Key takeaways
- ATLAS did not start as a MITRE-only project.
- Each tactic groups one or more of ATLAS's 221 techniques and sub-techniques; each technique entry documents example adversary procedures and links to the specific case studies and mitigations that apply.
- ATLAS is a deliberate companion to MITRE ATT&CK, not a fork or replacement.
- Pin a specific ATLAS content version when citing technique IDs in internal documentation — ATLAS ships monthly updates and has already renamed and restructured techniques between releases (e.g.
MITRE ATLAS (Adversarial Threat Landscape for AI Systems) is a free, public knowledge base that catalogs real-world adversary tactics, techniques and case studies targeting AI and machine-learning systems — the AI-specific counterpart to MITRE ATT&CK. Per MITRE's own ATLAS Data repository, it is "a public knowledge base of adversary TTPs targeting AI systems." The October 2026 content release (version 2026.10, published 28 October 2026) defines 16 tactics, 221 techniques and sub-techniques, 44 mitigations, and 77 documented case studies — figures that matter for device and firmware teams now building AI agents, retrieval pipelines and MCP-based tool integrations into products, since ATLAS is where techniques like LLM prompt injection and AI-agent tool abuse are formally tracked alongside the more familiar model-theft and training-data-poisoning attack classes.
From a 2020 industry matrix to a living MITRE knowledge base
ATLAS did not start as a MITRE-only project. On 22 October 2020, Microsoft and MITRE jointly released the Adversarial ML Threat Matrix, with contributions reported at the time (by SecurityWeek, The Hacker News and VentureBeat) from 11 further organizations spanning industry and academia — including IBM, NVIDIA, Airbus, Bosch, Deep Instinct, Two Six Labs, PricewaterhouseCoopers, Carnegie Mellon's Software Engineering Institute, the Berryville Institute of Machine Learning, Cardiff University and the University of Toronto. The matrix was deliberately modeled on ATT&CK's tactic/technique structure and grounded in real incidents from the outset, including the 2016 Microsoft Tay chatbot poisoning and a ProofPoint email-filter evasion case.
The project's own data confirms the timeline that followed: per the ATLAS Data CHANGELOG, the dataset was first formally defined as version 1.0.0 on 17 February 2021, and the project itself was renamed from its original codename "advmlthreatmatrix" to ATLAS on 31 August 2021 as more organizations — including Citadel AI, McAfee and Palo Alto Networks, per contemporaneous reporting — joined the effort. ATLAS has shipped monthly or near-monthly content updates since; the underlying collection's created-date field is recorded as 23 October 2020, and its most recent content version as of this guide is 2026.10, modified 28 October 2026.
The 16 tactics
ATLAS organizes adversary behavior into 16 tactics, broadly following an attack's lifecycle from early reconnaissance through final impact:
| Tactic | ID | What it covers |
|---|---|---|
| Reconnaissance | AML.TA0002 | Gathering information to plan an attack on an AI system |
| Resource Development | AML.TA0003 | Establishing resources (models, data, infrastructure) to support an operation |
| Initial Access | AML.TA0004 | Gaining an initial foothold in or via the AI system (e.g. prompt injection) |
| AI Model Access | AML.TA0000 | The level of access an adversary has to a target model — from black-box API queries to full white-box internals |
| Execution | AML.TA0005 | Running adversary-controlled code or logic via the AI system |
| Persistence | AML.TA0006 | Maintaining a foothold across sessions or retraining cycles |
| Privilege Escalation | AML.TA0012 | Gaining higher-level permissions than initially granted |
| Defense Evasion | AML.TA0007 | Avoiding detection by security controls or monitoring |
| Credential Access | AML.TA0013 | Stealing credentials or access tokens |
| Discovery | AML.TA0008 | Learning about the AI system and its environment |
| Lateral Movement | AML.TA0015 | Moving through connected systems using AI-system access |
| Collection | AML.TA0009 | Gathering data of interest from or about the AI system |
| AI Attack Adaptation | AML.TA0001 | Turning gathered knowledge and capabilities into attack-ready, target-specific outputs (crafted prompts, adversarial inputs, deepfakes) |
| Command and Control | AML.TA0014 | Communicating with compromised AI components or agents |
| Exfiltration | AML.TA0010 | Extracting data, model internals or training data out of the system |
| Impact | AML.TA0011 | Manipulating, interrupting or destroying AI systems and their outputs |
Each tactic groups one or more of ATLAS's 221 techniques and sub-techniques; each technique entry documents example adversary procedures and links to the specific case studies and mitigations that apply.
Why this matters for AI-agent and MCP integrations specifically
The October 2026 release's own changelog shows ATLAS actively tracking the newer AI-agent and tool-calling attack surface that device and firmware makers are increasingly exposed to as they add AI features: new techniques added in this release include AI Service Request Metadata Sanitization, Event Triggered Execution, LLM Prompt Propagation, and Poison AI Agent Learning Environment, alongside an updated Supply Chain Compromise technique family covering AI hardware, software, data-repository and model-repository compromise. One of the most directly relevant entries for teams building AI assistants or agent tooling is LLM Prompt Injection (AML.T0051), which ATLAS describes as crafting "malicious prompts as inputs to an LLM that cause the LLM to act in unintended ways," with three documented sub-techniques — Direct injection by the adversary themself, Indirect injection via content the LLM later ingests (a web page, document or sensor feed), and Triggered injection that activates only under a specific condition. This is the same attack class covered from a protocol-security angle in our MCP server security guide — ATLAS supplies the adversary-behavior taxonomy and real case studies, while MCP's own Security Best Practices document supplies the protocol-level mitigations.
How ATLAS relates to ATT&CK
ATLAS is a deliberate companion to MITRE ATT&CK, not a fork or replacement. It reuses ATT&CK's tactic/technique/sub-technique schema, and its early versions (per the ATLAS Data CHANGELOG) literally imported ATT&CK Enterprise data via a STIX retrieval script before that dependency was removed in version 2.2.0 (October 2021) once ATLAS's own AI-specific technique catalog matured. Where an attack chain crosses from conventional IT infrastructure into AI-specific territory — for example, an adversary using a compromised cloud account (ATT&CK) to reach a model API and then running a prompt-injection attack (ATLAS) — the two frameworks are meant to be read together, each covering the part of the chain within its own domain. ATLAS case studies and technique references that touch conventional attacker infrastructure still cite ATT&CK Group IDs where applicable, keeping the two knowledge bases cross-referenceable rather than overlapping.
A workable starting point
Use ATLAS's tactics as a checklist when threat-modeling a new AI feature— if your product adds an LLM-backed assistant, a RAG pipeline, or MCP/agent tool-calling, walk the 16 tactics and ask which ATLAS techniques under Initial Access, Execution and Exfiltration actually apply to your specific integration. Treat LLM Prompt Injection's three sub-techniques as distinct risks, not one problem— Direct injection is a user-input-validation problem; Indirect injection (content an LLM ingests from the web, a document or a sensor) is a data-provenance and sandboxing problem; design mitigations for each separately. Cross-reference ATLAS mitigations against your existing AI-security controls— the 44 mitigations in the October 2026 release (including newly added ones like AI Agent External Resource Lifecycle Management) give a structured checklist rather than requiring you to invent agent/tool-security controls from scratch. Read ATLAS and ATT&CK together for products that mix conventional IT and AI attack surface— most real intrusions involving AI systems still start with a conventional foothold (phishing, a compromised credential, an exposed API) before the AI-specific techniques come into play. Pin a specific ATLAS content version when citing technique IDs in internal documentation— ATLAS ships monthly updates and has already renamed and restructured techniques between releases (e.g. "AI Attack Staging" became "AI Attack Adaptation"), so an undated reference to a technique ID can go stale.
SoftWSP's device and firmware security work increasingly covers the AI-agent and MCP-tool surface that ships inside modern products — see Device & Firmware Security for an assessment that can be scoped against ATLAS's tactics and techniques alongside conventional firmware vulnerability classes.
This guide summarizes MITRE's own public ATLAS data repository (README, CHANGELOG, and the October 2026 dataset) and contemporaneous 2020 industry reporting on ATLAS's origin as the Adversarial ML Threat Matrix; it is not a substitute for the current atlas.mitre.org content and does not constitute security advice.
Sources
- MITRE ATLAS — official site (matrix, tactics, techniques, case studies, mitigations)
- MITRE ATLAS Data — GitHub repository README (definition, purpose, data format)
- MITRE ATLAS Data — CHANGELOG.md (version history from v1.0.0 2021-02-17 through 2026.10; rename from advmlthreatmatrix to ATLAS on 2021-08-31)
- MITRE ATLAS Data — dist/v6/ATLAS-2026.10.yaml (authoritative machine-readable dataset: tactics, techniques, mitigations, case studies, version 2026.10, modified 2026-10-28)
- MITRE ATLAS Data — LICENSE (Apache License 2.0, Copyright 2021-2026 MITRE)
- SecurityWeek: "Microsoft, MITRE Release Adversarial Machine Learning Threat Matrix" (22 October 2020 — origin, partner organizations)
Frequently asked questions
What is MITRE ATLAS?
ATLAS stands for Adversarial Threat Landscape for AI Systems. Per MITRE's own ATLAS Data repository README, it is "a public knowledge base of adversary TTPs [tactics, techniques and procedures] targeting AI systems," built and maintained by The MITRE Corporation and structured as a companion to MITRE ATT&CK. The project's underlying data collection carries a created-date of 23 October 2020 and, per the ATLAS data CHANGELOG, was originally named "advmlthreatmatrix" before being renamed "ATLAS" on 31 August 2021. As of the October 2026 content release (version 2026.10), the ATLAS dataset defines 1 matrix, 16 tactics, 129 top-level techniques plus 92 sub-techniques (221 total), 44 mitigations, 44 threat-actor/entity records, 37 software records, and 77 real-world case studies.
Where did ATLAS come from, and who maintains it?
ATLAS began as the Adversarial ML Threat Matrix, released on 22 October 2020 by Microsoft and MITRE with contributions from 11 other organizations — reported at the time (by SecurityWeek, The Hacker News and VentureBeat) as including IBM, NVIDIA, Airbus, Bosch, Deep Instinct, Two Six Labs, PricewaterhouseCoopers, Carnegie Mellon's Software Engineering Institute, the Berryville Institute of Machine Learning, Cardiff University and the University of Toronto. It was explicitly modeled on MITRE ATT&CK's tactic/technique structure, including real case studies such as the Microsoft Tay chatbot poisoning and a ProofPoint evasion attack. In 2021 the project was renamed ATLAS (confirmed in MITRE's own ATLAS Data CHANGELOG as occurring on 31 August 2021) as further organizations including Citadel AI, McAfee and Palo Alto Networks joined; it is now maintained and published by MITRE under the Apache License 2.0 through the public atlas.mitre.org site and the mitre-atlas/atlas-data GitHub repository, with monthly content releases.
What are the 16 tactics, and how is ATLAS structured?
Per the October 2026 ATLAS data release, the matrix's 16 tactics (adversary goals, listed roughly in attack-chain order) are: Reconnaissance, Resource Development, Initial Access, AI Model Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, AI Attack Adaptation (formerly "AI Attack Staging"), Command and Control, Exfiltration, and Impact. Each tactic groups one or more techniques (e.g. LLM Prompt Injection sits under Initial Access) and each technique entry documents the adversary behavior, example procedures, and links to one or more of ATLAS's 77 documented case studies and 44 mitigations — the same tactic-technique-mitigation-case-study structure ATT&CK uses for conventional IT/OT intrusions, applied instead to attacks that specifically target AI model training, inference, agent tooling and supply chains.
How does ATLAS relate to ATT&CK, and is it free to use?
ATLAS is a deliberate companion framework to ATT&CK, not a replacement or fork of it — MITRE built it using the same tactic/technique/sub-technique schema and, in early versions, even imported ATT&CK Enterprise data directly before diverging into its own AI-specific content (the ATLAS Data CHANGELOG records "Removed retrieval and usage of ATT&CK Enterprise data" in version 2.2.0, October 2021, once ATLAS's own technique set matured). ATLAS entries that reuse general IT techniques still reference ATT&CK Group IDs where relevant. ATLAS is free and public: the atlas.mitre.org site, the Navigator-compatible matrix views, and the underlying atlas-data GitHub repository are published under the Apache License 2.0 — permissive, commercial-use-friendly, and requiring only attribution and license-notice preservation, unlike ATT&CK's own separate terms of use that this guide has not reviewed here.
In this cluster
