What is MITRE ATLAS in one sentence?

MITRE ATLAS is a free, living knowledge base of the tactics and techniques attackers use against AI systems, organised like the MITRE ATT&CK framework but focused on machine learning, effectively ATT&CK for AI.

How many tactics and techniques does ATLAS have?

The current matrix, the 2026.05 release, defines 16 tactics and 173 techniques, with 35 mitigations and 63 case studies. Most tactics are reused from ATT&CK; two are unique to ATLAS: AI Model Access and AI Attack Staging.

How is ATLAS different from the OWASP LLM Top 10?

The OWASP LLM Top 10 is a builder's risk checklist of what can go wrong in your app. ATLAS is an adversary's technique catalogue of how attackers actually operate, mapped to real case studies. They complement each other: OWASP names the risk, ATLAS names the attacker behaviour and gives stable technique IDs.

Why does ATLAS matter for compliance, not just security?

The EU AI Act Article 15 requires high-risk AI to resist adversarial attacks and names data poisoning, model poisoning, and adversarial examples, the same threats ATLAS catalogues. Mapping ATLAS techniques to controls and tests gives assessors concrete evidence, which aligns with the NIST AI RMF and ISO 42001.

Does AgentRedTeam implement all of ATLAS?

No. AgentRedTeam's simulations are modelled on a subset of ATLAS technique families, prompt injection, tool abuse, exfiltration, and poisoning, and return a prioritized report. It is a simulation and scanning tool, not the ATLAS knowledge base, and does not guarantee coverage of all techniques or find every vulnerability.

MITRE ATLAS overview: the adversary framework for AI systems

MITRE ATLAS™ (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a globally accessible, living knowledge base of adversary tactics and techniques against AI-enabled systems, built from real-world attack observations and red-team demonstrations (MITRE ATLAS). Think of it as "ATT&CK for AI." The current matrix defines 16 tactics and 173 techniques (with 35 mitigations and 63 case studies as of the 2026.05 release), and it reuses most ATT&CK tactics while adding two AI-native ones: AI Model Access and AI Attack Staging (CyberDefenders — What is MITRE ATLAS?; MITRE CTID — Secure AI v2). See also the OWASP LLM Top 10 (2025) for the builder's risk catalogue.

1. What ATLAS is (and isn't)

ATLAS is a reference framework, not a tool you install. It gives defenders a shared, stable vocabulary with technique IDs so red teams, engineers, and risk owners can talk about the same attack. The April 2026 updates expanded coverage for Agentic AI and LLM threats — 45+ new techniques and sub-techniques, 10+ new mitigations, and 20+ new case studies — and moved ATLAS to a monthly release cadence (MITRE CTID).

2. The tactic chain (how an AI attack unfolds)

ATLAS mirrors ATT&CK's left-to-right kill chain, adapted for AI systems:

Reconnaissance → Resource Development → Initial Access & AI Model Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → AI Attack Staging → Command and Control → Exfiltration → Impact

Several techniques map directly to the failure classes builders care about:

LLM Prompt Injection (direct / indirect / triggered) — AML.T0051.
Poison Training Data, RAG Poisoning, AI Agent Tool Poisoning — data- and tool-layer attacks.
Exfiltration via AI Agent Tool Invocation, Exfiltration via AI Inference API — the agent exfiltration paths.
LLM Jailbreak, Extract LLM System Prompt, LLM Data Leakage — model-surface techniques.

3. Why it matters for governance, not just SOC

ATLAS is also a compliance instrument, because the attacks it catalogs are the attacks regulation now names. The EU AI Act, Article 15, requires high-risk AI systems to be "resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities," and it explicitly names data poisoning, model poisoning, and adversarial examples (AI Sigil — MITRE ATLAS). When an assessor asks how you address adversarial examples or data poisoning, "we mapped the relevant ATLAS techniques to controls and tested them" is far stronger than a policy statement.

The operational chain is threat → control → evidence. For each AI system, shortlist the ATLAS techniques your architecture actually invites, map each to a control you already own, and attach proof the control works (a red-team report, a poisoning-detection test, an access log). That is exactly what the NIST AI RMF Measure and Manage functions ask for, and it aligns with ISO 42001 Annex A.

4. How to use ATLAS in practice

Inventory your AI systems — model type, data sources, exposure.
Shortlist the ATLAS techniques plausible for each architecture (you don't need all 173).
Map each to an existing control (access management, input validation, monitoring, supply-chain checks, red-team testing).
Evidence the controls that work; record genuine gaps as build items.
Review quarterly — ATLAS is living, and your model estate changes.

5. Where AgentRedTeam connects (honestly)

AgentRedTeam's automated simulations are modelled on ATLAS technique families — prompt injection, tool abuse, exfiltration, and poisoning scenarios — and return a prioritized report mapped to those techniques. It is a simulation/scanning tool, not the ATLAS knowledge base, and it does not guarantee coverage of all 173 techniques or find every vulnerability. Use it to start the threat→control→evidence chain; graduate to human-led ATLAS-based emulation for high-risk systems. Also see the LLM red-teaming guide.

MITRE ATLAS overview: the adversary framework for AI systems

MITRE ATLAS overview: the adversary framework for AI systems

1. What ATLAS is (and isn't)

2. The tactic chain (how an AI attack unfolds)

3. Why it matters for governance, not just SOC

4. How to use ATLAS in practice

5. Where AgentRedTeam connects (honestly)

FAQ