For Heads-of · Practitioner
MITRE ATLAS
Also known as: ATLAS · Adversarial Threat Landscape for Artificial-Intelligence Systems
MITRE's knowledge base of the tactics and techniques adversaries use against AI systems, modelled on the MITRE ATT&CK framework for conventional cyber attacks and built from real-world case studies and red-team findings.
- MITRE
- ATLAS
- threat modelling
- ATT&CK
- adversarial machine learning
What it contains
Tactics (the adversary's goal at each stage, from reconnaissance to impact), techniques (how each goal is achieved, such as prompt injection, model extraction or data poisoning), mitigations, and documented case studies. The September 2026 release lists 16 tactics and 120 techniques. Coverage of AI agents has grown fastest, with techniques such as AI agent tool poisoning added in 2026.
How it differs from OWASP
The OWASP Top 10 for LLM Applications names categories of weakness and what to do about them, which suits a risk register. ATLAS catalogues specific adversary techniques, which suits threat modelling, detection engineering and red-team planning. Security teams already using ATT&CK can extend the same workflow to AI.
Using it
Map the AI systems in scope to the ATLAS techniques that apply, check each against detection and prevention controls, and use the result to scope AI red teaming. A technique with no control is a candidate for the register's adversarial testing coverage gap, which adversarial robustness testing closes.
Sources
Related Terms
Adversarial Attack
An attempt to manipulate or deceive an AI model by deliberately crafting inputs designed to cause misclassification or unintended behaviour.
AI Red Teaming
Structured adversarial testing in which testers try to make an AI system fail, either by producing harmful or prohibited output (safety red teaming) or by being subverted to act against its owner (security red teaming). It finds failures an ordinary test suite cannot, because the tester's job is to imagine what the designers did not.
OWASP Top 10 for Agentic Applications
OWASP's list of the ten most critical security risks specific to autonomous AI agents, published in December 2025. It complements the OWASP Top 10 for LLM Applications by covering what only goes wrong when a model acts: hijacked goals, misused tools, poisoned memory and failures that cascade between agents.
OWASP Top 10 for LLM Applications
The OWASP GenAI Security Project's ranked list of the ten most critical security risks in applications built on large language models. The 2026 edition, published in August 2026, is the closest thing the field has to a shared vocabulary for LLM application security, and every item on it maps to an entry in this site's risk register.