Framework
MITRE ATLAS, mapped to AI security tools
MITRE ATLAS (Adversarial Threat Landscape for AI Systems) organizes how attackers target AI systems into tactics and techniques. This page lists its tactics and the techniques we map to OWASP LLM risks and tool categories.
Data version
We read tactic and technique IDs and names from ATLAS data version 2026.09 Source, checked October 21, 2026: raw.githubusercontent.com (opens in a new tab) . ATLAS renames and renumbers entries between releases, so check atlas.mitre.org for the current matrix.
Whose words are these?
Tactic and technique names and IDs are MITRE's. Which techniques we show, and how they map to OWASP risks and categories, is our analysis.
Tactics
16 tactics in this data version, in ID order.
| ID | Tactic |
|---|---|
| AML.TA0000 | AI Model Access |
| AML.TA0001 | AI Attack Adaptation |
| AML.TA0002 | Reconnaissance |
| AML.TA0003 | Resource Development |
| AML.TA0004 | Initial Access |
| AML.TA0005 | Execution |
| AML.TA0006 | Persistence |
| AML.TA0007 | Defense Evasion |
| AML.TA0008 | Discovery |
| AML.TA0009 | Collection |
| AML.TA0010 | Exfiltration |
| AML.TA0011 | Impact |
| AML.TA0012 | Privilege Escalation |
| AML.TA0013 | Credential Access |
| AML.TA0014 | Command and Control |
| AML.TA0015 | Lateral Movement |
Techniques we map
Our analysisA short list of techniques that line up with OWASP LLM risks and with tool categories in this directory. ATLAS has many more.
| ID | Technique | OWASP risks | Categories | Tools |
|---|---|---|---|---|
| AML.T0010 | AI Supply Chain Compromise | None mapped yet | ||
| AML.T0011.000 | User Execution: Unsafe AI Artifacts | None mapped yet | ||
| AML.T0020 | Training Data Poisoning | ART | ||
| AML.T0024 | Exfiltration via AI Inference API | ART | ||
| AML.T0029 | Denial of AI Service | None mapped yet | ||
| AML.T0034 | Cost Harvesting | None mapped yet | ||
| AML.T0051 | LLM Prompt Injection | None mapped yet | ||
| AML.T0053 | AI Agent Tool Invocation | None mapped yet | ||
| AML.T0054 | LLM Jailbreak | None mapped yet | ||
| AML.T0056 | Extract LLM System Prompt | None mapped yet | ||
| AML.T0057 | LLM Data Leakage | None mapped yet | ||
| AML.T0060 | Publish Hallucinated Entities | None mapped yet | ||
| AML.T0070 | RAG Poisoning | None mapped yet | ||
| AML.T0077 | LLM Response Rendering | None mapped yet | ||
| AML.T0086 | Exfiltration via AI Agent Tool Invocation | None mapped yet | ||
| AML.T0109 | AI Supply Chain Rug Pull | None mapped yet | ||
| AML.T0110 | AI Agent Tool Poisoning | None mapped yet |
Mitigations by layer
Our analysisThe 12 mitigations in this data version, with the AI security layers that deliver each one. The layers are our editorial model, not a standard. Source states means the mitigation's own name is the control the layer delivers. Our analysis means we drew the link.
| ID | Mitigation | Layers |
|---|---|---|
| AML.M0004 | Limit AI Service Query Volume and Rate |
|
| AML.M0007 | Sanitize Training Data |
|
| AML.M0013 | Code Signing |
|
| AML.M0014 | Verify AI Artifacts |
|
| AML.M0016 | Vulnerability Scanning |
|
| AML.M0019 | Control Access to AI Models and Data in Production |
|
| AML.M0020 | Generative AI Guardrails |
|
| AML.M0023 | AI Bill of Materials |
|
| AML.M0025 | Maintain AI Dataset Provenance |
|
| AML.M0029 | Human In-the-Loop for AI Agent Actions |
|
| AML.M0030 | Restrict AI Agent Tool Invocation on Untrusted Data |
|
| AML.M0033 | Input and Output Validation for AI Agent Components |
|
Looking for the OWASP side? See the OWASP Top 10 for LLM Applications. Terms are explained in the glossary.