poison Training Data (AML.T0020): Data poisoning corrupts training data to manipulate model behavior — a critical data exfiltration vector
• Exfiltration via AI Agent Tool Invocation (October 2025 addition): Leveraging agent tool access to extract data

Understanding lateral movement patterns helps security teams track how attackers progress through these tactics.

ATLAS tools ecosystem

ATLAS provides free, practical tools that transform the framework from documentation into actionable security capabilities. This tools ecosystem addresses a major content gap — few competitors cover these resources comprehensively.

Table: MITRE ATLAS official tools ecosystem

ATLAS Navigator walkthrough

The ATLAS Navigator provides an interactive web interface for visualizing the framework matrix. Security teams use Navigator for:

1. Coverage mapping: Create custom layers showing which techniques your security controls address
2. Threat modeling: Highlight relevant techniques based on your AI system's architecture
3. Gap analysis: Identify techniques without corresponding detection capabilities
4. Reporting: Export visualizations for stakeholder communication

Navigator integrates with the ATT&CK Navigator, enabling unified views across both frameworks. Teams already using ATT&CK Navigator will find the ATLAS interface immediately familiar.

Arsenal for AI red teaming

In March 2023, Microsoft and MITRE announced collaboration on Arsenal — a CALDERA plugin enabling automated adversary emulation against AI systems. Arsenal implements ATLAS techniques without requiring deep machine learning expertise.

Key capabilities include:

• Pre-built adversary profiles based on ATLAS tactics
• Automated attack chain execution for purple team exercises
• Results mapped directly to ATLAS technique IDs
• Integration with existing CALDERA deployments

Arsenal supports threat hunting by validating detection coverage against realistic attack simulations. For incident response teams, Arsenal helps understand attacker capabilities and test response procedures.

AI Incident Sharing Initiative

The AI Incident Sharing Initiative enables organizations to share and learn from AI security incidents. This community-driven platform provides:

• Anonymized incident reports with ATLAS technique mapping
• Searchable database of AI vulnerabilities and attacks
• Integration with CVE and CWE AI Working Groups
• Trend analysis across reported incidents

This intelligence feeds directly into ATLAS updates, ensuring the framework reflects current threat patterns.

Framework comparison: ATLAS vs OWASP LLM Top 10 vs NIST AI RMF

Security teams often ask which AI security framework to adopt. The answer: use all three for complementary coverage. This comparison helps teams understand when to apply each framework, addressing a common PAA question.

Table: AI security framework comparison: ATLAS vs OWASP vs NIST AI RMF

According to Cloudsine's framework analysis, these frameworks serve different phases of the AI security lifecycle:

• Development phase: OWASP LLM Top 10 guides secure coding practices
• Operations phase: ATLAS informs threat modeling and detection strategies
• Governance phase: NIST AI RMF structures risk management and compliance

Crosswalk table: Mapping across frameworks

Table: Framework crosswalk for common AI vulnerabilities

Understanding vulnerabilities across all three frameworks enables comprehensive coverage. Teams should map their AI assets to relevant techniques in each framework.

SOC integration and operationalization

Integrating ATLAS into security operations requires mapping techniques to detection capabilities and workflows. According to ThreatConnect's SOC integration guide, approximately 70% of ATLAS mitigations map to existing security controls. The remaining 30% require new AI-specific controls.

Steps for SOC integration:

1. Inventory AI assets: Document all ML models, training pipelines, and AI-enabled applications
2. Map techniques to assets: Identify which ATLAS techniques apply based on your AI architecture
3. Assess current coverage: Use Navigator to visualize existing detection capabilities
4. Prioritize gaps: Focus on high-impact techniques relevant to your environment
5. Develop detection rules: Create SIEM rules and alerts for priority techniques
6. Establish baselines: Define normal behavior for AI system telemetry
7. Integrate with workflows: Add ATLAS context to alert triage and investigation procedures
8. Review quarterly: Update threat models as ATLAS evolves

Detection rule mapping

Effective detection requires mapping ATLAS techniques to specific log sources and detection logic.

Table: Example detection mapping for priority ATLAS techniques

Network detection and response capabilities complement application-layer detection. User and entity behavior analytics (UEBA) helps identify anomalous access patterns to AI systems.

Metrics and coverage tracking

Track these metrics to measure ATLAS operationalization:

• Technique coverage: Percentage of relevant techniques with detection rules
• Detection latency: Time from attack execution to alert generation
• False positive rate: Alert accuracy for AI-specific detections
• Threat model currency: Days since last ATLAS-informed update

Quarterly threat model reviews ensure coverage keeps pace with framework updates and emerging threats.

Case studies and lessons learned

ATLAS includes 42 case studies documenting real-world attacks against AI systems, up from 33 in October 2025. Analyzing these incidents provides actionable defensive insights that go beyond theoretical threat modeling.

iProov deepfake case study analysis

In November 2025, MITRE ATLAS published a case study documenting deepfake attacks against mobile KYC (Know Your Customer) liveness detection systems. According to Mobile ID World's coverage, this attack targeted banking, financial services, and cryptocurrency platforms.

Attack chain progression:

Reconnaissance -> Resource Development -> Initial Access -> Defense Evasion -> Impact

1. Reconnaissance: Attackers gathered target identity information from social engineering via social media profiles
2. Resource Development: Adversaries acquired face-swap AI tools (Faceswap, Deep Live Cam)
3. Initial Access: OBS virtual camera injection bypassed physical camera requirements
4. Defense Evasion: AI-generated deepfakes defeated liveness detection algorithms
5. Impact: Successful fraudulent account creation and identity verification bypass

Defensive recommendations:

• Implement multi-modal verification beyond facial recognition
• Deploy device attestation to detect virtual camera injection
• Monitor for signs of synthetic media in biometric captures
• Establish enhanced liveness detection with depth sensing

This case study demonstrates how attackers combine social engineering with AI tools to defeat security controls, potentially leading to data breaches.

SesameOp AI agent backdoor case study (AML.CS0042)

The SesameOp case study, added to ATLAS in late 2025, documents a novel backdoor technique that leverages AI assistant APIs for command and control. Instead of building traditional C2 infrastructure, adversaries repurposed legitimate agent service APIs as covert control channels — blending malicious activity into normal AI workflows. This attack pattern maps to the new AI Service API technique (AML.T0096) and demonstrates how agentic AI infrastructure creates command and control channels that evade conventional network detection.

Additional notable case studies (2025-2026)

ATLAS expanded from 33 to 42 case studies between October 2025 and February 2026. Notable additions include:

• Financial Transaction Hijacking with M365 Copilot as an Insider — demonstrating how AI assistants can be exploited for unauthorized financial operations
• Organization Confusion on Hugging Face — highlighting risks from model repository misuse in supply chain attacks
• MCP Server Compromise (January 2026) — documenting attacks against Model Context Protocol infrastructure

Cylance endpoint product bypass

The HiddenLayer analysis of ATLAS case study AML.CS0003 documents how researchers bypassed an ML-based endpoint security product:

• Attackers used adversarial perturbation techniques to craft malware that evaded detection
• The attack demonstrated model evasion without knowledge of the underlying model architecture
• Defensive lessons include model diversity and input validation for ML-based security tools

Detecting and preventing AI threats

AI security threats require specialized detection approaches that go beyond traditional security controls. With AI-enabled adversary attacks surging 89% compared to prior years — up from a 72% increase in 2025 — organizations need proactive defense strategies.

Defense checklist for AI security:

• [ ] Implement input validation and sanitization for all LLM interactions
• [ ] Deploy prompt injection detection at the application layer
• [ ] Establish training data provenance and integrity monitoring
• [ ] Monitor inference API access patterns for anomalies
• [ ] Audit AI agent configurations and permissions regularly
• [ ] Integrate AI-specific alerts with existing SOC workflows
• [ ] Conduct regular AI red team exercises using Arsenal
• [ ] Subscribe to AI threat intelligence feeds

Organizations should align AI security investments with both phishing prevention (AI-generated phishing is rising rapidly) and ransomware defense (AI enables more sophisticated attacks).

Prompt injection techniques in MITRE ATLAS (AML.T0051)

Prompt injection is the most prominent ATLAS technique, cataloged as AML.T0051 under the Initial Access tactic. Large language models face unique attack vectors that traditional security cannot address, and ATLAS catalogs these threats systematically.

Table: LLM threat types with ATLAS mapping and detection methods

Recent CVEs demonstrate these threats in practice:

• CVE-2025-32711 (EchoLeak): According to Hack The Box analysis, this Microsoft Copilot vulnerability enabled zero-click data exfiltration through prompt injection combined with prompt reflection
• CVE-2025-54135/54136 (CurXecute): Per BleepingComputer reporting, the Cursor IDE's MCP implementation allowed remote code execution via prompt injection

Identity threat detection and response capabilities help detect credential theft attempts through LLM exploitation.

Agentic AI security considerations

The October 2025 ATLAS update specifically addresses autonomous AI agents — systems that can take actions, access tools, and persist context across sessions. New techniques include:

• AML.T0058 AI Agent Context Poisoning: Injecting malicious content into agent memory or thread context
• AML.T0059 Activation Triggers: Embedding triggers that activate under specific conditions
• AML.T0060 Data from AI Services: Extracting information through RAG database retrieval
• AML.T0061 AI Agent Tools: Exploiting agent tool access for malicious purposes
• AML.T0062 Exfiltration via AI Agent Tool Invocation: Using legitimate tool calls to extract data

Security principles for AI agents:

1. Apply least privilege to all agent tool permissions
2. Implement human-in-the-loop for sensitive operations
3. Monitor agent configuration changes continuously
4. Validate MCP server configurations and connections
5. Establish agent behavior baselines for anomaly detection

According to CISA's December 2025 AI/OT guidance, organizations should embed oversight and failsafes for all AI systems operating in critical environments.

MCP security and ATLAS technique mapping

The Model Context Protocol (MCP) — an open standard for connecting AI agents to external tools and data sources — introduces attack surfaces that ATLAS now explicitly addresses. MCP exploits allow adversaries to manipulate the tool-calling layer between AI agents and enterprise systems, bypassing traditional security controls.

ATLAS techniques relevant to MCP security include:

• AI Agent Tools (AML.T0061): Adversaries exploit MCP server configurations to invoke unauthorized tool actions or access restricted data
• Exfiltration via AI Agent Tool Invocation (AML.T0062): Attackers leverage legitimate MCP tool calls to extract sensitive data through sanctioned channels
• Publish Poisoned AI Agent Tool (added February 2026): Adversaries create malicious versions of legitimate MCP tools that appear safe but execute harmful actions when invoked
• AI Service API (AML.T0096, added 2026): Exploiting AI orchestration APIs for stealthy command and control

The January 2026 ATLAS update (v5.3.0) added three new case studies specifically covering MCP server compromises, indirect prompt injection via MCP channels, and malicious AI agent deployment. Security teams should validate all MCP server configurations, restrict tool permissions to least privilege, and monitor tool invocation patterns for anomalies.

Modern approaches to AI security

The AI security landscape evolves rapidly, with regulatory pressure and industry collaboration driving framework adoption. Organizations must prepare for both emerging threats and compliance requirements.

The MITRE Secure AI Program, supported by 16 member organizations including Microsoft and JPMorgan Chase, focuses on expanding ATLAS with real-world observations and expediting AI incident sharing.

Regulatory developments:

• EU AI Act: GPAI (General Purpose AI) obligations became active in August 2025, requiring adversarial testing for systemic-risk AI systems and cybersecurity protection against unauthorized access
• CISA guidance: The December 2025 multi-agency publication addresses AI security in operational technology environments

AI security threats continue to accelerate, with 87% of organizations reporting AI-powered cyberattack exposure and 92% expressing concern over agentic AI security implications according to industry research.

How Vectra AI approaches AI security threats

Vectra AI's Attack Signal Intelligence methodology applies behavior-based detection principles that align with ATLAS framework objectives. By focusing on attacker behaviors rather than static signatures, organizations can detect the techniques cataloged in ATLAS — from prompt injection attempts to data exfiltration via inference APIs — across hybrid cloud environments.

This approach enables security teams to identify and prioritize real AI-related threats while reducing alert noise. Network detection and response combined with identity threat detection provides visibility across the attack surface that AI threats now target.

Conclusion

MITRE ATLAS provides the structured approach organizations need to defend AI systems against sophisticated adversaries. With 16 tactics, 84 techniques, and continuous updates reflecting emerging threats like agentic AI attacks and MCP exploits, the framework delivers actionable intelligence for security teams.

The rapid expansion from 15 tactics in October 2025 to 16 tactics and 84 techniques by February 2026 demonstrates ATLAS's commitment to keeping pace with AI evolution. As AI-assisted attacks continue to surge and regulatory requirements like the EU AI Act take effect, organizations cannot afford to treat AI security as an afterthought.

Start with these immediate actions:

1. Explore the ATLAS Navigator to understand framework structure
2. Inventory your AI assets and map relevant techniques
3. Assess current detection coverage against priority techniques
4. Integrate ATLAS context into existing SOC workflows

For organizations seeking comprehensive AI security beyond framework adoption, Vectra AI's Attack Signal Intelligence provides behavior-based detection that identifies the adversary techniques ATLAS catalogs — enabling security teams to find and stop AI threats across hybrid environments.