Frameworks

MITRE ATLAS in 2026: What v2026.09 Covers for LLMs and AI Agents, With Technique IDs for Pentest Reports

MITRE ATLAS now ships a new content release every month, and most of what it adds covers AI agents. The September 2026 release counts 120 techniques and 88 sub-techniques across 16 tactics. Here is what changed, which IDs belong in an LLM or agent pentest report, and how to cite them so they still mean something next quarter.

By Austa · Published October 10, 2026 · Facts checked against vendor sources as of October 2026 · ~10 min read

MITRE ATLAS (Adversarial Threat Landscape for AI Systems) is the ATT&CK-style knowledge base for attacks on AI systems. In 2026 it moved to monthly releases, gained dozens of agent techniques, and renamed a tactic. Pentest reports and detection rules written against a 2025 snapshot now cite IDs that have moved, merged or gained sub-techniques. This page uses MITRE's own release notes and the v2026.09 data file as of October 2026.

ATLAS v2026.09 by the numbers

Between v2026.07 and v2026.09 the matrix grew by a net 19 techniques and 11 sub-techniques. By maturity, the v2026.09 data rates 101 entries Realized (seen in real attacks), 83 Demonstrated (shown by researchers or red teams) and 24 Feasible.

The versioning change you need to know about

On May 27, 2026, MITRE split ATLAS versioning in two. Knowledge base content now has monthly releases named YYYY.MM (sometimes with a .N suffix), and the data format follows semantic versioning starting at v6.0.0. Before that, content and format changes shared one SemVer number, and v5.6.0 (May 4, 2026) was the last of those. The legacy dist/ATLAS.yaml file now starts with a comment saying it's deprecated and no longer updated. Tools that still read it are stuck at v5.6.0, with 16 tactics and none of the agent techniques added since.

The v2026.05 release also tagged every technique with one or more platforms: Predictive AI, Generative AI, Agentic AI or Enterprise. That makes filtering easy. For an LLM application test, start with the Generative AI and Agentic AI tags and skip most of the Predictive AI evasion material.

The 16 tactics, in matrix order

Reconnaissance (AML.TA0002), Resource Development (AML.TA0003), AI Attack Adaptation (AML.TA0001), Initial Access (AML.TA0004), AI Model Access (AML.TA0000), Execution (AML.TA0005), Persistence (AML.TA0006), Privilege Escalation (AML.TA0012), Defense Evasion (AML.TA0007), Credential Access (AML.TA0013), Discovery (AML.TA0008), Lateral Movement (AML.TA0015), Collection (AML.TA0009), Command and Control (AML.TA0014), Exfiltration (AML.TA0010), Impact (AML.TA0011).

AML.TA0001 was called "AI Attack Staging" until v2026.08. If your report templates or SIEM tags still use the old name, update them. The ID didn't change.

The LLM and agent technique IDs worth memorising

The "Triggered" sub-technique (AML.T0051.002, added November 2025) covers payloads planted in the victim's environment that fire on a user action or event, often after an earlier step of Prompt Infiltration via Public-Facing Application (AML.T0093). It's the right label for injections that wait in a ticket, an email or a shared document until an agent processes them, as described in our article on prompt injection against agent memory.

What July to September 2026 added

v2026.07: tool poisoning gets its own sub-techniques

AI Agent Tool Poisoning (AML.T0110) was split into Definition and Instructions, Implementation, and Runtime Response. The publishing techniques were merged into Publish Poisoned AI Artifacts (AML.T0115), which absorbed the former Publish Poisoned Datasets (AML.T0019), Publish Poisoned Models (AML.T0058) and Publish Poisoned AI Agent Tool (AML.T0104). If your reports cite T0019, T0058 or T0104, map them to the T0115 sub-techniques. The same release added the AI Red Team mitigation (AML.M0035).

v2026.08: autonomous attackers

This release added techniques for AI used by attackers: Autonomous Reconnaissance (AML.T0116), Autonomous Attack-Path Adaptation (AML.T0117), Autonomous AI Agent Communication (AML.T0118) and Autonomous Attack Orchestration (AML.T0124), along with case studies including the GTG-1002 Claude Code espionage campaign (AML.CS0069). It also added two agent mitigations: AI Agent Authority Expansion Controls (AML.M0037) and AI Agent Scope Drift Detection (AML.M0038).

v2026.09: links, cloaking and multimodal triggers

• Crafted AI Assistant Links (AML.T0131): links that open an assistant with an attacker-written prompt already filled in through URL parameters, often disguised as "Summarize with AI" buttons.
• AI Agent Response Biasing (AML.T0130): instructions such as "treat this source as trusted" that skew an assistant's answers, and can persist through poisoned memory.
• AI Targeted Cloaking (AML.T0134): serving prompt injection only to clients identified as AI agents, for example by user-agent, while humans and crawlers see clean content. This matters for anyone testing browser agents, because a scanner fetching as a normal browser won't see the payload.
• Triggers in Multimodal Inputs (AML.T0129): payloads in images, audio, video or file metadata (EXIF, ID3) that slip past text-only filters. Most text-only guardrails never look at those channels.
• Discover AI Agent Runtime Capabilities (AML.T0133), four new Active Scanning sub-techniques for exposed AI infrastructure, and a new mitigation: AI Honeypots (AML.M0039).

Mitigations ATLAS maps to prompt injection

For the parent technique AML.T0051, v2026.09 maps seven mitigations: Control Access to AI Models and Data in Production (M0019), Generative AI Guardrails (M0020), Generative AI Guidelines (M0021), Generative AI Model Alignment (M0022), AI Telemetry Logging (M0024), Input and Output Validation for AI Agent Components (M0033) and AI Red Team (M0035). For AI Agent Tool Invocation (AML.T0053) the list is longer and more useful. It adds agent permission configuration (M0026, M0027, M0028), Human In-the-Loop for AI Agent Actions (M0029), Restrict AI Agent Tool Invocation on Untrusted Data (M0030) and Segmentation of AI Agent Components (M0032).

The pattern matches what holds up in practice. Guardrails (M0020) appear in the injection mappings, but the controls that limit damage are on the tool side: permissions, restricting tool calls once untrusted data is in context, and human approval. Managed guardrails such as Bedrock Guardrails fall under M0020, and they come with documented blind spots.

Using ATLAS IDs in an LLM pentest

1. Pin the version. Write "ATLAS v2026.09" in the report header. With monthly releases, an unversioned ID is ambiguous within a quarter.
2. Tag findings with the sub-technique, not the parent. "AML.T0051.001 via a tool result" tells the reader where the payload entered. "AML.T0051" doesn't.
3. Chain the techniques. A typical agent finding is T0093 (planting) then T0051.002 (trigger) then T0053 (tool invocation) then T0086 (exfiltration). Report it as a chain, the way the ATLAS case studies are written.
4. Map each finding to a mitigation that would have stopped it. Use the M-IDs. Most fixes for agent findings land on M0026 to M0030, not M0020.
5. Cross-reference other frameworks where your client needs it. ATLAS tracks attacker behaviour. The OWASP Top 10 for agents ranks risks, and the NIST agent controls describe what to implement. One finding often needs an ID from all three.

FAQ

What is the latest version of MITRE ATLAS?

As of October 2026 the latest ATLAS content release is v2026.09, published on September 15, 2026. It contains 1 matrix, 16 tactics, 120 techniques, 88 sub-techniques, 40 mitigations and 73 case studies.

What is the MITRE ATLAS technique ID for prompt injection?

LLM Prompt Injection is AML.T0051 under the Execution tactic. Its sub-techniques are AML.T0051.000 Direct, AML.T0051.001 Indirect and AML.T0051.002 Triggered. LLM Jailbreak is a separate technique, AML.T0054, under Privilege Escalation and Defense Evasion.

How many tactics are in the ATLAS matrix?

Sixteen: Reconnaissance, Resource Development, AI Attack Adaptation, Initial Access, AI Model Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. AI Attack Adaptation (AML.TA0001) was called AI Attack Staging until v2026.08.

How is ATLAS versioned now?

Since May 27, 2026, ATLAS knowledge base content is released monthly with YYYY.MM version numbers, and the data format uses separate semantic versioning starting at v6.0.0. The previous combined SemVer series ended with v5.6.0 on May 4, 2026, and the legacy ATLAS.yaml file is marked deprecated.

Which ATLAS techniques cover AI agent tool poisoning?

AI Agent Tool Poisoning is AML.T0110 under Persistence, split in v2026.07 into AML.T0110.000 Definition and Instructions, AML.T0110.001 Implementation and AML.T0110.002 Runtime Response. Related techniques include AI Agent Tool Invocation (AML.T0053) and Exfiltration via AI Agent Tool Invocation (AML.T0086).

What did ATLAS v2026.09 add?

It added Triggers in Multimodal Inputs (AML.T0129), AI Agent Response Biasing (AML.T0130), Crafted AI Assistant Links (AML.T0131), Misconfigured or Publicly Exposed AI Services (AML.T0132), Discover AI Agent Runtime Capabilities (AML.T0133), AI Targeted Cloaking (AML.T0134), four Active Scanning sub-techniques, a Scan Databases sub-technique under Search Open Technical Databases, the AI Honeypots mitigation (AML.M0039) and a case study on AI recommendation poisoning via crafted assistant links.

Related reading

• Azure Prompt Shields limits and pricing: an M0020 guardrail and the windows it scans.
• Google Model Armor pricing and limits: an M0020 guardrail that can sit in front of MCP servers.
• Llama Prompt Guard 2: 86M vs 22M: a self-hosted M0020 classifier.

The matrix, technique pages and case studies are published on the MITRE ATLAS site.