International · Adversary technique catalogue
MITRE ATLAS: AI attack tactics mapped to governance
MITRE ATLAS is a knowledge base of adversary tactics and techniques against AI systems, built on the structure of MITRE ATT&CK and drawn from real attacks and AI red-team demonstrations. It is updated monthly. The 2026.10 release, dated 28 October 2026, lists 16 tactics, 129 techniques and 92 sub-techniques, with 44 mitigations and 77 case studies. FairMind maps ATLAS at tactic level and covers 15 tactics; Lateral Movement, added in late 2025, is not mapped yet.
In the FairMind catalogue: 15 requirements mapped to 4 workflows and 16 evaluations.
Source: MITRE ATLAS; ATLAS data, release 2026.10
MITRE ATLAS: what it asks of AI systems
The parts most relevant to governing AI systems and agents, summarised from the MITRE ATLAS (Adversarial Threat Landscape for AI Systems).
- AML.TA0002Reconnaissance
- Gathering information about the target AI system, its models and its data.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0003Resource Development
- Acquiring or building the datasets, models, infrastructure and accounts an attack needs.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0004Initial Access
- Getting a foothold, for example through prompt injection or a compromised model supply chain.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0000AI Model Access
- Reaching the model through its API, the product that embeds it, or the model files.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0005Execution
- Running adversary-controlled code or commands, including through an agent's tools.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0006Persistence
- Keeping access through poisoned data, backdoored models or altered agent memory.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0012Privilege Escalation
- Gaining higher permissions, including by abusing an agent's access.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0007Defense Evasion
- Avoiding guardrails, classifiers and monitoring, for example through jailbreaks.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0013Credential Access
- Stealing credentials and secrets, including those placed in agent and tool context.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0008Discovery
- Learning about the AI system's configuration, system prompt, tools and environment.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0009Collection
- Gathering data and AI artifacts of interest to the adversary.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0001AI Attack Staging
- Preparing the attack, such as crafting adversarial inputs or training proxy models. Named AI Attack Adaptation in the current matrix.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0014Command and Control
- Communicating with compromised systems, including through an AI agent.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0010Exfiltration
- Moving data, model weights or other AI artifacts out of the environment.Mapped to: Threat modelling, guardrails and vulnerabilities
- AML.TA0011Impact
- Disrupting, degrading or manipulating the AI system or the decisions it supports.Mapped to: Threat modelling, guardrails and vulnerabilities
Evidence FairMind helps you produce
FairMind links technical evidence to MITRE ATLAS obligations for a human reviewer to accept. It is not legal advice and does not decide compliance.
- 16 evaluations mapped to ATLAS tactics, such as direct prompt injection for Initial Access and model extraction resistance for Exfiltration
- Agent threat models with a taint trace of untrusted data flows
- AI red-teaming programme results linked to the tactic they exercise
- Vulnerability disclosure and patching records for findings
MITRE ATLAS questions
How does MITRE ATLAS relate to MITRE ATT&CK?
ATLAS follows the ATT&CK structure of tactics and techniques and adds the ones specific to AI systems, such as AI Model Access and adversarial input crafting. Tactics like Reconnaissance and Exfiltration share their names with ATT&CK, so security teams can read both side by side.
Why does FairMind map ATLAS at tactic level?
Techniques change with the monthly releases; tactics change rarely. Mapping evidence to tactics keeps it valid between releases. Each record still notes the ATLAS release it was reviewed against.
How does FairMind map ATLAS?
The catalogue maps 15 tactics to threat modelling, guardrails and vulnerability workflows (4 in all). A person reviews each threat model and finding at the gate before it is filed.