AML.T0096

MITRE ATLAS / AI Service API

Adversaries communicate with compromised systems through the API of an AI service already present in the environment, blending command and control traffic into legitimate model calls.

Think of it likePassing messages through the office mailroom, since parcels move through it all day anyway.

In plain English

Traffic to a known model provider is expected and usually allowed. Hiding instructions inside those calls means the command channel looks exactly like the AI work everyone else is doing.