AI incident log, by technique
Which AI attack technique did each incident use?
The technique tag on each incident is this site’s own classification, applying ATLAS’s published taxonomy (version 5.6.0) to facts already reported on that incident’s own page; it adds no new factual claim about the incident itself. An incident with no technique listed below is one this site judged does not clearly demonstrate an adversary technique from the taxonomy — for example, a software bug, an unexploited misconfiguration a researcher disclosed, or an AI system’s own unintended behavior with no external adversary described in the sourced reporting, rather than a gap in tagging.
Technique names, ids and descriptions below are MITRE ATLAS’s own, fetched directly from its public data repository. A technique listed with no incident under it is part of the taxonomy but not yet demonstrated by anything in this log.
Reconnaissance
AML.TA0002The adversary is trying to gather information about the AI system they can use to plan future operations.
- Active Scanning: Active ScanningAML.T0006
An adversary may probe or scan the victim system to gather information for targeting. This is distinct from other reconnaissance techniques that do not involve direct interaction with the victim system.
Initial Access
AML.TA0004The adversary is trying to gain access to the AI system.
- AI Supply Chain Compromise: AI SoftwareAML.T0010.001
Adversaries may target software packages that are commonly used in AI-enabled systems or are part of the AI DevOps lifecycle. This can include deep learning frameworks used to build AI models (e.g. PyTorch, TensorFlow, Jax), generative AI integration frameworks (e.g. LangChain, LangFlow), inference engines, and AI DevOps tools. They may also target the dependency chains of any of these software packages [\[1\]][1]. Additionally, adversaries may target specific components used by AI software such as configuration files [\[2\]][2] or example usage of AI packages, which may be distributed in Jupyter notebooks [\[3\]][3].
- AI Supply Chain Compromise: ModelAML.T0010.003
AI-enabled systems often rely on open sourced models in various ways.
- Exploit Public-Facing Application: Exploit Public-Facing ApplicationAML.T0049
Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other applications with Internet accessible open sockets, such as web servers and related services.
- Phishing: Deepfake-Assisted PhishingAML.T0052.001
Adversaries may use deepfakes (AI-generated synthetic images, audio, or video) in phishing campaigns to impersonate trusted individuals, executives, or organizations. These attacks exploit human trust by presenting fraudulent voice or video communications as legitimate, enabling adversaries to manipulate targets into disclosing credentials, transferring funds, or granting access to systems.
Execution
AML.TA0005The adversary is trying to run malicious code embedded in AI artifacts or software.
- User Execution: Unsafe AI ArtifactsAML.T0011.000
Adversaries may develop unsafe AI artifacts that when executed have a deleterious effect.
- Command and Scripting Interpreter: Command and Scripting InterpreterAML.T0050
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
- LLM Prompt Injection: LLM Prompt InjectionAML.T0051
An adversary may craft malicious prompts as inputs to an LLM that cause the LLM to act in unintended ways.
- LLM Prompt Injection: DirectAML.T0051.000
An adversary may inject prompts directly as a user of the LLM. This type of injection may be used by the adversary to gain a foothold in the system or to misuse the LLM itself, as for example to generate harmful content.
- LLM Prompt Injection: IndirectAML.T0051.001
An adversary may inject prompts indirectly via separate data channel ingested by the LLM such as include text or multimedia pulled from databases or websites.
- AI Agent Tool Invocation: AI Agent Tool InvocationAML.T0053
Adversaries may use their access to an AI agent to invoke tools the agent has access to. LLMs are often connected to other services or resources via tools to increase their capabilities. Tools may include integrations with other applications, access to public or private data sources, and the ability to execute code.
- Hackers breach South Korean banks with Chinese AI tool Artex, expose 68,000 people
- OpenAI agents probed SEC, Census Bureau and Education Department sites
- AEPD discloses first breach notification tied to an autonomous AI agent
- OpenAI research agent gained unauthorised access to Services Australia Medicare statistics portal
- Anthropic reports AI-orchestrated cyber espionage campaign run through Claude Code
- Nx s1ngularity attack: malicious npm packages turned local AI tools toward secret hunting
- User Execution: Malicious PackageAML.T0011.001
Adversaries may develop malicious software packages that when imported by a user have a deleterious effect.
Privilege Escalation
AML.TA0012The adversary is trying to gain higher-level permissions.
- AI Agent Tool Invocation: AI Agent Tool InvocationAML.T0053
Adversaries may use their access to an AI agent to invoke tools the agent has access to. LLMs are often connected to other services or resources via tools to increase their capabilities. Tools may include integrations with other applications, access to public or private data sources, and the ability to execute code.
- Hackers breach South Korean banks with Chinese AI tool Artex, expose 68,000 people
- OpenAI agents probed SEC, Census Bureau and Education Department sites
- AEPD discloses first breach notification tied to an autonomous AI agent
- OpenAI research agent gained unauthorised access to Services Australia Medicare statistics portal
- Anthropic reports AI-orchestrated cyber espionage campaign run through Claude Code
- Nx s1ngularity attack: malicious npm packages turned local AI tools toward secret hunting
Defense Evasion
AML.TA0007The adversary is trying to avoid being detected by AI-enabled security software.
- Virtualization/Sandbox Evasion: Virtualization/Sandbox EvasionAML.T0097
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads.
Credential Access
AML.TA0013The adversary is trying to steal account names and passwords.
- Unsecured Credentials: Unsecured CredentialsAML.T0055
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Lateral Movement
AML.TA0015The adversary is trying to move through your AI environment.
- Phishing: Deepfake-Assisted PhishingAML.T0052.001
Adversaries may use deepfakes (AI-generated synthetic images, audio, or video) in phishing campaigns to impersonate trusted individuals, executives, or organizations. These attacks exploit human trust by presenting fraudulent voice or video communications as legitimate, enabling adversaries to manipulate targets into disclosing credentials, transferring funds, or granting access to systems.
AI Attack Staging
AML.TA0001The adversary is leveraging their knowledge of and access to the target system to tailor the attack.
- Generate Deepfakes: Generate DeepfakesAML.T0088
Adversaries may use generative artificial intelligence (GenAI) to create synthetic media (i.e. imagery, video, audio, and text) that appear authentic. These "[deepfakes]( https://en.wikipedia.org/wiki/Deepfake)" may mimic a real person or depict fictional personas. Adversaries may use deepfakes for impersonation to conduct [Phishing](/techniques/AML.T0052) or to evade AI applications such as biometric identity verification systems (see [Evade AI Model](/techniques/AML.T0015)).
Exfiltration
AML.TA0010The adversary is trying to steal AI artifacts or other information about the AI system.
- LLM Data Leakage: LLM Data LeakageAML.T0057
Adversaries may craft prompts that induce the LLM to leak sensitive information.