To map a RAG app to MITRE ATLAS, draw the data path from source documents to index to model to user, then mark which ATLAS techniques touch each stage. Six techniques cover most of it: Gather RAG-Indexed Targets, Retrieval Content Crafting, RAG Poisoning, False RAG Entry Injection, RAG Credential Harvesting and RAG Databases collection.
Step 1: draw the path
Write down five boxes: where documents come from, the ingestion job, the vector store, the model with its prompt, and the user or agent that sees the answer. Add every tool the model can call. Without this, a mapping is guesswork.
Step 2: attach the techniques
These are the RAG-specific techniques in the 2026.09 ATLAS release.
Gather RAG-Indexed Targets. The adversary works out which data sources feed the system, from public documentation or by asking the system and watching for references to sources. This is the scouting step before poisoning.
Retrieval Content Crafting. The adversary writes content designed to be retrieved by user queries and to influence the user. ATLAS notes it can be combined with a prompt injection or stand alone as a document or email. It abuses the trust the user has in the system.
RAG Poisoning. Malicious content is placed in data the RAG system indexes, so it surfaces in later search results. The content may be false, may contain prompt injections, or may be false entries. ATLAS says it may be set up to show for a specific user query.
False RAG Entry Injection. A fake document is placed inside a normal entry so the model treats part of the retrieved text as a separate retrieved result. ATLAS notes that doing so bypasses data monitoring tools and prevents the document being deleted directly, since it lives inside a regular entry.
RAG Credential Harvesting. Credentials sitting in internal documents get ingested into the index, then retrieved by an agent on the adversary's behalf.
RAG Databases (collection). The adversary prompts the service to retrieve data from the index. ATLAS says this can include most of an organisation's internal documents.
Step 3: ask "can this happen here?"
For each technique, answer yes, no or unknown, and write down why.
- Who can write to the source locations the ingestion job reads? If the answer includes people outside your team, poisoning is plausible.
- Does ingestion strip formatting and hidden text, or does it index the raw file?
- Can the model's answer cite or reveal which source it used? That helps recon.
- Do your documents include secrets, and has anything scanned them first?
- Does retrieval check the asking user's permissions, or only the model's?
"Unknown" is a valid answer and usually the most useful one. Each unknown becomes a test in your next red team exercise.
Step 4: connect mitigations
ATLAS links mitigations to techniques. Several apply across the RAG path: Generative AI Guardrails that evaluate retrieved context as well as prompts and outputs, AI Telemetry Logging, Maintain AI Dataset Provenance, and Input and Output Validation performed outside the agent. The mitigations checklist for RAG goes through them.
Step 5: keep it alive
Store the mapping next to the architecture diagram. When someone adds a new data source or a new tool, rerun the five steps for that change only. The mapping takes about an hour for one app, and it does not go stale if it rides along with design reviews.
Quick check
Is a mapping the same as a test?
No. A mapping tells you which attacks are plausible. A red team exercise or a test suite tells you whether your controls stop them.
What if my app has no agent or tools?
You still have the retrieval techniques. Poisoning, crafted content and data collection do not need tools, only an index that someone else can write to or read from.
Sources
- MITRE ATLAS data repository (mitre-atlas/atlas-data), 2026.09 release data.
Last reviewed: 19 October 2026.
