MITRE ATLAS

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a knowledge base of how AI systems are attacked in the real world. It catalogues adversary tactics, techniques and documented case studies, structured in the same format as MITRE ATT&CK so security teams can use it without learning a new vocabulary. It is a threat model, not a governance framework or a compliance standard.

What ATLAS actually contains

ATLAS is structured like MITRE ATT&CK, and deliberately so. Tactics describe what an adversary is trying to achieve. Techniques describe how they achieve it. The familiarity is the point: a security team that already threat models with ATT&CK can read ATLAS immediately. As of the July 2026 release, ATLAS documented 16 tactics, 101 top-level techniques, 77 sub-techniques and 68 case studies, of which 50 are labelled exercises and 18 are real incidents. ATLAS ships monthly, so treat those numbers as a dated snapshot and check the live matrix before citing them.

Three properties make it work. The knowledge base is built from observed attacks rather than theoretical ones, so the taxonomy grows behind real incidents instead of ahead of them. It is a living resource, updated continuously from AI red teams and security groups. And it is openly accessible, which is what allows an attack pattern to be cited by identifier across organizations.

MITRE has extended ATLAS with Microsoft to cover generative AI and large language models specifically, describing the attack pathways that open up once a model is embedded in a product with access to data and tools.

The case studies are the useful part

Each case study documents a real attack step by step and maps every step to a technique. AML.CS0035, "Data Exfiltration from Slack AI via Indirect Prompt Injection", is a clear example: an attacker posts a crafted instruction in a public channel, Slack AI indexes it into its retrieval database, and a later user query pulls the injected instruction alongside that user’s private-channel data. Related entries cover Microsoft 365 Copilot (AML.CS0026), Copilot Studio (AML.CS0037) and prompt injection through Jira Service Management (AML.CS0039).

This is why ATLAS matters operationally. You can reference an attack pattern by identifier in a threat model instead of describing it from scratch, and reviewers can look it up. Techniques such as AML.T0051.001 (Indirect Prompt Injection), AML.T0070 (RAG Poisoning) and AML.T0082 (RAG Credential Harvesting) exist because incidents like these were catalogued first.

How to use it

Use ATLAS for threat modelling, not governance. It tells you what attackers do; it does not tell you how to run a risk program, which is what the NIST AI RMF is for, nor what to build, which is OWASP AI. The ATLAS Navigator at atlas.mitre.org provides an interactive view of the matrix for marking up which techniques apply to a given system.

In practice it does three jobs well: enumerating the attack surface of a specific AI system during design review, giving detection engineering a concrete list of behaviours to hunt for, and feeding named, evidenced threats into a risk assessment that would otherwise rest on speculation. For worked examples on this site, see the Slack AI exfiltration case and the broader catalogue of AI attack techniques.

Related frameworks

MITRE ATLAS documents how AI systems are attacked. For the engineering guidance that mitigates those techniques, see OWASP AI. For the risk process that consumes threat intelligence, see NIST AI RMF. For how all five frameworks relate, see the AI security framework comparison.