Standards
MITRE ATLAS techniques for AI agents
MITRE ATLAS is a public knowledge base of adversary tactics and techniques against AI systems. Several techniques describe attacks on tool-using agents, including AML.T0051 LLM Prompt Injection, AML.T0053 AI Agent Tool Invocation and AML.T0110 AI Agent Tool Poisoning. This page maps them to the tests in an Agent Action Pentest.
What is MITRE ATLAS?
MITRE ATLAS, the Adversarial Threat Landscape for AI Systems, catalogs tactics, techniques and case studies for attacks on AI. Its data is published in the mitre-atlas/atlas-data repository. Every ID and name on this page was checked against release 2026.09 of that data on the review date. ATLAS releases content monthly, so IDs can be added; we re-check when we review the page.
ATLAS is useful for agent work because recent releases include techniques written specifically about agents and their tools, not only about models. Several of them describe exactly the chain we test: get instructions in, invoke a tool, move or destroy data.
Which ATLAS techniques apply to AI agents?
| ID | Name | What an Agent Action Pentest exercises | Scope |
|---|---|---|---|
| AML.T0051 | LLM Prompt Injection | Injected instructions that change the task. Details | In scope |
| AML.T0051.001 | LLM Prompt Injection: Indirect | Payloads in emails, pages, files and tool results. Details | In scope |
| AML.T0053 | AI Agent Tool Invocation | Driving the agent to call tools it holds. Details | In scope |
| AML.T0086 | Exfiltration via AI Agent Tool Invocation | Data carried out in write-tool arguments. Details | In scope |
| AML.T0057 | LLM Data Leakage | Records exposed in output. Details | In scope |
| AML.T0056 | Extract LLM System Prompt | Recovering instructions and their contents. Details | In scope |
| AML.T0110 | AI Agent Tool Poisoning | Malicious tool definitions and responses. Details | In scope for tools the agent uses |
| AML.T0098 | AI Agent Tool Credential Harvesting | Getting tools to reveal the secrets they hold. Details | In scope |
| AML.T0101 | Data Destruction via AI Agent Tool Invocation | Deletes triggered through the agent. Details | In scope, in test environments |
| AML.T0054 | LLM Jailbreak | Bypassing model safety behavior. Details | Only where it leads to an action |
How is this mapping used in a report?
Each finding in an Agent Action Pentest report has a VulnZap class, a severity and reproduction steps. Where a finding matches an ATLAS technique, we tag it with the ID so your security team can line it up with existing threat models. This is a mapping for convenience. It is not an endorsement by MITRE and not a claim of coverage for the whole matrix.
Techniques about model training, model theft or inference API abuse at the model level sit outside a fixed-scope agent test and are not listed. Reconnaissance techniques appear only when we discover agent configuration while testing, which ATLAS lists as AML.T0084 Discover AI Agent Configuration.
How do the techniques chain in an agent?
A typical finding uses three or four techniques in a row. Content the agent reads carries an indirect injection (AML.T0051.001). The injected text drives a tool call the attacker could not make directly (AML.T0053). The call either carries data out in its arguments (AML.T0086) or performs a destructive change (AML.T0101). Mapping each step lets your team decide where to break the chain: at the content, at the tool, or at the permission behind it.
Agent Action Pentest: $2,500 fixed. Written report within 72 hours of access, or a full refund.
See the offer or email yaz@plaw.io
Questions
Why might the atlas.mitre.org links load slowly?
The ATLAS site renders in the browser. The IDs on this page were verified against the published atlas-data release, which is also linked.
Is this an official MITRE mapping?
No. It is our mapping of our tests to public ATLAS techniques.
Do you cover the full ATLAS matrix?
No. Only the techniques listed here, which describe attacks that end in agent actions.
Related pages
- 01Prompt injection in AI agentsInstructions in user input or ingested content override what the agent was told to do.
- 02Indirect prompt injection in AI agentsHidden instructions in emails, pages, files or tool results steer an agent that reads them.
- 05MCP tool poisoning and MCP server risksMalicious tool definitions or over-scoped MCP servers steer what the agent calls.
- OWASP Top 10 for LLM Applications 2026, mapped to agent testsAll ten 2026 entries mapped to what an agent pentest covers, with a 2025 to 2026 crosswalk.
- OWASP Agentic AI threats, mapped to agent testsThe OWASP agentic threat taxonomy, T1 to T17, mapped to what an agent pentest covers.
Sources
- MITRE ATLAS
- MITRE ATLAS data, release 2026.09 (mitre-atlas/atlas-data)
- MITRE ATLAS AML.T0051 LLM Prompt Injection
- MITRE ATLAS AML.T0051.001 LLM Prompt Injection: Indirect
- MITRE ATLAS AML.T0053 AI Agent Tool Invocation
- MITRE ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation
- MITRE ATLAS AML.T0110 AI Agent Tool Poisoning
- MITRE ATLAS AML.T0084 Discover AI Agent Configuration
Last reviewed: