MITRE ATLAS Tactics Explained: The Stages of an AI Attack

What are MITRE ATLAS tactics?

ATLAS is MITRE's knowledge base of how attackers target AI systems. It is built from real incidents and research, and it copies the structure of MITRE ATT&CK, the framework security teams already use for ordinary attacks. If you are new to it, start with what MITRE ATLAS is and how it differs from ATT&CK.

A tactic is the attacker's goal at one step: "get in", "stay in", "steal data". A technique is how they do it, such as hiding instructions in a web page. Think of tactics as the chapter titles of an attack, and techniques as the paragraphs.

Two points make this useful. First, the tactics give you a checklist: for each goal, what could stop the attacker? Second, they show that most attacks are not one trick. They are a chain.

How many ATLAS tactics are there?

Sixteen, in the official data file for release 2026.07. Fourteen come from ATT&CK, adapted for AI. Two are specific to AI: AI Model Access and AI Attack Staging. Counts of techniques and mitigations change with each release, so check the ATLAS site for current numbers.

The table is ordered roughly as an attack unfolds. MITRE numbers them differently, which is why the IDs look shuffled. The names and IDs match the official ATLAS data file.

The tactics, one by one

Stage 1: Preparing the attack

Reconnaissance. The attacker researches you before touching anything: your public documentation, the model you use, your job postings, your API behaviour. AI example: asking a support bot odd questions to work out which model sits behind it.

Resource Development. They set up what they need: accounts, poisoned documents, a malicious website, a look-alike package. AI example: publishing a web page full of hidden instructions, waiting for an AI browser agent to read it.

AI Model Access. The attacker gets some level of access to the model, whether through your public chat box, your API, or a stolen copy. The level matters. A chat window lets them probe. Full access lets them study the model's internals. See our guide to model theft.

AI Attack Staging. They use what they know to tune the attack, such as building a copy of your model to test attacks on first, or crafting inputs designed to fool it. This is the AI-specific rehearsal step, and it explains why model evasion attacks can be so reliable.

Stage 2: Getting in and running

Initial Access. The first foothold: a compromised dependency, a public-facing AI app, or a poisoned file the AI trusts. AI example: an email that an AI assistant reads automatically.

Execution. The attacker's instructions run. For AI, this is often prompt injection, where text is treated as a command. ATLAS lists LLM prompt injection as AML.T0051 and jailbreaking as AML.T0054 (IDs can move between releases, so confirm in the matrix). Read what prompt injection is.

Persistence. They make the foothold last. In AI systems this includes planting data that gets reloaded each time: a poisoned knowledge base entry, or a bad "memory". See memory poisoning and data poisoning.

Privilege Escalation. They gain more power than they started with. AI example: tricking an agent that has admin credentials into doing something the attacker's own account could never do.

Defense Evasion. They avoid being noticed, for instance by encoding instructions so filters miss them, or splitting a malicious request across many harmless-looking ones.

Stage 3: Looking around and spreading

Credential Access. Agents often hold API keys and tokens. If an attacker can make the model reveal or use them, they have a way into every connected system.

Discovery. The attacker maps what the AI can reach: which tools, which databases, which files. AI example: asking an agent "what tools do you have?" and noting the answer.

Lateral Movement. They move from one component to another, such as from a chatbot to the internal system it calls. In multi-agent setups, one compromised agent can pass poisoned instructions to the next.

Collection. They gather what they came for: private documents the AI can retrieve, training data, prompts, or model files.

Stage 4: Taking control and causing harm

Command and Control. The attacker keeps a channel to direct a compromised AI component. AI example: an agent that, every time it runs, fetches fresh instructions from a page the attacker controls.

Exfiltration. Data leaves. This might be a model response that leaks a customer record, or an agent that sends files to an outside address. Zero-click incidents have shown a single email causing data theft without anyone clicking anything; see zero-click AI attack case studies.

Impact. The damage lands: wrong decisions, deleted data, stolen money, a model made unusable, or lost trust. For agents, impact can be a real-world action, which is why AI agent blast radius matters.

What do ATLAS tactics look like against an AI agent?

Agents are where the chain becomes concrete. Take an AI assistant that reads email and can send messages.

No malware, no password theft. The attacker needed only text the agent would read. ATLAS now includes techniques written for agents, such as AI Agent Context Poisoning (AML.T0080) and AI Agent Tool Poisoning (AML.T0110). According to one independent review, the 2026.09 release did not add new tactics for agents; the agent-specific detail sits at the technique level. If you run agents, read AI agent tool security and how to prevent zero-click AI attacks.

How do you use the tactics to defend your AI system?

1. Pick your most important AI feature. A support bot, an agent with tools, a RAG assistant.
2. Walk the chain. For each tactic, write one sentence: how would an attacker do this here?
3. Mark what you can already stop or detect. The unmarked ones are your gaps.
4. Close the cheap gaps first. Least privilege, approval for risky actions, and logging cover several tactics at once.
5. Test it. A checklist tells you where to look. Testing tells you whether the controls work. See agentic AI red teaming.

The ATLAS Navigator lets you map your coverage visually.

Which stages does HexTyx test?

HexTyx's scanner runs attack modules that line up with several of these tactics. As a rough guide:

This is a mapping for orientation, not a claim of full ATLAS coverage. Several tactics, such as Reconnaissance and Resource Development, happen largely outside your system and can't be tested by scanning it. You can try the scanner in the free playground.

Frequently Asked Questions

Sources

• MITRE ATLAS
• MITRE ATLAS data file, release 2026.07 (YAML)
• Speakeasy, MITRE ATLAS overview (v2026.09)

Related Guides