The 2026.09 release of MITRE ATLAS lists 16 tactics, the stages of an attack against an AI system. They run from getting access to a model, through reconnaissance, execution and exfiltration, to lateral movement. For an LLM app, they work as a checklist of where an attacker could be and where you could stop them.
The list, in data order
The tactic IDs in the release run from AML.TA0000 to AML.TA0015:
- AI Model Access
- AI Attack Adaptation
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Defense Evasion
- Discovery
- Collection
- Exfiltration
- Impact
- Privilege Escalation
- Credential Access
- Command and Control
- Lateral Movement
Some names will look familiar if you know enterprise attack matrices. A few are specific to AI. The list can change between releases, so treat this as a snapshot.
What they mean for an LLM app
AI Model Access and AI Attack Adaptation are the AI-specific ones. The first covers how an attacker reaches the model, for example through your public chat endpoint. The second covers how an attacker turns general methods and target knowledge into attacks fitted to your system. Rate limits and authentication on the endpoint address the first. Keeping technical detail about your stack private makes the second harder.
Reconnaissance and Resource Development happen before the attacker touches you. In RAG systems, one technique here is Gather RAG-Indexed Targets: finding out which data sources the system indexes, for example from public documentation. Limiting what you publish about your AI stack is a listed mitigation.
Initial Access and Execution cover the first foothold. LLM Prompt Injection sits here as a way to make the model act in unintended ways. Treat anything the model reads as input from an attacker unless you can prove otherwise.
Persistence is about keeping a foothold. ATLAS describes it as often involving poisoned training data or manipulated models. In a RAG system, the same idea applies to a poisoned entry in the index, which keeps influencing answers after the attacker has gone.
Defense Evasion includes LLM Jailbreak, which tries to get the model to ignore its safety behaviour or guardrails.
Discovery and Collection are about learning what the system can reach. If an agent has tools, an attacker asks what those tools are.
Exfiltration and Impact are where the damage shows up: leaked documents, destroyed data, wrong answers delivered to users.
Privilege Escalation, Credential Access, Command and Control, Lateral Movement matter most for agents. ATLAS notes that adversaries may pivot to AI infrastructure such as model registries, vector databases, notebooks and training pipelines. If your AI service holds credentials or can call other systems, a compromise of the model's context can reach those systems.
How to use the list
Draw your feature on one page: user, app, model, retrieval store, tools, outputs. For each tactic, write one line on what an attacker would try and one line on what you have that stops it. Where the second line is empty, you have a finding.
Do this with a developer in the room. They will spot the tool permissions and data sources that the architecture slide hides.
Quick check
Do I need to cover every tactic?
No. Cover the ones that fit your system. A chat widget with no tools has little lateral movement risk, but an agent with credentials has a lot.
Where do I find the technique list under each tactic?
In the ATLAS data release itself. Each technique is tagged to a tactic and lists the platforms it applies to, such as Generative AI or Agentic AI.
Sources
- MITRE ATLAS data repository (mitre-atlas/atlas-data), 2026.09 release data.
Last reviewed: 19 October 2026.
