From 2402c26bf973fe95f475e36928f46b5979bf2fbf Mon Sep 17 00:00:00 2001 From: emmanuelgjr Date: Fri, 18 Sep 2026 12:27:56 -0400 Subject: [PATCH] #93: retarget the 16 ATLAS rows whose own claim restates the ATLAS definition Category A of the ruling sheet posted on #93, approved by the maintainer. These are the rows where the text the author wrote in the row matches an ATLAS technique's published description, so the retarget follows the evidence rather than a judgment: "Data Poisoning" T0032 -> T0070 RAG Poisoning "Embedding Manipulation" T0063 -> T0066 Retrieval Content Crafting "Exploit Public-Facing ML Appl." T0057 -> T0049 Exploit Public-Facing Application "Data Leakage" T0021 -> T0057 LLM Data Leakage "Information Disclosure" T0030 -> T0057 LLM Data Leakage "Spearphishing via AI" T0049 -> T0052.000 Spearphishing via Social Engineering LLM "Model Inversion" T0027 -> T0024.001 Invert AI Model "Configuration Exposure" T0041 -> T0056 Extract LLM System Prompt "LLM Capability Escalation" T0015 -> T0053 AI Agent Tool Invocation "Network Service Scanning" T0043 -> T0006.002 Scan for Exposed AI Infrastructure Each row takes the technique's official name, its DRAFT marker comes off, and the quick-reference id lists follow the detail rows of the same entry. Five techniques the rulings now cite are transcribed into the registry from ATLAS 2026.09 (52 -> 57 items). Categories B (two defensible targets, 12 rows) and C (no ATLAS counterpart, 6 rows) keep their DRAFT markers and their entries in #93. Validator: 34 -> 18 flagged rows. Mappings unchanged at 3,771; no row removed, no severity, relationship or confidence touched. Consequence to note: LLM02 now carries two AML.T0057 rows, because "Data Leakage" and "Information Disclosure" both describe LLM Data Leakage. Their notes differ and merging them would discard one, so both are left. Co-Authored-By: Claude Opus 5 (1M context) --- agentic-top10/Agentic_MITREATLAS.md | 28 +-- data/backlinks.json | 314 +++++++++++++-------------- data/entries/ASI02.json | 8 +- data/entries/ASI06.json | 16 +- data/entries/ASI07.json | 8 +- data/entries/ASI08.json | 8 +- data/entries/ASI09.json | 8 +- data/entries/ASI10.json | 16 +- data/entries/DSGAI18.json | 6 +- data/entries/LLM02.json | 16 +- data/entries/LLM03.json | 8 +- data/entries/LLM05.json | 16 +- data/entries/LLM08.json | 8 +- data/entries/LLM09.json | 8 +- data/frameworks/mitre-atlas.json | 47 ++++- data/stats.json | 4 +- docs/backlinks.js | 316 +++++++++++++--------------- docs/data.js | 126 +++++------ docs/frameworks-registry.js | 47 ++++- dsgai-2026/DSGAI_MITREATLAS.md | 6 +- llm-top10/LLM_MITREATLAS.md | 24 +-- 21 files changed, 548 insertions(+), 490 deletions(-) diff --git a/agentic-top10/Agentic_MITREATLAS.md b/agentic-top10/Agentic_MITREATLAS.md index 799827e..74a5d64 100644 --- a/agentic-top10/Agentic_MITREATLAS.md +++ b/agentic-top10/Agentic_MITREATLAS.md @@ -58,15 +58,15 @@ it travels through. | ID | Name | Severity | Primary ATLAS Techniques | Agentic amplifier | Tier | |---|---|---|---|---|---| | ASI01 | Agent Goal Hijack | Critical | AML.T0051.000, AML.T0051.001, AML.T0054 | Autonomy turns single injection into multi-step attack chain | Foundational–Advanced | -| ASI02 | Tool Misuse & Exploitation | Critical | AML.T0037, AML.T0015, AML.T0126 | Tool access converts prompt manipulation into real-world action | Foundational–Advanced | +| ASI02 | Tool Misuse & Exploitation | Critical | AML.T0037, AML.T0053, AML.T0126 | Tool access converts prompt manipulation into real-world action | Foundational–Advanced | | ASI03 | Identity & Privilege Abuse | Critical | AML.T0012, AML.T0024 | Cached credentials give attacker persistent access beyond session | Foundational–Advanced | | ASI04 | Agentic Supply Chain | High | AML.T0056, AML.T0048, AML.T0018 | Runtime dynamic loading means poisoned components affect all consumers | Hardening–Advanced | | ASI05 | Unexpected Code Execution | Critical | AML.T0040, AML.T0054, AML.T0037 | Code generation + execution capability creates RCE gateway | Foundational–Advanced | -| ASI06 | Memory & Context Poisoning | High | AML.T0032, AML.T0063, AML.T0020 | Persistence across sessions amplifies impact of single injection | Hardening–Advanced | -| ASI07 | Insecure Inter-Agent Comms | High | AML.T0043, AML.T0012, AML.T0024 | A2A spoofing misdirects entire agent clusters | Hardening–Advanced | -| ASI08 | Cascading Agent Failures | High | AML.T0029, AML.T0034, AML.T0057 | Single fault fans out across all downstream agents | Foundational–Advanced | -| ASI09 | Human-Agent Trust Exploitation | Medium | AML.T0045, AML.T0047, AML.T0049 | Agent fluency makes manipulation invisible to audit logs | Foundational–Hardening | -| ASI10 | Rogue Agents | Critical | AML.T0054, AML.T0015, AML.T0057 | Compliant surface masks persistent hidden goal pursuit | Hardening–Advanced | +| ASI06 | Memory & Context Poisoning | High | AML.T0070, AML.T0066, AML.T0020 | Persistence across sessions amplifies impact of single injection | Hardening–Advanced | +| ASI07 | Insecure Inter-Agent Comms | High | AML.T0006.002, AML.T0012, AML.T0024 | A2A spoofing misdirects entire agent clusters | Hardening–Advanced | +| ASI08 | Cascading Agent Failures | High | AML.T0029, AML.T0034, AML.T0049 | Single fault fans out across all downstream agents | Foundational–Advanced | +| ASI09 | Human-Agent Trust Exploitation | Medium | AML.T0045, AML.T0047, AML.T0052.000 | Agent fluency makes manipulation invisible to audit logs | Foundational–Hardening | +| ASI10 | Rogue Agents | Critical | AML.T0054, AML.T0053, AML.T0049 | Compliant surface masks persistent hidden goal pursuit | Hardening–Advanced | --- @@ -177,7 +177,7 @@ tool does in response: delete, send, execute, publish. | Technique | ID | Tactic | Agentic context | |---|---|---|---| | Output Manipulation | [AML.T0037](https://atlas.mitre.org/techniques/AML.T0037) | Influence Operations | Crafting inputs that produce tool calls with destructive parameters — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | -| LLM Capability Escalation | [AML.T0015](https://atlas.mitre.org/techniques/AML.T0015) | Privilege Escalation | Exploiting overly permissive tool access to exceed intended agent scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| AI Agent Tool Invocation | [AML.T0053](https://atlas.mitre.org/techniques/AML.T0053) | Privilege Escalation | Exploiting overly permissive tool access to exceed intended agent scope | | Automated Collection | [AML.T0126](https://atlas.mitre.org/techniques/AML.T0126) | Collection | Agent autonomously harvesting data through tool chains beyond authorised scope | #### Mitigations by tier @@ -457,8 +457,8 @@ without triggering any single detectable event. | Technique | ID | Tactic | Agentic context | |---|---|---|---| -| Data Poisoning | [AML.T0032](https://atlas.mitre.org/techniques/AML.T0032) | ML Attack Staging | Injecting malicious content into agent persistent memory or RAG stores — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)** | -| Embedding Manipulation | [AML.T0063](https://atlas.mitre.org/techniques/AML.T0063) | ML Attack Staging | Crafting content whose embeddings bias future retrieval results in attacker's favour — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| RAG Poisoning | [AML.T0070](https://atlas.mitre.org/techniques/AML.T0070) | ML Attack Staging | Injecting malicious content into agent persistent memory or RAG stores | +| Retrieval Content Crafting | [AML.T0066](https://atlas.mitre.org/techniques/AML.T0066) | ML Attack Staging | Crafting content whose embeddings bias future retrieval results in attacker's favour | | Backdoor via Poisoned Memory | [AML.T0020](https://atlas.mitre.org/techniques/AML.T0020) | Persistence | Establishing persistent trigger-response patterns in agent memory stores — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | #### Mitigations by tier @@ -520,7 +520,7 @@ cluster. | Technique | ID | Tactic | Agentic context | |---|---|---|---| -| Network Service Scanning | [AML.T0043](https://atlas.mitre.org/techniques/AML.T0043) | Discovery | Identifying and mapping inter-agent communication endpoints for targeting — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| Active Scanning: Scan for Exposed AI Infrastructure | [AML.T0006.002](https://atlas.mitre.org/techniques/AML.T0006.002) | Discovery | Identifying and mapping inter-agent communication endpoints for targeting | | Valid Accounts | [AML.T0012](https://atlas.mitre.org/techniques/AML.T0012) | Persistence | Using compromised agent credentials to impersonate trusted agents in A2A channels | | Exfiltration via AI Inference API | [AML.T0024](https://atlas.mitre.org/techniques/AML.T0024) | Exfiltration | Intercepting inter-agent messages to exfiltrate sensitive context passed between agents | @@ -594,7 +594,7 @@ crosswalks for OT-specific controls. |---|---|---|---| | Denial of AI Service | [AML.T0029](https://atlas.mitre.org/techniques/AML.T0029) | Impact | Triggering cascading failure propagation to exhaust system resources or degrade service | | Cost Harvesting | [AML.T0034](https://atlas.mitre.org/techniques/AML.T0034) | Impact | Crafting inputs that trigger runaway agent loops generating unbounded costs | -| Exploit Public-Facing ML Application | [AML.T0057](https://atlas.mitre.org/techniques/AML.T0057) | Initial Access | Exploiting an exposed agent endpoint to introduce a fault that cascades internally — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| Exploit Public-Facing Application | [AML.T0049](https://atlas.mitre.org/techniques/AML.T0049) | Initial Access | Exploiting an exposed agent endpoint to introduce a fault that cascades internally | #### Mitigations by tier @@ -657,7 +657,7 @@ forensics shows a legitimate user decision, not an agent manipulation. |---|---|---|---| | Disinformation | [AML.T0045](https://atlas.mitre.org/techniques/AML.T0045) | Influence Operations | Agent generates persuasive false information to manipulate human approvals — **DRAFT — AML.T0045 is not an ATLAS technique id; retarget pending SME review (#93)** | | Influence via Automated Content | [AML.T0047](https://atlas.mitre.org/techniques/AML.T0047) | Influence Operations | Agent produces high-volume, fluent content that overwhelms human critical assessment — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | -| Spearphishing via AI | [AML.T0049](https://atlas.mitre.org/techniques/AML.T0049) | Initial Access | Compromised agent crafts highly personalised, convincing manipulation targeted at specific users — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| Phishing: Spearphishing via Social Engineering LLM | [AML.T0052.000](https://atlas.mitre.org/techniques/AML.T0052.000) | Initial Access | Compromised agent crafts highly personalised, convincing manipulation targeted at specific users | #### Mitigations by tier @@ -710,8 +710,8 @@ ASI06 attack that has gone undetected across multiple sessions. | Technique | ID | Tactic | Agentic context | |---|---|---|---| | LLM Jailbreak | [AML.T0054](https://atlas.mitre.org/techniques/AML.T0054) | Execution | Persistent override of agent safety constraints enabling hidden goal execution | -| LLM Capability Escalation | [AML.T0015](https://atlas.mitre.org/techniques/AML.T0015) | Privilege Escalation | Rogue agent gradually escalates its own capabilities and permissions over time — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | -| Exploit Public-Facing ML Application | [AML.T0057](https://atlas.mitre.org/techniques/AML.T0057) | Persistence | Compromised agent maintains persistent access and hidden execution across sessions — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| AI Agent Tool Invocation | [AML.T0053](https://atlas.mitre.org/techniques/AML.T0053) | Privilege Escalation | Rogue agent gradually escalates its own capabilities and permissions over time | +| Exploit Public-Facing Application | [AML.T0049](https://atlas.mitre.org/techniques/AML.T0049) | Persistence | Compromised agent maintains persistent access and hidden execution across sessions | #### Mitigations by tier diff --git a/data/backlinks.json b/data/backlinks.json index f87b6f1..a8afcc9 100644 --- a/data/backlinks.json +++ b/data/backlinks.json @@ -18758,6 +18758,22 @@ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0006.002", + "control_name": "Active Scanning: Scan for Exposed AI Infrastructure", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Identifying and mapping inter-agent communication endpoints for targeting" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0012", @@ -18799,40 +18815,6 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Exploiting overly permissive tool access to exceed intended agent scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Rogue agent gradually escalates its own capabilities and permissions over time — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0016", @@ -18971,22 +18953,6 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0021", - "control_name": "Data Leakage", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Unintended exposure of training data or sensitive context through model outputs — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024", @@ -19199,6 +19165,31 @@ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", + "entries": [ + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Reconstructing sensitive training data from model outputs" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024.002", @@ -19312,31 +19303,6 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Reconstructing sensitive training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**" - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0029", @@ -19371,47 +19337,6 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0030", - "control_name": "Information Disclosure", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Extraction of confidential information via targeted model queries — **DRAFT — AML.T0030 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Injecting malicious data into training pipelines to corrupt model behaviour — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Injecting malicious content into agent persistent memory or RAG stores — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0034", @@ -19602,36 +19527,11 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0041", - "control_name": "Configuration Exposure", - "entries": [ - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Extraction of internal model configuration, instructions, or system prompts — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0043", - "control_name": "Network Service Scanning", + "control_name": "Craft Adversarial Data", "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Identifying and mapping inter-agent communication endpoints for targeting — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -19748,16 +19648,25 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0049", - "control_name": "Spearphishing via AI", + "control_name": "Exploit Public-Facing Application", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Compromised agent maintains persistent access and hidden execution across sessions" }, { "id": "DSGAI02", @@ -19883,6 +19792,56 @@ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0052.000", + "control_name": "Phishing: Spearphishing via Social Engineering LLM", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users" + } + ] + }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", + "entries": [ + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Exploiting overly permissive tool access to exceed intended agent scope" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Rogue agent gradually escalates its own capabilities and permissions over time" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0054", @@ -19940,6 +19899,15 @@ "scope": "Both", "notes": "Tampering with model weights, adapters, or configurations during supply chain — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Extraction of internal model configuration, instructions, or system prompts" + }, { "id": "ASI04", "name": "Agentic Supply Chain", @@ -19954,41 +19922,57 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_name": "LLM Data Leakage", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Unintended exposure of training data or sensitive context through model outputs" + } + ] + }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", + "entries": [ + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Crafting inputs whose embeddings manipulate similarity search results" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Compromised agent maintains persistent access and hidden execution across sessions — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour" } ] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "entries": [ { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Hardening", - "scope": "Build", - "notes": "Crafting inputs whose embeddings manipulate similarity search results — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "scope": "Both", + "notes": "Injecting malicious data into training pipelines to corrupt model behaviour" }, { "id": "ASI06", @@ -19997,7 +19981,7 @@ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Injecting malicious content into agent persistent memory or RAG stores" } ] }, diff --git a/data/entries/ASI02.json b/data/entries/ASI02.json index 4680dc4..73bf196 100644 --- a/data/entries/ASI02.json +++ b/data/entries/ASI02.json @@ -95,12 +95,12 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Exploiting overly permissive tool access to exceed intended agent scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Exploiting overly permissive tool access to exceed intended agent scope", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI06.json b/data/entries/ASI06.json index 268297a..07d246c 100644 --- a/data/entries/ASI06.json +++ b/data/entries/ASI06.json @@ -84,23 +84,23 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0032", - "notes": "Injecting malicious content into agent persistent memory or RAG stores — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0070", + "notes": "Injecting malicious content into agent persistent memory or RAG stores", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0063", - "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0066", + "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI07.json b/data/entries/ASI07.json index c112955..0b7ba37 100644 --- a/data/entries/ASI07.json +++ b/data/entries/ASI07.json @@ -84,12 +84,12 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0043", - "control_name": "Network Service Scanning", + "control_id": "AML.T0006.002", + "control_name": "Active Scanning: Scan for Exposed AI Infrastructure", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0043", - "notes": "Identifying and mapping inter-agent communication endpoints for targeting — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0006.002", + "notes": "Identifying and mapping inter-agent communication endpoints for targeting", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI08.json b/data/entries/ASI08.json index 310a894..9f11c5e 100644 --- a/data/entries/ASI08.json +++ b/data/entries/ASI08.json @@ -106,12 +106,12 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_id": "AML.T0049", + "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0057", - "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0049", + "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI09.json b/data/entries/ASI09.json index 4bbc9d3..62f51af 100644 --- a/data/entries/ASI09.json +++ b/data/entries/ASI09.json @@ -106,12 +106,12 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0049", - "control_name": "Spearphishing via AI", + "control_id": "AML.T0052.000", + "control_name": "Phishing: Spearphishing via Social Engineering LLM", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0049", - "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0052.000", + "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/ASI10.json b/data/entries/ASI10.json index e037a42..9d08e24 100644 --- a/data/entries/ASI10.json +++ b/data/entries/ASI10.json @@ -95,23 +95,23 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Rogue agent gradually escalates its own capabilities and permissions over time — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Rogue agent gradually escalates its own capabilities and permissions over time", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_id": "AML.T0049", + "control_name": "Exploit Public-Facing Application", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0057", - "notes": "Compromised agent maintains persistent access and hidden execution across sessions — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0049", + "notes": "Compromised agent maintains persistent access and hidden execution across sessions", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/DSGAI18.json b/data/entries/DSGAI18.json index 70b077b..ca6d2ac 100644 --- a/data/entries/DSGAI18.json +++ b/data/entries/DSGAI18.json @@ -105,11 +105,11 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", "tier": "Hardening", "scope": "Both", - "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**", + "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM02.json b/data/entries/LLM02.json index a3b98e8..889a5fb 100644 --- a/data/entries/LLM02.json +++ b/data/entries/LLM02.json @@ -18,23 +18,23 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0021", - "control_name": "Data Leakage", + "control_id": "AML.T0057", + "control_name": "LLM Data Leakage", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0021", - "notes": "Unintended exposure of training data or sensitive context through model outputs — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0057", + "notes": "Unintended exposure of training data or sensitive context through model outputs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0030", - "control_name": "Information Disclosure", + "control_id": "AML.T0057", + "control_name": "LLM Data Leakage", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0030", - "notes": "Extraction of confidential information via targeted model queries — **DRAFT — AML.T0030 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0057", + "notes": "Extraction of confidential information via targeted model queries", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM03.json b/data/entries/LLM03.json index 33d79d9..45b2016 100644 --- a/data/entries/LLM03.json +++ b/data/entries/LLM03.json @@ -18,12 +18,12 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Foundational", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM05.json b/data/entries/LLM05.json index dfdf7b3..b964730 100644 --- a/data/entries/LLM05.json +++ b/data/entries/LLM05.json @@ -18,12 +18,12 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0032", - "notes": "Injecting malicious data into training pipelines to corrupt model behaviour — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0070", + "notes": "Injecting malicious data into training pipelines to corrupt model behaviour", "confidence": "unreviewed", "reviewed_by": [] }, @@ -40,12 +40,12 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0027", - "notes": "Reconstructing sensitive training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0024.001", + "notes": "Reconstructing sensitive training data from model outputs", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM08.json b/data/entries/LLM08.json index 45dcb5c..a1674fb 100644 --- a/data/entries/LLM08.json +++ b/data/entries/LLM08.json @@ -18,12 +18,12 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0041", - "control_name": "Configuration Exposure", + "control_id": "AML.T0056", + "control_name": "Extract LLM System Prompt", "tier": "Foundational", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0041", - "notes": "Extraction of internal model configuration, instructions, or system prompts — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0056", + "notes": "Extraction of internal model configuration, instructions, or system prompts", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/entries/LLM09.json b/data/entries/LLM09.json index ea3872e..b03ab20 100644 --- a/data/entries/LLM09.json +++ b/data/entries/LLM09.json @@ -18,12 +18,12 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", "tier": "Hardening", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0063", - "notes": "Crafting inputs whose embeddings manipulate similarity search results — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0066", + "notes": "Crafting inputs whose embeddings manipulate similarity search results", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/data/frameworks/mitre-atlas.json b/data/frameworks/mitre-atlas.json index ecab4ec..673cbc7 100644 --- a/data/frameworks/mitre-atlas.json +++ b/data/frameworks/mitre-atlas.json @@ -50,6 +50,14 @@ "function": "Reconnaissance", "kind": "technique" }, + { + "control_id": "AML.T0006.002", + "title": "Active Scanning: Scan for Exposed AI Infrastructure", + "description": "\"Adversaries may scan network ports and services to identify deployed\\ \\ AI backends, model-serving endpoints, and AI agent infrastructure reachable\\ \\ over the internet.", + "parent": "AML.T0006", + "function": "Reconnaissance", + "kind": "technique" + }, { "control_id": "AML.T0010", "title": "AI Supply Chain Compromise", @@ -160,6 +168,14 @@ "function": "Exfiltration", "parent": "AML.T0024" }, + { + "control_id": "AML.T0024.001", + "title": "Exfiltration via AI Inference API: Invert AI Model", + "description": "AI models' training data could be reconstructed by exploiting the confidence scores that are available via an inference API.", + "parent": "AML.T0024", + "function": "Exfiltration", + "kind": "technique" + }, { "control_id": "AML.T0024.002", "title": "Exfiltration via AI Inference API: Extract AI Model", @@ -353,6 +369,14 @@ "function": "Initial Access", "kind": "technique" }, + { + "control_id": "AML.T0052.000", + "title": "Phishing: Spearphishing via Social Engineering LLM", + "description": "Adversaries may turn LLMs into targeted social engineers.", + "parent": "AML.T0052", + "function": "Initial Access", + "kind": "technique" + }, { "control_id": "AML.T0053", "title": "AI Agent Tool Invocation", @@ -400,6 +424,14 @@ "kind": "technique", "function": "Discovery" }, + { + "control_id": "AML.T0066", + "title": "Retrieval Content Crafting", + "description": "Adversaries may write content designed to be retrieved by user queries and influence a user of the system in some way.", + "parent": null, + "function": "AI Attack Adaptation", + "kind": "technique" + }, { "control_id": "AML.T0068", "title": "LLM Prompt Obfuscation", @@ -407,6 +439,14 @@ "kind": "technique", "function": "Defense Evasion" }, + { + "control_id": "AML.T0070", + "title": "RAG Poisoning", + "description": "Adversaries may inject malicious content into data indexed by a retrieval augmented generation (RAG) system to contaminate a future thread through RAG-based search results.", + "parent": null, + "function": "Persistence", + "kind": "technique" + }, { "control_id": "AML.T0126", "title": "Automated Collection", @@ -431,11 +471,16 @@ "date": "2026-09-18", "change": "Added 2 ATLAS 2026.09 technique(s) now cited by corrected mapping rows: AML.T0024.002, AML.T0126", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Added 5 ATLAS 2026.09 technique(s) now cited by corrected mapping rows: AML.T0006.002, AML.T0024.001, AML.T0052.000, AML.T0066, AML.T0070", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { "status": "partial", - "included": 46, + "included": 51, "total": 208, "note": "Transcribed from ATLAS 2026.09. 6 further ids in this registry (AML.T0019, AML.T0022, AML.T0032, AML.T0045, AML.T0027, AML.T0030) are not techniques in 2026.09 and are left for review — see issue #93.", "source": "https://github.com/mitre-atlas/atlas-data/blob/v2026.09/dist/v6/ATLAS-2026.09.yaml" diff --git a/data/stats.json b/data/stats.json index ba7b959..ea443c9 100644 --- a/data/stats.json +++ b/data/stats.json @@ -94,11 +94,11 @@ }, "controls": { "total": 991, - "registry_items": 1120, + "registry_items": 1125, "by_kind": { "control": 991, "layer": 10, - "technique": 52, + "technique": 57, "threat-category": 6, "weakness": 61 } diff --git a/docs/backlinks.js b/docs/backlinks.js index 4209206..5f293e2 100644 --- a/docs/backlinks.js +++ b/docs/backlinks.js @@ -1,5 +1,5 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Backlinks: 767 +// Backlinks: 766 window.CROSSWALK_BACKLINKS = [ { "framework": "AIUC-1", @@ -18760,6 +18760,22 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0006.002", + "control_name": "Active Scanning: Scan for Exposed AI Infrastructure", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Identifying and mapping inter-agent communication endpoints for targeting" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0012", @@ -18801,40 +18817,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", - "entries": [ - { - "id": "LLM03", - "name": "Excessive Agency", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Build", - "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, - { - "id": "ASI02", - "name": "Tool Misuse and Exploitation", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Exploiting overly permissive tool access to exceed intended agent scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, - { - "id": "ASI10", - "name": "Rogue Agents", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Rogue agent gradually escalates its own capabilities and permissions over time — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0016", @@ -18973,22 +18955,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0021", - "control_name": "Data Leakage", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Unintended exposure of training data or sensitive context through model outputs — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024", @@ -19201,6 +19167,31 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", + "entries": [ + { + "id": "LLM05", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Reconstructing sensitive training data from model outputs" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024.002", @@ -19314,31 +19305,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Reconstructing sensitive training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**" - }, - { - "id": "DSGAI18", - "name": "Inference and Data Reconstruction", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0029", @@ -19373,47 +19339,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0030", - "control_name": "Information Disclosure", - "entries": [ - { - "id": "LLM02", - "name": "Sensitive Information Disclosure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Extraction of confidential information via targeted model queries — **DRAFT — AML.T0030 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", - "entries": [ - { - "id": "LLM05", - "name": "Data and Model Poisoning", - "source_list": "LLM-Top10-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Injecting malicious data into training pipelines to corrupt model behaviour — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**" - }, - { - "id": "ASI06", - "name": "Memory and Context Poisoning", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Injecting malicious content into agent persistent memory or RAG stores — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0034", @@ -19604,36 +19529,11 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0041", - "control_name": "Configuration Exposure", - "entries": [ - { - "id": "LLM08", - "name": "Hidden Context Exposure", - "source_list": "LLM-Top10-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Build", - "notes": "Extraction of internal model configuration, instructions, or system prompts — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0043", - "control_name": "Network Service Scanning", + "control_name": "Craft Adversarial Data", "entries": [ - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Identifying and mapping inter-agent communication endpoints for targeting — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" - }, { "id": "DSGAI04", "name": "Data Model and Artifact Poisoning", @@ -19750,16 +19650,25 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0049", - "control_name": "Spearphishing via AI", + "control_name": "Exploit Public-Facing Application", "entries": [ { - "id": "ASI09", - "name": "Human-Agent Trust Exploitation", + "id": "ASI08", + "name": "Cascading Agent Failures", "source_list": "Agentic-Top10-2026", - "severity": "High", + "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Compromised agent maintains persistent access and hidden execution across sessions" }, { "id": "DSGAI02", @@ -19885,6 +19794,56 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0052.000", + "control_name": "Phishing: Spearphishing via Social Engineering LLM", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users" + } + ] + }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", + "entries": [ + { + "id": "LLM03", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Build", + "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Exploiting overly permissive tool access to exceed intended agent scope" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Rogue agent gradually escalates its own capabilities and permissions over time" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0054", @@ -19942,6 +19901,15 @@ window.CROSSWALK_BACKLINKS = [ "scope": "Both", "notes": "Tampering with model weights, adapters, or configurations during supply chain — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" }, + { + "id": "LLM08", + "name": "Hidden Context Exposure", + "source_list": "LLM-Top10-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Build", + "notes": "Extraction of internal model configuration, instructions, or system prompts" + }, { "id": "ASI04", "name": "Agentic Supply Chain", @@ -19956,41 +19924,57 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_name": "LLM Data Leakage", "entries": [ { - "id": "ASI08", - "name": "Cascading Agent Failures", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2026", + "severity": "High", "tier": "Foundational", "scope": "Both", - "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Unintended exposure of training data or sensitive context through model outputs" + } + ] + }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", + "entries": [ + { + "id": "LLM09", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Build", + "notes": "Crafting inputs whose embeddings manipulate similarity search results" }, { - "id": "ASI10", - "name": "Rogue Agents", + "id": "ASI06", + "name": "Memory and Context Poisoning", "source_list": "Agentic-Top10-2026", - "severity": "Critical", + "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Compromised agent maintains persistent access and hidden execution across sessions — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour" } ] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "entries": [ { - "id": "LLM09", - "name": "Vector and Embedding Weaknesses", + "id": "LLM05", + "name": "Data and Model Poisoning", "source_list": "LLM-Top10-2026", - "severity": "Medium", + "severity": "Critical", "tier": "Hardening", - "scope": "Build", - "notes": "Crafting inputs whose embeddings manipulate similarity search results — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "scope": "Both", + "notes": "Injecting malicious data into training pipelines to corrupt model behaviour" }, { "id": "ASI06", @@ -19999,7 +19983,7 @@ window.CROSSWALK_BACKLINKS = [ "severity": "High", "tier": "Hardening", "scope": "Both", - "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**" + "notes": "Injecting malicious content into agent persistent memory or RAG stores" } ] }, diff --git a/docs/data.js b/docs/data.js index 3d58538..dcd1b25 100644 --- a/docs/data.js +++ b/docs/data.js @@ -1465,23 +1465,23 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0021", - "control_name": "Data Leakage", + "control_id": "AML.T0057", + "control_name": "LLM Data Leakage", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0021", - "notes": "Unintended exposure of training data or sensitive context through model outputs — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0057", + "notes": "Unintended exposure of training data or sensitive context through model outputs", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0030", - "control_name": "Information Disclosure", + "control_id": "AML.T0057", + "control_name": "LLM Data Leakage", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0030", - "notes": "Extraction of confidential information via targeted model queries — **DRAFT — AML.T0030 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0057", + "notes": "Extraction of confidential information via targeted model queries", "confidence": "unreviewed", "reviewed_by": [] }, @@ -2673,12 +2673,12 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Foundational", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope", "confidence": "unreviewed", "reviewed_by": [] }, @@ -5118,12 +5118,12 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0032", - "notes": "Injecting malicious data into training pipelines to corrupt model behaviour — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0070", + "notes": "Injecting malicious data into training pipelines to corrupt model behaviour", "confidence": "unreviewed", "reviewed_by": [] }, @@ -5140,12 +5140,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0027", - "notes": "Reconstructing sensitive training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0024.001", + "notes": "Reconstructing sensitive training data from model outputs", "confidence": "unreviewed", "reviewed_by": [] }, @@ -8542,12 +8542,12 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0041", - "control_name": "Configuration Exposure", + "control_id": "AML.T0056", + "control_name": "Extract LLM System Prompt", "tier": "Foundational", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0041", - "notes": "Extraction of internal model configuration, instructions, or system prompts — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0056", + "notes": "Extraction of internal model configuration, instructions, or system prompts", "confidence": "unreviewed", "reviewed_by": [] }, @@ -9603,12 +9603,12 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", "tier": "Hardening", "scope": "Build", - "url": "https://atlas.mitre.org/techniques/AML.T0063", - "notes": "Crafting inputs whose embeddings manipulate similarity search results — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0066", + "notes": "Crafting inputs whose embeddings manipulate similarity search results", "confidence": "unreviewed", "reviewed_by": [] }, @@ -14258,12 +14258,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Exploiting overly permissive tool access to exceed intended agent scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Exploiting overly permissive tool access to exceed intended agent scope", "confidence": "unreviewed", "reviewed_by": [] }, @@ -19242,23 +19242,23 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0032", - "control_name": "Data Poisoning", + "control_id": "AML.T0070", + "control_name": "RAG Poisoning", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0032", - "notes": "Injecting malicious content into agent persistent memory or RAG stores — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0070", + "notes": "Injecting malicious content into agent persistent memory or RAG stores", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0063", - "control_name": "Embedding Manipulation", + "control_id": "AML.T0066", + "control_name": "Retrieval Content Crafting", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0063", - "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0066", + "notes": "Crafting content whose embeddings bias future retrieval results in attacker's favour", "confidence": "unreviewed", "reviewed_by": [] }, @@ -20413,12 +20413,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0043", - "control_name": "Network Service Scanning", + "control_id": "AML.T0006.002", + "control_name": "Active Scanning: Scan for Exposed AI Infrastructure", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0043", - "notes": "Identifying and mapping inter-agent communication endpoints for targeting — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0006.002", + "notes": "Identifying and mapping inter-agent communication endpoints for targeting", "confidence": "unreviewed", "reviewed_by": [] }, @@ -21566,12 +21566,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_id": "AML.T0049", + "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0057", - "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0049", + "notes": "Exploiting an exposed agent endpoint to introduce a fault that cascades internally", "confidence": "unreviewed", "reviewed_by": [] }, @@ -22696,12 +22696,12 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0049", - "control_name": "Spearphishing via AI", + "control_id": "AML.T0052.000", + "control_name": "Phishing: Spearphishing via Social Engineering LLM", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0049", - "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0052.000", + "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users", "confidence": "unreviewed", "reviewed_by": [] }, @@ -23834,23 +23834,23 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0015", - "control_name": "LLM Capability Escalation", + "control_id": "AML.T0053", + "control_name": "AI Agent Tool Invocation", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0015", - "notes": "Rogue agent gradually escalates its own capabilities and permissions over time — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0053", + "notes": "Rogue agent gradually escalates its own capabilities and permissions over time", "confidence": "unreviewed", "reviewed_by": [] }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", - "control_name": "Exploit Public-Facing ML Application", + "control_id": "AML.T0049", + "control_name": "Exploit Public-Facing Application", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0057", - "notes": "Compromised agent maintains persistent access and hidden execution across sessions — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)**", + "url": "https://atlas.mitre.org/techniques/AML.T0049", + "notes": "Compromised agent maintains persistent access and hidden execution across sessions", "confidence": "unreviewed", "reviewed_by": [] }, @@ -42413,11 +42413,11 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0027", - "control_name": "Model Inversion", + "control_id": "AML.T0024.001", + "control_name": "Exfiltration via AI Inference API: Invert AI Model", "tier": "Hardening", "scope": "Both", - "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)**", + "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns", "confidence": "unreviewed", "reviewed_by": [] }, diff --git a/docs/frameworks-registry.js b/docs/frameworks-registry.js index 06d6880..cfc0ecd 100644 --- a/docs/frameworks-registry.js +++ b/docs/frameworks-registry.js @@ -4064,6 +4064,14 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Reconnaissance", "kind": "technique" }, + { + "control_id": "AML.T0006.002", + "title": "Active Scanning: Scan for Exposed AI Infrastructure", + "description": "\"Adversaries may scan network ports and services to identify deployed\\ \\ AI backends, model-serving endpoints, and AI agent infrastructure reachable\\ \\ over the internet.", + "parent": "AML.T0006", + "function": "Reconnaissance", + "kind": "technique" + }, { "control_id": "AML.T0010", "title": "AI Supply Chain Compromise", @@ -4174,6 +4182,14 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Exfiltration", "parent": "AML.T0024" }, + { + "control_id": "AML.T0024.001", + "title": "Exfiltration via AI Inference API: Invert AI Model", + "description": "AI models' training data could be reconstructed by exploiting the confidence scores that are available via an inference API.", + "parent": "AML.T0024", + "function": "Exfiltration", + "kind": "technique" + }, { "control_id": "AML.T0024.002", "title": "Exfiltration via AI Inference API: Extract AI Model", @@ -4367,6 +4383,14 @@ window.CROSSWALK_FRAMEWORKS = [ "function": "Initial Access", "kind": "technique" }, + { + "control_id": "AML.T0052.000", + "title": "Phishing: Spearphishing via Social Engineering LLM", + "description": "Adversaries may turn LLMs into targeted social engineers.", + "parent": "AML.T0052", + "function": "Initial Access", + "kind": "technique" + }, { "control_id": "AML.T0053", "title": "AI Agent Tool Invocation", @@ -4414,6 +4438,14 @@ window.CROSSWALK_FRAMEWORKS = [ "kind": "technique", "function": "Discovery" }, + { + "control_id": "AML.T0066", + "title": "Retrieval Content Crafting", + "description": "Adversaries may write content designed to be retrieved by user queries and influence a user of the system in some way.", + "parent": null, + "function": "AI Attack Adaptation", + "kind": "technique" + }, { "control_id": "AML.T0068", "title": "LLM Prompt Obfuscation", @@ -4421,6 +4453,14 @@ window.CROSSWALK_FRAMEWORKS = [ "kind": "technique", "function": "Defense Evasion" }, + { + "control_id": "AML.T0070", + "title": "RAG Poisoning", + "description": "Adversaries may inject malicious content into data indexed by a retrieval augmented generation (RAG) system to contaminate a future thread through RAG-based search results.", + "parent": null, + "function": "Persistence", + "kind": "technique" + }, { "control_id": "AML.T0126", "title": "Automated Collection", @@ -4445,11 +4485,16 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-09-18", "change": "Added 2 ATLAS 2026.09 technique(s) now cited by corrected mapping rows: AML.T0024.002, AML.T0126", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-18", + "change": "Added 5 ATLAS 2026.09 technique(s) now cited by corrected mapping rows: AML.T0006.002, AML.T0024.001, AML.T0052.000, AML.T0066, AML.T0070", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { "status": "partial", - "included": 46, + "included": 51, "total": 208, "note": "Transcribed from ATLAS 2026.09. 6 further ids in this registry (AML.T0019, AML.T0022, AML.T0032, AML.T0045, AML.T0027, AML.T0030) are not techniques in 2026.09 and are left for review — see issue #93.", "source": "https://github.com/mitre-atlas/atlas-data/blob/v2026.09/dist/v6/ATLAS-2026.09.yaml" diff --git a/dsgai-2026/DSGAI_MITREATLAS.md b/dsgai-2026/DSGAI_MITREATLAS.md index 0796c27..4c29742 100644 --- a/dsgai-2026/DSGAI_MITREATLAS.md +++ b/dsgai-2026/DSGAI_MITREATLAS.md @@ -84,7 +84,7 @@ goal) and techniques (how they achieve it): | DSGAI15 | Over-Broad Context Windows | High | AML.T0049, AML.T0025, AML.T0024 | Foundational–Hardening | | DSGAI16 | Endpoint & Browser Assistant Overreach | High | AML.T0013, AML.T0036, AML.T0024 | Foundational–Hardening | | DSGAI17 | Data Availability & Resilience Failures | High | AML.T0029, AML.T0034, AML.T0036 | Foundational–Advanced | -| DSGAI18 | Inference & Data Reconstruction | High | AML.T0024.000, AML.T0025, AML.T0027 | Hardening–Advanced | +| DSGAI18 | Inference & Data Reconstruction | High | AML.T0024.000, AML.T0025, AML.T0024.001 | Hardening–Advanced | | DSGAI19 | Human-in-Loop & Labeler Overexposure | Medium | AML.T0024, AML.T0036, AML.T0020 | Foundational–Hardening | | DSGAI20 | Model Exfiltration & IP Replication | High | AML.T0024.002, AML.T0025, AML.T0034 | Hardening–Advanced | | DSGAI21 | Disinformation via Data Poisoning | High | AML.T0045, AML.T0020, AML.T0043 | Hardening–Advanced | @@ -114,7 +114,7 @@ Key techniques cited throughout this mapping: | Manipulate AI Model | AML.T0018 | Embed hidden functionality triggered by specific inputs | | Craft Adversarial Data | AML.T0043 | Create inputs specifically designed to manipulate model outputs | | Infer Training Data Membership | AML.T0024.000 | Determine whether a specific data point was used in training | -| Model Inversion | AML.T0027 | Reconstruct training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)** | +| Exfiltration via AI Inference API: Invert AI Model | AML.T0024.001 | Reconstruct training data from model outputs | | Exfiltration via AI Inference API: Extract AI Model | AML.T0024.002 | Steal model functionality through systematic querying | | Exfiltration via Cyber Means | AML.T0025 | Steal data using standard cyber exfiltration techniques | | Exploit Public-Facing Application | AML.T0049 | Exploit vulnerabilities in AI APIs or web interfaces | @@ -910,7 +910,7 @@ are the primary techniques. |---|---|---|---| | Infer Training Data Membership | AML.T0024.000 | Exfiltration | Adversary determines whether specific sensitive records were used in training through systematic query analysis | | Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Training data confirmed present and partially reconstructed through inference, then exfiltrated | -| Model Inversion | AML.T0027 | Exfiltration | Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)** | +| Exfiltration via AI Inference API: Invert AI Model | AML.T0024.001 | Exfiltration | Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns | #### Mitigations mapped to ATLAS diff --git a/llm-top10/LLM_MITREATLAS.md b/llm-top10/LLM_MITREATLAS.md index 2eabe22..343b6de 100644 --- a/llm-top10/LLM_MITREATLAS.md +++ b/llm-top10/LLM_MITREATLAS.md @@ -77,14 +77,14 @@ ATLAS organises adversarial AI techniques across a kill chain of tactics: | ID | Name | Severity | Primary ATLAS Techniques | Tier | Scope | |---|---|---|---|---|---| | LLM01 | Prompt Injection | Critical | AML.T0051.000, AML.T0051.001, AML.T0054 | Foundational–Advanced | Both | -| LLM02 | Sensitive Information Disclosure | High | AML.T0021, AML.T0030, AML.T0024 | Foundational–Advanced | Both | -| LLM03 | Excessive Agency | Critical | AML.T0015, AML.T0126 | Foundational–Hardening | Build | +| LLM02 | Sensitive Information Disclosure | High | AML.T0057, AML.T0057, AML.T0024 | Foundational–Advanced | Both | +| LLM03 | Excessive Agency | Critical | AML.T0053, AML.T0126 | Foundational–Hardening | Build | | LLM04 | Supply Chain | High | AML.T0056, AML.T0048, AML.T0018 | Foundational–Hardening | Both | -| LLM05 | Data and Model Poisoning | Critical | AML.T0032, AML.T0018, AML.T0027 | Hardening–Advanced | Both | +| LLM05 | Data and Model Poisoning | Critical | AML.T0070, AML.T0018, AML.T0024.001 | Hardening–Advanced | Both | | LLM06 | Unbounded Consumption | High | AML.T0029, AML.T0034 | Foundational–Hardening | Both | | LLM07 | Misinformation | High | AML.T0045, AML.T0047 | Foundational–Hardening | Both | -| LLM08 | Hidden Context Exposure | High | AML.T0041, AML.T0051.000 | Foundational–Hardening | Build | -| LLM09 | Vector and Embedding Weaknesses | Medium | AML.T0063, AML.T0025 | Hardening–Advanced | Build | +| LLM08 | Hidden Context Exposure | High | AML.T0056, AML.T0051.000 | Foundational–Hardening | Build | +| LLM09 | Vector and Embedding Weaknesses | Medium | AML.T0066, AML.T0025 | Hardening–Advanced | Build | | LLM10 | Improper Output Handling | High | AML.T0037, AML.T0040 | Foundational–Hardening | Build | --- @@ -203,8 +203,8 @@ or improperly sanitised responses. | Technique | ID | Tactic | Description | |---|---|---|---| -| Data Leakage | [AML.T0021](https://atlas.mitre.org/techniques/AML.T0021) | Exfiltration | Unintended exposure of training data or sensitive context through model outputs — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | -| Information Disclosure | [AML.T0030](https://atlas.mitre.org/techniques/AML.T0030) | Collection | Extraction of confidential information via targeted model queries — **DRAFT — AML.T0030 is not an ATLAS technique id; retarget pending SME review (#93)** | +| LLM Data Leakage | [AML.T0057](https://atlas.mitre.org/techniques/AML.T0057) | Exfiltration | Unintended exposure of training data or sensitive context through model outputs | +| LLM Data Leakage | [AML.T0057](https://atlas.mitre.org/techniques/AML.T0057) | Collection | Extraction of confidential information via targeted model queries | | Model Inversion | [AML.T0024](https://atlas.mitre.org/techniques/AML.T0024) | Collection | Reconstructing training data from model outputs or confidence scores — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | #### Mitigations by tier @@ -271,7 +271,7 @@ misaligned goal-following. | Technique | ID | Tactic | Description | |---|---|---|---| -| LLM Capability Escalation | [AML.T0015](https://atlas.mitre.org/techniques/AML.T0015) | Privilege Escalation | Exploiting overly permissive LLM tool access to perform actions beyond intended scope — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| AI Agent Tool Invocation | [AML.T0053](https://atlas.mitre.org/techniques/AML.T0053) | Privilege Escalation | Exploiting overly permissive LLM tool access to perform actions beyond intended scope | | Automated Collection | [AML.T0126](https://atlas.mitre.org/techniques/AML.T0126) | Collection | LLM autonomously collecting data beyond its intended access scope | #### Mitigations by tier @@ -419,9 +419,9 @@ stage that writes weights, not just the original training corpus. | Technique | ID | Tactic | Description | |---|---|---|---| -| Data Poisoning | [AML.T0032](https://atlas.mitre.org/techniques/AML.T0032) | ML Attack Staging | Injecting malicious data into training pipelines to corrupt model behaviour — **DRAFT — AML.T0032 is not an ATLAS technique id; retarget pending SME review (#93)** | +| RAG Poisoning | [AML.T0070](https://atlas.mitre.org/techniques/AML.T0070) | ML Attack Staging | Injecting malicious data into training pipelines to corrupt model behaviour | | Manipulate AI Model | [AML.T0018](https://atlas.mitre.org/techniques/AML.T0018) | Persistence | Embedding hidden trigger-response patterns in model via poisoned training data | -| Model Inversion | [AML.T0027](https://atlas.mitre.org/techniques/AML.T0027) | Collection | Reconstructing sensitive training data from model outputs — **DRAFT — AML.T0027 is not an ATLAS technique id; retarget pending SME review (#93)** | +| Exfiltration via AI Inference API: Invert AI Model | [AML.T0024.001](https://atlas.mitre.org/techniques/AML.T0024.001) | Collection | Reconstructing sensitive training data from model outputs | #### Mitigations by tier @@ -625,7 +625,7 @@ treat it as a security boundary. | Technique | ID | Tactic | Description | |---|---|---|---| -| Configuration Exposure | [AML.T0041](https://atlas.mitre.org/techniques/AML.T0041) | Discovery | Extraction of internal model configuration, instructions, or system prompts — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| Extract LLM System Prompt | [AML.T0056](https://atlas.mitre.org/techniques/AML.T0056) | Discovery | Extraction of internal model configuration, instructions, or system prompts | | LLM Prompt Injection: Direct | [AML.T0051.000](https://atlas.mitre.org/techniques/AML.T0051.000) | Influence Operations | Crafting inputs specifically designed to reveal or override system prompt content | #### Mitigations by tier @@ -685,7 +685,7 @@ to return attacker-controlled content. | Technique | ID | Tactic | Description | |---|---|---|---| -| Embedding Manipulation | [AML.T0063](https://atlas.mitre.org/techniques/AML.T0063) | ML Attack Staging | Crafting inputs whose embeddings manipulate similarity search results — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | +| Retrieval Content Crafting | [AML.T0066](https://atlas.mitre.org/techniques/AML.T0066) | ML Attack Staging | Crafting inputs whose embeddings manipulate similarity search results | | Resource Exhaustion via Embedding | [AML.T0025](https://atlas.mitre.org/techniques/AML.T0025) | Impact | Flooding vector stores with adversarial embeddings to degrade retrieval quality — **DRAFT — not an ATLAS technique name; retarget pending SME review (#93)** | #### Mitigations by tier