Defenders use MITRE ATLAS by treating it as a menu of attacker behaviors against AI systems. Draw your system, list the tactics that touch it, pick the techniques that are plausible for your setup, and give each one a preventive control and a detection source. Ten honest rows beat a full matrix.
What is ATLAS, in practice?
ATLAS is MITRE's knowledge base of adversary tactics and techniques against AI systems, built in the style of ATT&CK. The data file I fetched from MITRE's public repository is version 5.6.0 and lists 16 tactics, from Reconnaissance and Resource Development through Execution, Exfiltration and Impact. MITRE marks that file as deprecated in favor of newer data, so confirm counts and technique names on the ATLAS site before you quote them.
The tactic list includes two that ATT&CK lacks: AI Model Access and AI Attack Staging. Everything else will feel familiar to anyone who has mapped incidents before.
Step 1: Draw what you run
Write down five things: where models come from, what data they see, which tools an agent can call, where output goes, and who can change configuration. Techniques only matter if they touch one of those.
Step 2: Pick techniques that fit
These entries, taken from the ATLAS data, map well to the systems most teams now run. Descriptions are paraphrased from MITRE.
- AML.T0051 LLM Prompt Injection (direct and indirect). Untrusted text steers the model. Control: treat model output as untrusted input to every downstream system.
- AML.T0053 AI Agent Tool Invocation. An attacker with access to an agent invokes the tools it can reach. Control: give agents narrow tools and per tool permissions.
- AML.T0010 AI Supply Chain Compromise. Hardware, software, data or model sources are tampered with. Control: pin versions, record hashes, keep an inventory.
- AML.T0011.001 Malicious Package. A package that looks useful for an AI task but harms the importer. Control: allow lists and review for new dependencies.
- AML.T0060 Publish Hallucinated Entities. An adversary registers something an LLM tends to invent, such as a package name. Control: verify that a package exists and has history before install.
- AML.T0098 AI Agent Tool Credential Harvesting and AML.T0083 Credentials from AI Agent Configuration. Secrets reachable through agent tools or config files. Control: short lived credentials, no secrets in agent config.
- AML.T0081 Modify AI Agent Configuration. Persistent changes to prompts, knowledge sources or tool settings. Control: treat agent config as code with review.
- AML.T0101 Data Destruction via AI Agent Tool Invocation. A tool that can delete gets used to delete. Control: no destructive tools without a human approval step.
- AML.T0105 Escape to Host. Breaking out of a container or virtual environment. Control: isolation plus patching of the runtime.
- AML.T0034 Cost Harvesting, including an agentic resource consumption sub technique. Control: budgets and rate limits per identity.
Step 3: Add a detection source to every row
A control without a log is a hope. For each technique, name the event you would see: a tool call record, a package install event, a config file diff, a spike in tokens per user. If you cannot name one, that row is a gap, and the gap is the finding.
Step 4: Test one row a month
Pick a technique and run a controlled test in a non production environment. Did the control block it? Did the log fire? Did anyone see the alert? Write the result next to the row. Over a quarter you get evidence, which auditors and boards value more than a matrix screenshot.
What ATLAS does not do
It does not rank risk for you, and it does not tell you which controls are cheap. Pair it with a risk process and with the OWASP guidance on excessive agency, which spells out preventive measures like minimizing tools and requiring approval for high impact actions.
What to do
- Draw your AI system on one page.
- Pull the current ATLAS data and shortlist ten techniques.
- Assign an owner, a control and a log source to each.
- Mark rows with no detection as open work.
- Test one row per month and record the result.
- Refresh the list when ATLAS releases new data.
Quick check
Is ATLAS a compliance framework?
No. It is a knowledge base of attacker behavior. You use it to plan controls and tests, not to claim conformance.
Do I need to cover every technique?
No. Cover the ones plausible for your system and revisit the list when your architecture changes.
Sources
Last reviewed: 18 October 2026.
