MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a public knowledge base of the tactics, techniques and real-world case studies adversaries use against machine learning and AI systems. It is modelled on MITRE ATT&CK, the widely used matrix for conventional cyberattacks, and uses the same structure so security teams can work with both.
How it is organised
- Tactics are the adversary's goals at each stage, laid out as matrix columns: for example Reconnaissance, Initial Access, AI Model Access, Execution, Persistence, Defense Evasion, Discovery, Collection, AI Attack Staging, Exfiltration and Impact.
- Techniques are how a goal is achieved, each with an identifier. LLM-specific entries include AML.T0051 LLM Prompt Injection (with direct and indirect sub-techniques) and AML.T0054 LLM Jailbreak, alongside classic ML attacks such as crafting adversarial data and model extraction through an inference API.
- Case studies document real incidents and red-team exercises, mapped step by step to techniques.
- Mitigations link defences to the techniques they address.
Worked example
A security team threat-models a customer-facing agent. Using ATLAS, they write the most worrying attack path as a chain: Reconnaissance (find public docs on which tools the agent uses), Initial Access via indirect prompt injection in a support ticket, Execution through the agent's tool calls, and Exfiltration of account data via a crafted link. Each step gets a technique ID, a planned control and a red-team test. The ID chain lets them report coverage the same way their organisation already reports ATT&CK coverage.
ATLAS vs the OWASP LLM Top 10
The OWASP Top 10 ranks risk categories for LLM applications. ATLAS describes adversary behaviour across the whole attack lifecycle and across all ML systems, not only LLMs. Teams commonly use OWASP to decide what to fix and ATLAS to describe how attacks unfold and to structure red-team reports.
Why it matters
AI security needs a shared language with the rest of security. ATLAS gives AI-specific attacks identifiers that fit into existing threat intelligence, detection engineering and incident response workflows, so AI risk is handled by the same processes as every other risk, rather than as a separate novelty.
Related terms
Sources
- The MITRE Corporation. MITRE ATLAS, 2025. atlas.mitre.org