MITRE ATLAS isn't a security framework. It's a catalog of how people break AI systems, and if you already know ATT&CK, only two of its 16 tactics are new to you.
So why does the matrix start at AML.TA0002?
Why the numbers look scrambled
The two tactics ATT&CK doesn't have got the first two IDs. AI Model Access is AML.TA0000 and AI Attack Staging is AML.TA0001.
The ATT&CK names came next. Reconnaissance through Impact took TA0002 to TA0011. Then Privilege Escalation (TA0012) and Credential Access (TA0013) were added and took the next free numbers, with Command and Control (TA0014) and Lateral Movement (TA0015) after those. The IDs record when a tactic joined. They say nothing about where it sits in an attack.
Both AI tactics used to say ML instead of AI. Same tactics, new label, and I don't care which one you type into the ticket as long as the ID is right. (AML here means adversarial machine learning, not anti-money laundering. Your BSA officer will get confused by that exactly once.)
The whole thing traces back to the Adversarial ML Threat Matrix that MITRE and Microsoft published in October 2020.
What order an attack actually runs in
Here's the matrix re-sorted the way a real attack against a model unfolds, with one technique per tactic. Each name links to the site's page for it.
- Reconnaissance, AML.TA0002. Find out which model you run and what's been published about breaking it. Example: AML.T0001, Search Open AI Vulnerability Analysis.
- Resource Development, AML.TA0003. Build the kit before touching you. Example: AML.T0020, Training Data Poisoning, which lives here and not under Impact.
- Initial Access, AML.TA0004. Get a foothold. Example: AML.T0010, AI Supply Chain Compromise.
- AI Model Access, AML.TA0000. Get a way to send the model inputs and read its outputs. Example: AML.T0040, AI Model Inference API Access.
- Execution, AML.TA0005. Run something. Example: AML.T0051, LLM Prompt Injection.
- Persistence, AML.TA0006. Stay in after a restart or a new session. Example: AML.T0070, RAG Poisoning.
- Privilege Escalation, AML.TA0012. Get the model to do what its guardrails say it can't. Example: AML.T0054, LLM Jailbreak.
- Defense Evasion, AML.TA0007. Slip past the classifier that's supposed to catch you. Example: AML.T0015, Evade AI Model.
- Credential Access, AML.TA0013. Steal the keys. Example: AML.T0083, Credentials from AI Agent Configuration.
- Discovery, AML.TA0008. Map what the model and its tools can reach. Example: AML.T0069, Discover LLM System Information.
- Lateral Movement, AML.TA0015. Move from the AI system into the rest of the estate. Example: AML.T0091, Use Alternate Authentication Material.
- Collection, AML.TA0009. Gather the valuable stuff. Example: AML.T0035, AI Artifact Collection.
- AI Attack Staging, AML.TA0001. Build and test the attack offline before firing it at the real target. Example: AML.T0005, Create Proxy AI Model.
- Command and Control, AML.TA0014. Keep a line back to the attacker. Example: AML.T0072, Reverse Shell.
- Exfiltration, AML.TA0010. Get it out. Example: AML.T0024, Exfiltration via AI Inference API.
- Impact, AML.TA0011. Do the damage, or run up the bill. Example: AML.T0034, Cost Harvesting.
The two tactics ATT&CK people skip
Start with model access, the attacker's channel to the model. Usually that's the inference API (AML.T0040). Sometimes it's the weights themselves (AML.T0044, Full AI Model Access), and for a camera or sensor model it can be standing in front of it (AML.T0041).
AI Attack Staging is the attacker's lab.
They query your model enough times to train a lookalike (AML.T0005). Then they craft adversarial inputs against the lookalike on their own hardware, where you can't see them (AML.T0043, Craft Adversarial Data), and fire a handful of tests at your production model to confirm it works (AML.T0042, Verify Attack). All you'll ever hold is a burst of API calls that looked like ordinary traffic. That's why I ask for inference API logs before I ask for anything else on an AI review.
What I keep seeing is AI threat models that skip both of these and spend four pages on prompt injection. Prompt injection matters, and I'd never drop it. It's also the one technique everybody already knows to look for.
Where ATLAS stops being useful
ATLAS is a threat catalog. It isn't a control set, and I'll argue with anyone who puts it in an audit scope. It does publish mitigations under AML.M codes, but there's no assessment procedure and nothing an auditor can mark met or not met.
For the application layer, use the OWASP Top 10 for LLM Applications, where LLM01 is prompt injection. For governance, use NIST AI RMF 1.0 from January 2023, starting with GOVERN 1. Both sit next to ATLAS on the AI frameworks page.
Here's what I don't know. The site's copy of ATLAS carries 101 techniques as of October 2026, and most of the newest IDs, AML.T0099 through AML.T0115, are about agents and their tools. I'd expect some of those to get merged or renamed before that corner of the matrix settles down.
Using it on one real feature
If you're the one shipping a customer-facing RAG chatbot before the November change freeze, don't map it to all 16 tactics. Pick five techniques that fit that one feature. For a RAG bot I'd start with these.
- AML.T0051, LLM Prompt Injection.
- AML.T0070, RAG Poisoning, because anyone who can edit a page in the index can edit your answers.
- AML.T0056, Extract LLM System Prompt.
- AML.T0057, LLM Data Leakage.
- AML.T0034, Cost Harvesting.
Then run those five through the AI threat model tool and get each one tied to a framework reference and an owner.
Five rows you'll defend in a review beat 101 rows nobody reads.