diff --git a/agentic-top10/Agentic_MITREATLAS.md b/agentic-top10/Agentic_MITREATLAS.md index 799827e..74a5d64 100644 --- a/agentic-top10/Agentic_MITREATLAS.md +++ b/agentic-top10/Agentic_MITREATLAS.md @@ -58,15 +58,15 @@ it travels through. | ID | Name | Severity | Primary ATLAS Techniques | Agentic amplifier | Tier | |---|---|---|---|---|---| | ASI01 | Agent Goal Hijack | Critical | AML.T0051.000, AML.T0051.001, AML.T0054 | Autonomy turns single injection into multi-step attack chain | Foundational–Advanced | -| ASI02 | Tool Misuse & Exploitation | Critical | AML.T0037, AML.T0015, AML.T0126 | Tool access converts prompt manipulation into real-world action | Foundational–Advanced | +| ASI02 | Tool Misuse & Exploitation | Critical | AML.T0037, AML.T0053, AML.T0126 | Tool access converts prompt manipulation into real-world action | Foundational–Advanced | | ASI03 | Identity & Privilege Abuse | Critical | AML.T0012, AML.T0024 | Cached credentials give attacker persistent access beyond session | Foundational–Advanced | | ASI04 | Agentic Supply Chain | High | AML.T0056, AML.T0048, AML.T0018 | Runtime dynamic loading means poisoned components affect all consumers | Hardening–Advanced | | ASI05 | Unexpected Code Execution | Critical | AML.T0040, AML.T0054, AML.T0037 | Code generation + execution capability creates RCE gateway | Foundational–Advanced | -| ASI06 | Memory & Context Poisoning | High | AML.T0032, AML.T0063, AML.T0020 | Persistence across sessions amplifies impact of single injection | Hardening–Advanced | -| ASI07 | Insecure Inter-Agent Comms | High | AML.T0043, AML.T0012, AML.T0024 | A2A spoofing misdirects entire agent clusters | Hardening–Advanced | -| ASI08 | Cascading Agent Failures | High | AML.T0029, AML.T0034, AML.T0057 | Single fault fans out across all downstream agents | Foundational–Advanced | -| ASI09 | Human-Agent Trust Exploitation | Medium | AML.T0045, AML.T0047, AML.T0049 | Agent fluency makes manipulation invisible to audit logs | Foundational–Hardening | -| ASI10 | Rogue Agents | Critical | AML.T0054, AML.T0015, AML.T0057 | Compliant surface masks persistent hidden goal pursuit | Hardening–Advanced | +| ASI06 | Memory & Context Poisoning | High | AML.T0070, AML.T0066, AML.T0020 | Persistence across sessions amplifies impact of single injection | Hardening–Advanced | +| ASI07 | Insecure Inter-Agent Comms | High | AML.T0006.002, AML.T0012, AML.T0024 | A2A spoofing misdirects entire agent clusters | Hardening–Advanced | +| ASI08 | Cascading Agent Failures | High | AML.T0029, AML.T0034, AML.T0049 | Single fault fans out across all downstream agents | Foundational–Advanced | +| ASI09 | Human-Agent Trust Exploitation | Medium | AML.T0045, AML.T0047, AML.T0052.000 | Agent fluency makes manipulation invisible to audit logs | Foundational–Hardening | +| ASI10 | Rogue Agents | Critical | AML.T0054, AML.T0053, AML.T0049 | Compliant surface masks persistent hidden goal pursuit | Hardening–Advanced | --- @@ -177,7 +177,7 @@ tool does in response: delete, send, execute, publish. | Technique | ID | Tactic | Agentic context | |---|---|---|---| | Output Manipulation | [AML.T0037](https://atlas.mitre.org/techniques/AML.T0037) | Influence Operations | Crafting inputs that produce tool calls with destructive parameters — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | -| LLM Capability Escalation | [AML.T0015](https://atlas.mitre.org/techniques/AML.T0015) | Privilege Escalation | Exploiting overly permissive tool access to exceed intended agent scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| AI Agent Tool Invocation | [AML.T0053](https://atlas.mitre.org/techniques/AML.T0053) | Privilege Escalation | Exploiting overly permissive tool access to exceed intended agent scope | | Automated Collection | [AML.T0126](https://atlas.mitre.org/techniques/AML.T0126) | Collection | Agent autonomously harvesting data through tool chains beyond authorised scope | #### Mitigations by tier @@ -457,8 +457,8 @@ without triggering any single detectable event. | Technique | ID | Tactic | Agentic context | |---|---|---|---| -| Data Poisoning | [AML.T0032](https://atlas.mitre.org/techniques/AML.T0032) | ML Attack Staging | Injecting malicious content into agent persistent memory or RAG stores — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)** | -| Embedding Manipulation | [AML.T0063](https://atlas.mitre.org/techniques/AML.T0063) | ML Attack Staging | Crafting content whose embeddings bias future retrieval results in attacker's favour — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| RAG Poisoning | [AML.T0070](https://atlas.mitre.org/techniques/AML.T0070) | ML Attack Staging | Injecting malicious content into agent persistent memory or RAG stores | +| Retrieval Content Crafting | [AML.T0066](https://atlas.mitre.org/techniques/AML.T0066) | ML Attack Staging | Crafting content whose embeddings bias future retrieval results in attacker's favour | | Backdoor via Poisoned Memory | [AML.T0020](https://atlas.mitre.org/techniques/AML.T0020) | Persistence | Establishing persistent trigger-response patterns in agent memory stores — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | #### Mitigations by tier @@ -520,7 +520,7 @@ cluster. | Technique | ID | Tactic | Agentic context | |---|---|---|---| -| Network Service Scanning | [AML.T0043](https://atlas.mitre.org/techniques/AML.T0043) | Discovery | Identifying and mapping inter-agent communication endpoints for targeting — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| Active Scanning: Scan for Exposed AI Infrastructure | [AML.T0006.002](https://atlas.mitre.org/techniques/AML.T0006.002) | Discovery | Identifying and mapping inter-agent communication endpoints for targeting | | Valid Accounts | [AML.T0012](https://atlas.mitre.org/techniques/AML.T0012) | Persistence | Using compromised agent credentials to impersonate trusted agents in A2A channels | | Exfiltration via AI Inference API | [AML.T0024](https://atlas.mitre.org/techniques/AML.T0024) | Exfiltration | Intercepting inter-agent messages to exfiltrate sensitive context passed between agents | @@ -594,7 +594,7 @@ crosswalks for OT-specific controls. |---|---|---|---| | Denial of AI Service | [AML.T0029](https://atlas.mitre.org/techniques/AML.T0029) | Impact | Triggering cascading failure propagation to exhaust system resources or degrade service | | Cost Harvesting | [AML.T0034](https://atlas.mitre.org/techniques/AML.T0034) | Impact | Crafting inputs that trigger runaway agent loops generating unbounded costs | -| Exploit Public-Facing ML Application | [AML.T0057](https://atlas.mitre.org/techniques/AML.T0057) | Initial Access | Exploiting an exposed agent endpoint to introduce a fault that cascades internally — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| Exploit Public-Facing Application | [AML.T0049](https://atlas.mitre.org/techniques/AML.T0049) | Initial Access | Exploiting an exposed agent endpoint to introduce a fault that cascades internally | #### Mitigations by tier @@ -657,7 +657,7 @@ forensics shows a legitimate user decision, not an agent manipulation. |---|---|---|---| | Disinformation | [AML.T0045](https://atlas.mitre.org/techniques/AML.T0045) | Influence Operations | Agent generates persuasive false information to manipulate human approvals — **DRAFT — AML.T0045 is not an ATLAS technique id; retarget pending SME review (#93)** | | Influence via Automated Content | [AML.T0047](https://atlas.mitre.org/techniques/AML.T0047) | Influence Operations | Agent produces high-volume, fluent content that overwhelms human critical assessment — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | -| Spearphishing via AI | [AML.T0049](https://atlas.mitre.org/techniques/AML.T0049) | Initial Access | Compromised agent crafts highly personalised, convincing manipulation targeted at specific users — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| Phishing: Spearphishing via Social Engineering LLM | [AML.T0052.000](https://atlas.mitre.org/techniques/AML.T0052.000) | Initial Access | Compromised agent crafts highly personalised, convincing manipulation targeted at specific users | #### Mitigations by tier @@ -710,8 +710,8 @@ ASI06 attack that has gone undetected across multiple sessions. | Technique | ID | Tactic | Agentic context | |---|---|---|---| | LLM Jailbreak | [AML.T0054](https://atlas.mitre.org/techniques/AML.T0054) | Execution | Persistent override of agent safety constraints enabling hidden goal execution | -| LLM Capability Escalation | [AML.T0015](https://atlas.mitre.org/techniques/AML.T0015) | Privilege Escalation | Rogue agent gradually escalates its own capabilities and permissions over time — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | -| Exploit Public-Facing ML Application | [AML.T0057](https://atlas.mitre.org/techniques/AML.T0057) | Persistence | Compromised agent maintains persistent access and hidden execution across sessions — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| AI Agent Tool Invocation | [AML.T0053](https://atlas.mitre.org/techniques/AML.T0053) | Privilege Escalation | Rogue agent gradually escalates its own capabilities and permissions over time | +| Exploit Public-Facing Application | [AML.T0049](https://atlas.mitre.org/techniques/AML.T0049) | Persistence | Compromised agent maintains persistent access and hidden execution across sessions | #### Mitigations by tier diff --git a/data/backlinks.json b/data/backlinks.json index f87b6f1..a8afcc9 100644 --- a/data/backlinks.json +++ b/data/backlinks.json @@ -18758,6 +18758,22 @@ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0006.002", + "control_name": "Active Scanning: Scan for Exposed AI Infrastructure", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Identifying and mapping inter-agent communication endpoints for targeting" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0012", @@ -18799,40 +18815,6 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Exploiting overly permissive tool access to exceed intended agent scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Rogue agent gradually escalates its own capabilities and permissions over time — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0016", @@ -18971,22 +18953,6 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0021", - "control_name": "Data Leakage", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Unintended exposure of training data or sensitive context through model outputs — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024", @@ -19199,6 +19165,31 @@ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", + "entries": [ + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Reconstructing sensitive training data from model outputs" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024.002", @@ -19312,31 +19303,6 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Reconstructing sensitive training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**" - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0029", @@ -19371,47 +19337,6 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0030", - "control_name": "Information Disclosure", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Extraction of confidential information via targeted model queries — **DRAFT — AML.T0030 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Injecting malicious data into training pipelines to corrupt model behaviour — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Injecting malicious content into agent persistent memory or RAG stores — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0034", @@ -19602,36 +19527,11 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0041", - "control_name": "Configuration Exposure", - "entries": [ - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Extraction of internal model configuration, instructions, or system prompts — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0043", - "control_name": "Network Service Scanning", + "control_name": "Craft Adversarial Data", "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Identifying and mapping inter-agent communication endpoints for targeting — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -19748,16 +19648,25 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0049", - "control_name": "Spearphishing via AI", + "control_name": "Exploit Public-Facing Application", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Compromised agent maintains persistent access and hidden execution across sessions" }, { "id": "DSGAI02", @@ -19883,6 +19792,56 @@ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0052.000", + "control_name": "Phishing: Spearphishing via Social Engineering LLM", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users" + } + ] + }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", + "entries": [ + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Exploiting overly permissive tool access to exceed intended agent scope" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Rogue agent gradually escalates its own capabilities and permissions over time" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0054", @@ -19940,6 +19899,15 @@ "scope": "Both", "notes": "Tampering with model weights, adapters, or configurations during supply chain — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Extraction of internal model configuration, instructions, or system prompts" + }, { "id": "ASI04", "name": "Agentic Supply Chain", @@ -19954,41 +19922,57 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_name": "LLM Data Leakage", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Unintended exposure of training data or sensitive context through model outputs" + } + ] + }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", + "entries": [ + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Crafting inputs whose embeddings manipulate similarity search results" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Compromised agent maintains persistent access and hidden execution across sessions — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour" } ] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "entries": [ { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Hardening", - "scope": "Build", - "notes": "Crafting inputs whose embeddings manipulate similarity search results — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "scope": "Both", + "notes": "Injecting malicious data into training pipelines to corrupt model behaviour" }, { "id": "ASI06", @@ -19997,7 +19981,7 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Injecting malicious content into agent persistent memory or RAG stores" } ] }, diff --git a/data/entries/ASI02.json b/data/entries/ASI02.json index 4680dc4..73bf196 100644 --- a/data/entries/ASI02.json +++ b/data/entries/ASI02.json @@ -95,12 +95,12 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Exploiting overly permissive tool access to exceed intended agent scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Exploiting overly permissive tool access to exceed intended agent scope", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI06.json b/data/entries/ASI06.json index 268297a..07d246c 100644 --- a/data/entries/ASI06.json +++ b/data/entries/ASI06.json @@ -84,23 +84,23 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0032", - "notes": "Injecting malicious content into agent persistent memory or RAG stores — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0070", + "notes": "Injecting malicious content into agent persistent memory or RAG stores", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0063", - "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0066", + "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI07.json b/data/entries/ASI07.json index c112955..0b7ba37 100644 --- a/data/entries/ASI07.json +++ b/data/entries/ASI07.json @@ -84,12 +84,12 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0043", - "control_name": "Network Service Scanning", + "control_id": "AML.T0006.002", + "control_name": "Active Scanning: Scan for Exposed AI Infrastructure", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0043", - "notes": "Identifying and mapping inter-agent communication endpoints for targeting — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0006.002", + "notes": "Identifying and mapping inter-agent communication endpoints for targeting", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI08.json b/data/entries/ASI08.json index 310a894..9f11c5e 100644 --- a/data/entries/ASI08.json +++ b/data/entries/ASI08.json @@ -106,12 +106,12 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_id": "AML.T0049", + "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0057", - "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0049", + "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI09.json b/data/entries/ASI09.json index 4bbc9d3..62f51af 100644 --- a/data/entries/ASI09.json +++ b/data/entries/ASI09.json @@ -106,12 +106,12 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0049", - "control_name": "Spearphishing via AI", + "control_id": "AML.T0052.000", + "control_name": "Phishing: Spearphishing via Social Engineering LLM", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0049", - "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0052.000", + "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI10.json b/data/entries/ASI10.json index e037a42..9d08e24 100644 --- a/data/entries/ASI10.json +++ b/data/entries/ASI10.json @@ -95,23 +95,23 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Rogue agent gradually escalates its own capabilities and permissions over time — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Rogue agent gradually escalates its own capabilities and permissions over time", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_id": "AML.T0049", + "control_name": "Exploit Public-Facing Application", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0057", - "notes": "Compromised agent maintains persistent access and hidden execution across sessions — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0049", + "notes": "Compromised agent maintains persistent access and hidden execution across sessions", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI18.json b/data/entries/DSGAI18.json index 70b077b..ca6d2ac 100644 --- a/data/entries/DSGAI18.json +++ b/data/entries/DSGAI18.json @@ -105,11 +105,11 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", "tier": "Hardening", "scope": "Both", - "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**", + "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM02.json b/data/entries/LLM02.json index a3b98e8..889a5fb 100644 --- a/data/entries/LLM02.json +++ b/data/entries/LLM02.json @@ -18,23 +18,23 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0021", - "control_name": "Data Leakage", + "control_id": "AML.T0057", + "control_name": "LLM Data Leakage", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0021", - "notes": "Unintended exposure of training data or sensitive context through model outputs — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0057", + "notes": "Unintended exposure of training data or sensitive context through model outputs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0030", - "control_name": "Information Disclosure", + "control_id": "AML.T0057", + "control_name": "LLM Data Leakage", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0030", - "notes": "Extraction of confidential information via targeted model queries — **DRAFT — AML.T0030 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0057", + "notes": "Extraction of confidential information via targeted model queries", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM03.json b/data/entries/LLM03.json index 33d79d9..45b2016 100644 --- a/data/entries/LLM03.json +++ b/data/entries/LLM03.json @@ -18,12 +18,12 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Foundational", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM05.json b/data/entries/LLM05.json index dfdf7b3..b964730 100644 --- a/data/entries/LLM05.json +++ b/data/entries/LLM05.json @@ -18,12 +18,12 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0032", - "notes": "Injecting malicious data into training pipelines to corrupt model behaviour — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0070", + "notes": "Injecting malicious data into training pipelines to corrupt model behaviour", "confidence": "unreviewed", "reviewed_by": [] }, @@ -40,12 +40,12 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0027", - "notes": "Reconstructing sensitive training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0024.001", + "notes": "Reconstructing sensitive training data from model outputs", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM08.json b/data/entries/LLM08.json index 45dcb5c..a1674fb 100644 --- a/data/entries/LLM08.json +++ b/data/entries/LLM08.json @@ -18,12 +18,12 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0041", - "control_name": "Configuration Exposure", + "control_id": "AML.T0056", + "control_name": "Extract LLM System Prompt", "tier": "Foundational", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0041", - "notes": "Extraction of internal model configuration, instructions, or system prompts — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0056", + "notes": "Extraction of internal model configuration, instructions, or system prompts", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM09.json b/data/entries/LLM09.json index ea3872e..b03ab20 100644 --- a/data/entries/LLM09.json +++ b/data/entries/LLM09.json @@ -18,12 +18,12 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", "tier": "Hardening", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0063", - "notes": "Crafting inputs whose embeddings manipulate similarity search results — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0066", + "notes": "Crafting inputs whose embeddings manipulate similarity search results", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/frameworks/mitre-atlas.json b/data/frameworks/mitre-atlas.json index ecab4ec..673cbc7 100644 --- a/data/frameworks/mitre-atlas.json +++ b/data/frameworks/mitre-atlas.json @@ -50,6 +50,14 @@ "function": "Reconnaissance", "kind": "technique" }, + { + "control_id": "AML.T0006.002", + "title": "Active Scanning: Scan for Exposed AI Infrastructure", + "description": "\"Adversaries may scan network ports and services to identify deployed\\ \\ AI backends, model-serving endpoints, and AI agent infrastructure reachable\\ \\ over the internet.", + "parent": "AML.T0006", + "function": "Reconnaissance", + "kind": "technique" + }, { "control_id": "AML.T0010", "title": "AI Supply Chain Compromise", @@ -160,6 +168,14 @@ "function": "Exfiltration", "parent": "AML.T0024" }, + { + "control_id": "AML.T0024.001", + "title": "Exfiltration via AI Inference API: Invert AI Model", + "description": "AI models' training data could be reconstructed by exploiting the confidence scores that are available via an inference API.", + "parent": "AML.T0024", + "function": "Exfiltration", + "kind": "technique" + }, { "control_id": "AML.T0024.002", "title": "Exfiltration via AI Inference API: Extract AI Model", @@ -353,6 +369,14 @@ "function": "Initial Access", "kind": "technique" }, + { + "control_id": "AML.T0052.000", + "title": "Phishing: Spearphishing via Social Engineering LLM", + "description": "Adversaries may turn LLMs into targeted social engineers.", + "parent": "AML.T0052", + "function": "Initial Access", + "kind": "technique" + }, { "control_id": "AML.T0053", "title": "AI Agent Tool Invocation", @@ -400,6 +424,14 @@ "kind": "technique", "function": "Discovery" }, + { + "control_id": "AML.T0066", + "title": "Retrieval Content Crafting", + "description": "Adversaries may write content designed to be retrieved by user queries and influence a user of the system in some way.", + "parent": null, + "function": "AI Attack Adaptation", + "kind": "technique" + }, { "control_id": "AML.T0068", "title": "LLM Prompt Obfuscation", @@ -407,6 +439,14 @@ "kind": "technique", "function": "Defense Evasion" }, + { + "control_id": "AML.T0070", + "title": "RAG Poisoning", + "description": "Adversaries may inject malicious content into data indexed by a retrieval augmented generation (RAG) system to contaminate a future thread through RAG-based search results.", + "parent": null, + "function": "Persistence", + "kind": "technique" + }, { "control_id": "AML.T0126", "title": "Automated Collection", @@ -431,11 +471,16 @@ "date": "2026-09-18", "change": "Added 2 ATLAS 2026.09 technique(s) now cited by corrected mapping rows: AML.T0024.002, AML.T0126", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Added 5 ATLAS 2026.09 technique(s) now cited by corrected mapping rows: AML.T0006.002, AML.T0024.001, AML.T0052.000, AML.T0066, AML.T0070", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { "status": "partial", - "included": 46, + "included": 51, "total": 208, "note": "Transcribed from ATLAS 2026.09. 6 further ids in this registry (AML.T0019, AML.T0022, AML.T0032, AML.T0045, AML.T0027, AML.T0030) are not techniques in 2026.09 and are left for review — see issue #93.", "source": "https://github.com/mitre-atlas/atlas-data/blob/v2026.09/dist/v6/ATLAS-2026.09.yaml" diff --git a/data/stats.json b/data/stats.json index ba7b959..ea443c9 100644 --- a/data/stats.json +++ b/data/stats.json @@ -94,11 +94,11 @@ }, "controls": { "total": 991, - "registry_items": 1120, + "registry_items": 1125, "by_kind": { "control": 991, "layer": 10, - "technique": 52, + "technique": 57, "threat-category": 6, "weakness": 61 } diff --git a/docs/backlinks.js b/docs/backlinks.js index 4209206..5f293e2 100644 --- a/docs/backlinks.js +++ b/docs/backlinks.js @@ -1,5 +1,5 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Backlinks: 767 +// Backlinks: 766 window.CROSSWALK_BACKLINKS = [ { "framework": "AIUC-1", @@ -18760,6 +18760,22 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0006.002", + "control_name": "Active Scanning: Scan for Exposed AI Infrastructure", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Identifying and mapping inter-agent communication endpoints for targeting" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0012", @@ -18801,40 +18817,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Exploiting overly permissive tool access to exceed intended agent scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Rogue agent gradually escalates its own capabilities and permissions over time — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0016", @@ -18973,22 +18955,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0021", - "control_name": "Data Leakage", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Unintended exposure of training data or sensitive context through model outputs — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024", @@ -19201,6 +19167,31 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", + "entries": [ + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Reconstructing sensitive training data from model outputs" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024.002", @@ -19314,31 +19305,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Reconstructing sensitive training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**" - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0029", @@ -19373,47 +19339,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0030", - "control_name": "Information Disclosure", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Extraction of confidential information via targeted model queries — **DRAFT — AML.T0030 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Injecting malicious data into training pipelines to corrupt model behaviour — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Injecting malicious content into agent persistent memory or RAG stores — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0034", @@ -19604,36 +19529,11 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0041", - "control_name": "Configuration Exposure", - "entries": [ - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Extraction of internal model configuration, instructions, or system prompts — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0043", - "control_name": "Network Service Scanning", + "control_name": "Craft Adversarial Data", "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Identifying and mapping inter-agent communication endpoints for targeting — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -19750,16 +19650,25 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0049", - "control_name": "Spearphishing via AI", + "control_name": "Exploit Public-Facing Application", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Compromised agent maintains persistent access and hidden execution across sessions" }, { "id": "DSGAI02", @@ -19885,6 +19794,56 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0052.000", + "control_name": "Phishing: Spearphishing via Social Engineering LLM", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users" + } + ] + }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", + "entries": [ + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Exploiting overly permissive tool access to exceed intended agent scope" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Rogue agent gradually escalates its own capabilities and permissions over time" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0054", @@ -19942,6 +19901,15 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": "Tampering with model weights, adapters, or configurations during supply chain — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Extraction of internal model configuration, instructions, or system prompts" + }, { "id": "ASI04", "name": "Agentic Supply Chain", @@ -19956,41 +19924,57 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_name": "LLM Data Leakage", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Unintended exposure of training data or sensitive context through model outputs" + } + ] + }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", + "entries": [ + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Crafting inputs whose embeddings manipulate similarity search results" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Compromised agent maintains persistent access and hidden execution across sessions — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour" } ] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "entries": [ { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Hardening", - "scope": "Build", - "notes": "Crafting inputs whose embeddings manipulate similarity search results — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "scope": "Both", + "notes": "Injecting malicious data into training pipelines to corrupt model behaviour" }, { "id": "ASI06", @@ -19999,7 +19983,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Injecting malicious content into agent persistent memory or RAG stores" } ] }, diff --git a/docs/data.js b/docs/data.js index 3d58538..dcd1b25 100644 --- a/docs/data.js +++ b/docs/data.js @@ -1465,23 +1465,23 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0021", - "control_name": "Data Leakage", + "control_id": "AML.T0057", + "control_name": "LLM Data Leakage", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0021", - "notes": "Unintended exposure of training data or sensitive context through model outputs — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0057", + "notes": "Unintended exposure of training data or sensitive context through model outputs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0030", - "control_name": "Information Disclosure", + "control_id": "AML.T0057", + "control_name": "LLM Data Leakage", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0030", - "notes": "Extraction of confidential information via targeted model queries — **DRAFT — AML.T0030 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0057", + "notes": "Extraction of confidential information via targeted model queries", "confidence": "unreviewed", "reviewed_by": [] }, @@ -2673,12 +2673,12 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Foundational", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope", "confidence": "unreviewed", "reviewed_by": [] }, @@ -5118,12 +5118,12 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0032", - "notes": "Injecting malicious data into training pipelines to corrupt model behaviour — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0070", + "notes": "Injecting malicious data into training pipelines to corrupt model behaviour", "confidence": "unreviewed", "reviewed_by": [] }, @@ -5140,12 +5140,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0027", - "notes": "Reconstructing sensitive training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0024.001", + "notes": "Reconstructing sensitive training data from model outputs", "confidence": "unreviewed", "reviewed_by": [] }, @@ -8542,12 +8542,12 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0041", - "control_name": "Configuration Exposure", + "control_id": "AML.T0056", + "control_name": "Extract LLM System Prompt", "tier": "Foundational", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0041", - "notes": "Extraction of internal model configuration, instructions, or system prompts — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0056", + "notes": "Extraction of internal model configuration, instructions, or system prompts", "confidence": "unreviewed", "reviewed_by": [] }, @@ -9603,12 +9603,12 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", "tier": "Hardening", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0063", - "notes": "Crafting inputs whose embeddings manipulate similarity search results — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0066", + "notes": "Crafting inputs whose embeddings manipulate similarity search results", "confidence": "unreviewed", "reviewed_by": [] }, @@ -14258,12 +14258,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Exploiting overly permissive tool access to exceed intended agent scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Exploiting overly permissive tool access to exceed intended agent scope", "confidence": "unreviewed", "reviewed_by": [] }, @@ -19242,23 +19242,23 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0032", - "notes": "Injecting malicious content into agent persistent memory or RAG stores — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0070", + "notes": "Injecting malicious content into agent persistent memory or RAG stores", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0063", - "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0066", + "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour", "confidence": "unreviewed", "reviewed_by": [] }, @@ -20413,12 +20413,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0043", - "control_name": "Network Service Scanning", + "control_id": "AML.T0006.002", + "control_name": "Active Scanning: Scan for Exposed AI Infrastructure", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0043", - "notes": "Identifying and mapping inter-agent communication endpoints for targeting — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0006.002", + "notes": "Identifying and mapping inter-agent communication endpoints for targeting", "confidence": "unreviewed", "reviewed_by": [] }, @@ -21566,12 +21566,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_id": "AML.T0049", + "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0057", - "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0049", + "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally", "confidence": "unreviewed", "reviewed_by": [] }, @@ -22696,12 +22696,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0049", - "control_name": "Spearphishing via AI", + "control_id": "AML.T0052.000", + "control_name": "Phishing: Spearphishing via Social Engineering LLM", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0049", - "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0052.000", + "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users", "confidence": "unreviewed", "reviewed_by": [] }, @@ -23834,23 +23834,23 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Rogue agent gradually escalates its own capabilities and permissions over time — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Rogue agent gradually escalates its own capabilities and permissions over time", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_id": "AML.T0049", + "control_name": "Exploit Public-Facing Application", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0057", - "notes": "Compromised agent maintains persistent access and hidden execution across sessions — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0049", + "notes": "Compromised agent maintains persistent access and hidden execution across sessions", "confidence": "unreviewed", "reviewed_by": [] }, @@ -42413,11 +42413,11 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", "tier": "Hardening", "scope": "Both", - "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**", + "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/docs/frameworks-registry.js b/docs/frameworks-registry.js index 06d6880..cfc0ecd 100644 --- a/docs/frameworks-registry.js +++ b/docs/frameworks-registry.js @@ -4064,6 +4064,14 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Reconnaissance", "kind": "technique" }, + { + "control_id": "AML.T0006.002", + "title": "Active Scanning: Scan for Exposed AI Infrastructure", + "description": "\"Adversaries may scan network ports and services to identify deployed\\ \\ AI backends, model-serving endpoints, and AI agent infrastructure reachable\\ \\ over the internet.", + "parent": "AML.T0006", + "function": "Reconnaissance", + "kind": "technique" + }, { "control_id": "AML.T0010", "title": "AI Supply Chain Compromise", @@ -4174,6 +4182,14 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Exfiltration", "parent": "AML.T0024" }, + { + "control_id": "AML.T0024.001", + "title": "Exfiltration via AI Inference API: Invert AI Model", + "description": "AI models' training data could be reconstructed by exploiting the confidence scores that are available via an inference API.", + "parent": "AML.T0024", + "function": "Exfiltration", + "kind": "technique" + }, { "control_id": "AML.T0024.002", "title": "Exfiltration via AI Inference API: Extract AI Model", @@ -4367,6 +4383,14 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Initial Access", "kind": "technique" }, + { + "control_id": "AML.T0052.000", + "title": "Phishing: Spearphishing via Social Engineering LLM", + "description": "Adversaries may turn LLMs into targeted social engineers.", + "parent": "AML.T0052", + "function": "Initial Access", + "kind": "technique" + }, { "control_id": "AML.T0053", "title": "AI Agent Tool Invocation", @@ -4414,6 +4438,14 @@ window.CROSSWALK_FRAMEWORKS = [ "kind": "technique", "function": "Discovery" }, + { + "control_id": "AML.T0066", + "title": "Retrieval Content Crafting", + "description": "Adversaries may write content designed to be retrieved by user queries and influence a user of the system in some way.", + "parent": null, + "function": "AI Attack Adaptation", + "kind": "technique" + }, { "control_id": "AML.T0068", "title": "LLM Prompt Obfuscation", @@ -4421,6 +4453,14 @@ window.CROSSWALK_FRAMEWORKS = [ "kind": "technique", "function": "Defense Evasion" }, + { + "control_id": "AML.T0070", + "title": "RAG Poisoning", + "description": "Adversaries may inject malicious content into data indexed by a retrieval augmented generation (RAG) system to contaminate a future thread through RAG-based search results.", + "parent": null, + "function": "Persistence", + "kind": "technique" + }, { "control_id": "AML.T0126", "title": "Automated Collection", @@ -4445,11 +4485,16 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Added 2 ATLAS 2026.09 technique(s) now cited by corrected mapping rows: AML.T0024.002, AML.T0126", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Added 5 ATLAS 2026.09 technique(s) now cited by corrected mapping rows: AML.T0006.002, AML.T0024.001, AML.T0052.000, AML.T0066, AML.T0070", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { "status": "partial", - "included": 46, + "included": 51, "total": 208, "note": "Transcribed from ATLAS 2026.09. 6 further ids in this registry (AML.T0019, AML.T0022, AML.T0032, AML.T0045, AML.T0027, AML.T0030) are not techniques in 2026.09 and are left for review — see issue #93.", "source": "https://github.com/mitre-atlas/atlas-data/blob/v2026.09/dist/v6/ATLAS-2026.09.yaml" diff --git a/dsgai-2026/DSGAI_MITREATLAS.md b/dsgai-2026/DSGAI_MITREATLAS.md index 0796c27..4c29742 100644 --- a/dsgai-2026/DSGAI_MITREATLAS.md +++ b/dsgai-2026/DSGAI_MITREATLAS.md @@ -84,7 +84,7 @@ goal) and techniques (how they achieve it): | DSGAI15 | Over-Broad Context Windows | High | AML.T0049, AML.T0025, AML.T0024 | Foundational–Hardening | | DSGAI16 | Endpoint & Browser Assistant Overreach | High | AML.T0013, AML.T0036, AML.T0024 | Foundational–Hardening | | DSGAI17 | Data Availability & Resilience Failures | High | AML.T0029, AML.T0034, AML.T0036 | Foundational–Advanced | -| DSGAI18 | Inference & Data Reconstruction | High | AML.T0024.000, AML.T0025, AML.T0027 | Hardening–Advanced | +| DSGAI18 | Inference & Data Reconstruction | High | AML.T0024.000, AML.T0025, AML.T0024.001 | Hardening–Advanced | | DSGAI19 | Human-in-Loop & Labeler Overexposure | Medium | AML.T0024, AML.T0036, AML.T0020 | Foundational–Hardening | | DSGAI20 | Model Exfiltration & IP Replication | High | AML.T0024.002, AML.T0025, AML.T0034 | Hardening–Advanced | | DSGAI21 | Disinformation via Data Poisoning | High | AML.T0045, AML.T0020, AML.T0043 | Hardening–Advanced | @@ -114,7 +114,7 @@ Key techniques cited throughout this mapping: | Manipulate AI Model | AML.T0018 | Embed hidden functionality triggered by specific inputs | | Craft Adversarial Data | AML.T0043 | Create inputs specifically designed to manipulate model outputs | | Infer Training Data Membership | AML.T0024.000 | Determine whether a specific data point was used in training | -| Model Inversion | AML.T0027 | Reconstruct training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)** | +| Exfiltration via AI Inference API: Invert AI Model | AML.T0024.001 | Reconstruct training data from model outputs | | Exfiltration via AI Inference API: Extract AI Model | AML.T0024.002 | Steal model functionality through systematic querying | | Exfiltration via Cyber Means | AML.T0025 | Steal data using standard cyber exfiltration techniques | | Exploit Public-Facing Application | AML.T0049 | Exploit vulnerabilities in AI APIs or web interfaces | @@ -910,7 +910,7 @@ are the primary techniques. |---|---|---|---| | Infer Training Data Membership | AML.T0024.000 | Exfiltration | Adversary determines whether specific sensitive records were used in training through systematic query analysis | | Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Training data confirmed present and partially reconstructed through inference, then exfiltrated | -| Model Inversion | AML.T0027 | Exfiltration | Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)** | +| Exfiltration via AI Inference API: Invert AI Model | AML.T0024.001 | Exfiltration | Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns | #### Mitigations mapped to ATLAS diff --git a/llm-top10/LLM_MITREATLAS.md b/llm-top10/LLM_MITREATLAS.md index 2eabe22..343b6de 100644 --- a/llm-top10/LLM_MITREATLAS.md +++ b/llm-top10/LLM_MITREATLAS.md @@ -77,14 +77,14 @@ ATLAS organises adversarial AI techniques across a kill chain of tactics: | ID | Name | Severity | Primary ATLAS Techniques | Tier | Scope | |---|---|---|---|---|---| | LLM01 | Prompt Injection | Critical | AML.T0051.000, AML.T0051.001, AML.T0054 | Foundational–Advanced | Both | -| LLM02 | Sensitive Information Disclosure | High | AML.T0021, AML.T0030, AML.T0024 | Foundational–Advanced | Both | -| LLM03 | Excessive Agency | Critical | AML.T0015, AML.T0126 | Foundational–Hardening | Build | +| LLM02 | Sensitive Information Disclosure | High | AML.T0057, AML.T0057, AML.T0024 | Foundational–Advanced | Both | +| LLM03 | Excessive Agency | Critical | AML.T0053, AML.T0126 | Foundational–Hardening | Build | | LLM04 | Supply Chain | High | AML.T0056, AML.T0048, AML.T0018 | Foundational–Hardening | Both | -| LLM05 | Data and Model Poisoning | Critical | AML.T0032, AML.T0018, AML.T0027 | Hardening–Advanced | Both | +| LLM05 | Data and Model Poisoning | Critical | AML.T0070, AML.T0018, AML.T0024.001 | Hardening–Advanced | Both | | LLM06 | Unbounded Consumption | High | AML.T0029, AML.T0034 | Foundational–Hardening | Both | | LLM07 | Misinformation | High | AML.T0045, AML.T0047 | Foundational–Hardening | Both | -| LLM08 | Hidden Context Exposure | High | AML.T0041, AML.T0051.000 | Foundational–Hardening | Build | -| LLM09 | Vector and Embedding Weaknesses | Medium | AML.T0063, AML.T0025 | Hardening–Advanced | Build | +| LLM08 | Hidden Context Exposure | High | AML.T0056, AML.T0051.000 | Foundational–Hardening | Build | +| LLM09 | Vector and Embedding Weaknesses | Medium | AML.T0066, AML.T0025 | Hardening–Advanced | Build | | LLM10 | Improper Output Handling | High | AML.T0037, AML.T0040 | Foundational–Hardening | Build | --- @@ -203,8 +203,8 @@ or improperly sanitised responses. | Technique | ID | Tactic | Description | |---|---|---|---| -| Data Leakage | [AML.T0021](https://atlas.mitre.org/techniques/AML.T0021) | Exfiltration | Unintended exposure of training data or sensitive context through model outputs — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | -| Information Disclosure | [AML.T0030](https://atlas.mitre.org/techniques/AML.T0030) | Collection | Extraction of confidential information via targeted model queries — **DRAFT — AML.T0030 is not an ATLAS technique id; retarget pending SME review (#93)** | +| LLM Data Leakage | [AML.T0057](https://atlas.mitre.org/techniques/AML.T0057) | Exfiltration | Unintended exposure of training data or sensitive context through model outputs | +| LLM Data Leakage | [AML.T0057](https://atlas.mitre.org/techniques/AML.T0057) | Collection | Extraction of confidential information via targeted model queries | | Model Inversion | [AML.T0024](https://atlas.mitre.org/techniques/AML.T0024) | Collection | Reconstructing training data from model outputs or confidence scores — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | #### Mitigations by tier @@ -271,7 +271,7 @@ misaligned goal-following. | Technique | ID | Tactic | Description | |---|---|---|---| -| LLM Capability Escalation | [AML.T0015](https://atlas.mitre.org/techniques/AML.T0015) | Privilege Escalation | Exploiting overly permissive LLM tool access to perform actions beyond intended scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| AI Agent Tool Invocation | [AML.T0053](https://atlas.mitre.org/techniques/AML.T0053) | Privilege Escalation | Exploiting overly permissive LLM tool access to perform actions beyond intended scope | | Automated Collection | [AML.T0126](https://atlas.mitre.org/techniques/AML.T0126) | Collection | LLM autonomously collecting data beyond its intended access scope | #### Mitigations by tier @@ -419,9 +419,9 @@ stage that writes weights, not just the original training corpus. | Technique | ID | Tactic | Description | |---|---|---|---| -| Data Poisoning | [AML.T0032](https://atlas.mitre.org/techniques/AML.T0032) | ML Attack Staging | Injecting malicious data into training pipelines to corrupt model behaviour — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)** | +| RAG Poisoning | [AML.T0070](https://atlas.mitre.org/techniques/AML.T0070) | ML Attack Staging | Injecting malicious data into training pipelines to corrupt model behaviour | | Manipulate AI Model | [AML.T0018](https://atlas.mitre.org/techniques/AML.T0018) | Persistence | Embedding hidden trigger-response patterns in model via poisoned training data | -| Model Inversion | [AML.T0027](https://atlas.mitre.org/techniques/AML.T0027) | Collection | Reconstructing sensitive training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)** | +| Exfiltration via AI Inference API: Invert AI Model | [AML.T0024.001](https://atlas.mitre.org/techniques/AML.T0024.001) | Collection | Reconstructing sensitive training data from model outputs | #### Mitigations by tier @@ -625,7 +625,7 @@ treat it as a security boundary. | Technique | ID | Tactic | Description | |---|---|---|---| -| Configuration Exposure | [AML.T0041](https://atlas.mitre.org/techniques/AML.T0041) | Discovery | Extraction of internal model configuration, instructions, or system prompts — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| Extract LLM System Prompt | [AML.T0056](https://atlas.mitre.org/techniques/AML.T0056) | Discovery | Extraction of internal model configuration, instructions, or system prompts | | LLM Prompt Injection: Direct | [AML.T0051.000](https://atlas.mitre.org/techniques/AML.T0051.000) | Influence Operations | Crafting inputs specifically designed to reveal or override system prompt content | #### Mitigations by tier @@ -685,7 +685,7 @@ to return attacker-controlled content. | Technique | ID | Tactic | Description | |---|---|---|---| -| Embedding Manipulation | [AML.T0063](https://atlas.mitre.org/techniques/AML.T0063) | ML Attack Staging | Crafting inputs whose embeddings manipulate similarity search results — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| Retrieval Content Crafting | [AML.T0066](https://atlas.mitre.org/techniques/AML.T0066) | ML Attack Staging | Crafting inputs whose embeddings manipulate similarity search results | | Resource Exhaustion via Embedding | [AML.T0025](https://atlas.mitre.org/techniques/AML.T0025) | Impact | Flooding vector stores with adversarial embeddings to degrade retrieval quality — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | #### Mitigations by tier