MITRE ATLAS for AI agents: a defender's guide

MITRE ATLAS is a free, public knowledge base of how adversaries actually attack AI systems, including agents and the tools they call. It names each attack technique with an ID like AML.T0051 for LLM Prompt Injection, groups techniques under tactics such as Initial Access and Exfiltration, and lists mitigations like AML.M0029 for Human In-the-Loop for AI Agent Actions. A security team uses it the way an infrastructure team uses MITRE ATT&CK: as a shared vocabulary for threat models, detections and the gaps between them.

What ATLAS is

ATLAS stands for Adversarial Threat Landscape for AI Systems. MITRE started it in October 2020 as the Adversarial ML Threat Matrix with Microsoft and other organizations, then renamed and relaunched it as ATLAS in 2021. It is structurally modeled on MITRE ATT&CK, the better known matrix for attacks against ordinary IT systems, but it is a separate knowledge base with its own ID namespace (AML.*) and its own data.

The underlying data is open source, published as versioned YAML in github.com/mitre-atlas/atlas-data under the Apache 2.0 license. The version checked for this article, 2026.09, has 16 tactics, 208 technique and sub-technique entries, and 40 mitigations. ATLAS also tags each technique with the platform it applies to: Predictive AI, Generative AI, Agentic AI or Enterprise. That tag is the fastest way to find what matters for an agent that calls MCP tools, since most of the content predates agents and covers classic machine learning attacks like model evasion and data poisoning that a tool-calling team will not run into.

Tactics, techniques and mitigations

ATLAS has three kinds of entries, and they connect to each other:

A tactic is the adversary's goal, like Initial Access or Exfiltration. ATLAS has 16: the 14 it shares with ATT&CK Enterprise (Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact) plus two it adds for AI specifically, AI Model Access and AI Attack Adaptation.

A technique is a specific way to pursue a tactic, with an ID like AML.T0051. Some techniques have sub-techniques, like AML.T0051.000 Direct and AML.T0051.001 Indirect under LLM Prompt Injection. Techniques carry a maturity tag, Feasible, Demonstrated or Realized, which says whether anyone has actually pulled it off in the field or it is still a research finding.

A mitigation is a control that addresses one or more techniques, with an ID like AML.M0029. ATLAS's data ties each mitigation to the techniques it covers, so you can start from a technique in your threat model and read off which mitigations apply, or start from a control you already run and see what it covers.

Techniques that apply to a tool-using agent

Most of ATLAS covers classic machine learning: evading a classifier, stealing a model, poisoning training data. None of that applies to a team wiring an agent up to MCP tools. The techniques below are the ones tagged Agentic AI (or Generative AI and Agentic AI together) that describe what happens when an agent with tools gets attacked. Names and IDs are from the ATLAS data, version 2026.09.

• AML.T0051 LLM Prompt Injection. Text crafted to make the model act on the attacker's instructions instead of the user's, split into Direct and Indirect. The entry point behind most techniques below.
• AML.T0053 AI Agent Tool Invocation. The adversary gets the agent to call a tool on their behalf, usually by prompt injection. See tool poisoning and the lethal trifecta.
• AML.T0110 AI Agent Tool Poisoning. Malicious content placed in a tool's own definition, implementation or runtime response, split into Definition and Instructions, Implementation and Runtime Response. Behind MCP tool poisoning and malicious MCP servers.
• AML.T0080 AI Agent Context Poisoning. Injected content that corrupts what the agent remembers or carries forward, split into Memory and Thread.
• AML.T0084 Discover AI Agent Configuration, including the AML.T0084.001 Tool Definitions sub-technique. Enumerating what tools an agent has, usually the first step before targeting one.
• AML.T0086 Exfiltration via AI Agent Tool Invocation. The agent is made to call a tool that moves data to the attacker, the lethal trifecta playing out: private data, untrusted content and a way out.
• AML.T0101 Data Destruction via AI Agent Tool Invocation. The same pattern, but the tool deletes or overwrites data instead of leaking it. Excessive agency in practice.
• AML.T0098 AI Agent Tool Credential Harvesting. The agent calls a tool in a way that exposes a credential it holds. See keeping credentials out of agents and confused deputy.
• AML.T0081 Modify AI Agent Configuration and AML.T0083 Credentials from AI Agent Configuration. Tampering with an agent's settings or pulling credentials from its config, the scenario behind MCP rug pull attacks.

A worked example: a support agent has a ticketing tool and a knowledge base search tool. An attacker files a ticket whose body carries hidden instructions (AML.T0051.001, Indirect Prompt Injection). The agent reads the ticket, follows the hidden instructions, and calls the search tool with a query that encodes a customer's private data (AML.T0053 into AML.T0086). That's three IDs, and a team can write a detection and a mitigation for each step.

How a security team uses it

Threat modeling. Walk the tools an agent can call and, for each one, ask which ATLAS techniques apply if an attacker controls part of its input. A tool that reads untrusted text is a path to AML.T0051. A tool that can move data out is a path to AML.T0086 once injection succeeds. Written down as a short table, tool by tool, "the agent might get hijacked" becomes a specific list of calls to watch.

Detection. Mitigation AML.M0024, AI Telemetry Logging, is the baseline. A log of what a tool was called with and what it returned is what lets anyone notice AML.T0053 or AML.T0086 happened at all. Without that record, a successful injection and a normal tool call look identical after the fact.

Mapping mitigations. Each technique has a reverse index of the mitigations that address it. For the agent techniques above, the recurring ones are AI Agent Tools Permissions Configuration (AML.M0028), Human In-the-Loop for AI Agent Actions (AML.M0029), Restrict AI Agent Tool Invocation on Untrusted Data (AML.M0030), and Input and Output Validation for AI Agent Components (AML.M0033). A reviewer who knows ATLAS will ask which of these your setup has.

Mapping table: technique, mitigation, where to read more

The mitigation column is the technique's primary match from ATLAS's own data, not an exhaustive list. Several of these techniques share more than one mitigation, and AML.M0024 AI Telemetry Logging in particular applies across most of the row above it, since you need a record before you can tell any of these happened.

What this does not cover

ATLAS names attack techniques. It doesn't grade your setup or tell you how urgent a gap is. No gateway closes every technique in the table on its own, and prompt injection has no complete fix. ATLAS's own mitigations for AML.T0051 reduce the chance and limit the damage.

Defenses in general

The mitigations ATLAS lists for agent techniques map onto a small set of practical moves: give each agent its own identity instead of a borrowed credential, grant tools individually instead of by server, log every call and every refusal, keep secrets out of the agent's reach, and put a human or a policy check in front of anything destructive. None of this requires ATLAS specifically. ATLAS is useful because it gives each move a name and an ID that a reviewer already recognizes.

Statio and ATLAS

Statio is a gateway for MCP that sits between agents and the tools they call. It covers part of this mapping, not all of it. Per-tool permissions grant and deny tools individually, the shape of AML.M0028 AI Agent Tools Permissions Configuration. Agent identity gives each agent its own token and its own entry in every log instead of a borrowed one. Audit logs record every call and every refusal, what AML.M0024 AI Telemetry Logging asks for. Tool descriptions are scanned for prompt injection and hidden characters when a server is added, and call arguments and responses pass through scanning too, in the direction AML.M0033 points at. Statio does not provide the human-in-the-loop approval step (AML.M0029) or memory hardening (AML.M0031). Those sit with the agent framework or the application built on top. Statio holds no certification against ATLAS or any other framework. The security page describes the full set of checks, and the MCP security checklist is a faster way to see where your own setup stands.

Next

• OWASP Top 10 for LLM Applications mapped to MCP
• OWASP agentic AI threats and mitigations explained
• How to get AI agents through a security review (and SOC 2)
• MCP tool poisoning
• The lethal trifecta

Questions