AI/ML Infrastructures, Large Language Models, MLOps Pipelines, and Autonomous Agent Runtimes HASS rates the unmitigated AI attack surface cataloged in ATLAS at 88/100 (CRITICAL). Unlike classical software exploits that target deterministic memory corruptions or logic bugs, adversarial AI attacks exploit the probabilistic nature of neural representations, data pipelines, and unconstrained semantic tool delegation.
For over a decade, cybersecurity operations centered around the MITRE ATT&CK® framework. ATT&CK revolutionized defensive security by cataloging real-world adversary behavior against operating systems, networks, identity providers, and hypervisors.
However, the rapid deployment of Machine Learning (ML), Large Language Models (LLMs), and autonomous multi-agent swarms introduced an entirely new class of vulnerabilities that ATT&CK was never designed to address:
if/then). Neural networks compute continuous probability distributions over tokens or high-dimensional latent vectors. An attacker manipulates these distributions through semantic perturbations rather than raw binary payloads.To address this systemic blind spot, the MITRE Corporation, in collaboration with industry leaders and academic researchers, created MITRE ATLAS™ (Adversarial Threat Landscape for Artificial-Intelligence Systems). Modeled on the familiar matrix structure of ATT&CK, ATLAS provides a standardized, empirical taxonomy of adversary tactics, techniques, and case studies targeting AI systems across their entire lifecycle.
While MITRE ATT&CK and MITRE ATLAS share the same foundational philosophy—organizing adversarial behavior into tactical objectives (“why”) and specific techniques (“how”)—their operational domains diverge fundamentally:
| Architectural Dimension | MITRE ATT&CK® (Enterprise) | MITRE ATLAS™ (AI/ML) |
|---|---|---|
| Target Substrate | Operating systems, network stacks, cloud IAM, containers, firmware | Training corpora, model weights, embeddings, vector stores, prompt contexts |
| Execution Mechanism | Deterministic binary instructions (syscalls, shell execution, DLL injection) | Probabilistic token generation, attention weight steering, gradient descent optimization |
| Exploitation Vector | Software defects, logic flaws, memory corruptions (buffer overflows, RCE) | Semantic prompt injection, data poisoning, adversarial examples, model extraction |
| Persistence Medium | Registry Run keys, scheduled tasks, cron jobs, startup services, WMI event subscriptions | Poisoned vector database chunks, backdoor triggers in weights, contaminated fine-tuning sets |
| Identification Prefix | T#### (e.g., T1059 Command and Scripting Interpreter) | AML.T#### (e.g., AML.T0051 LLM Prompt Injection) |
The ATLAS matrix organizes adversarial actions across 14 tactical stages representing the end-to-end lifecycle of an attack against artificial intelligence:
┌────────────────────────────────────────────────────────────────────────────────────────────────────────┐│ The MITRE ATLAS Matrix Lifecycle │└───────────────────────────────────────────────────┬────────────────────────────────────────────────────┘ │ ┌──────────────────────┐ ┌──────────────────────┐ ┌──────────────────────┐ ┌──────────────────────┐ │ 1. Reconnaissance │──>│ 2. Resource Develop. │──>│ 3. Initial Access │──>│ 4. ML Attack Staging │ │ (AML.TA0002) │ │ (AML.TA0003) │ │ (AML.TA0004) │ │ (AML.TA0005) │ └──────────────────────┘ └──────────────────────┘ └──────────────────────┘ └──────────────────────┘ │ ┌──────────────────────┐ ┌──────────────────────┐ ┌──────────────────────┐ ▼ │ 8. Defense Evasion │<──│ 7. Privilege Escal. │<──│ 6. Persistence │<──┌──────────────────────┐ │ (AML.TA0009) │ │ (AML.TA0008) │ │ (AML.TA0007) │ │ 5. Execution │ └──────────┬───────────┘ └──────────────────────┘ └──────────────────────┘ │ (AML.TA0006) │ │ └──────────────────────┘ ▼ ┌──────────────────────┐ ┌──────────────────────┐ ┌──────────────────────┐ ┌──────────────────────┐ │ 9. Credential Access │──>│ 10. Discovery │──>│ 11. Lateral Movement │──>│ 12. Collection │ │ (AML.TA0010) │ │ (AML.TA0011) │ │ (AML.TA0012) │ │ (AML.TA0013) │ └──────────────────────┘ └──────────────────────┘ └──────────────────────┘ └──────────┬───────────┘ │ ┌──────────────────────┐ ┌──────────▼───────────┐ │ 14. Impact │<──│ 13. Exfiltration │ │ (AML.TA0015) │ │ (AML.TA0014) │ └──────────────────────┘ └──────────────────────┘AML.TA0002): Gathering intelligence on target AI architecture, model families (GPT, Claude, Llama), training data sources, API rate limits, and guardrail layers.AML.TA0003): Acquiring surrogate models for offline gradient optimization, purchasing adversarial datasets, or renting GPU clusters to train trigger tokens.AML.TA0004): Gaining an initial foothold via public chat interfaces, email assistants, multimodal image upload portals, or insecure API gateways.AML.TA0005): Crafting adversarial inputs, tailoring trigger phrases, optimizing embedding collisions, or assembling multi-step prompt injection chains.AML.TA0006): Triggering unauthorized actions via the AI system, including malicious code interpretation, unsafe model deserialization (PyTorch/Pickle RCE), or agent tool calls.AML.TA0007): Embedding dormant triggers within long-term vector databases (as proven in AgentPoison / arXiv:2407.12784), fine-tuning checkpoints, or conversation history caches.AML.TA0008): Escaping sandboxed user conversation roles to attain system-level agent execution or accessing privileged backend API keys.AML.TA0009): Bypassing input content filters, safety alignment (RLHF), prompt firewalls, and perplexity detectors through character substitution, base64 encoding, or linguistic obfuscation.AML.TA0010): Forcing the model to reveal hardcoded system API keys, database connection strings, or cloud tokens embedded in prompts or retrieved context.AML.TA0011): Probing the model’s system prompt instructions, uncovering connected plugins, enumerating accessible MCP tools, or mapping downstream agent peers.AML.TA0012): Pivoting from an untrusted public-facing agent to a privileged internal agent within multi-agent orchestration frameworks (LangGraph, AutoGen, CrewAI).AML.TA0013): Gathering proprietary business logic, sensitive PII from conversational histories, or private enterprise documents retrieved via RAG.AML.TA0014): Stealing proprietary model weights, extracting synthetic training sets, or performing model inversion attacks to reconstruct private training samples.AML.TA0015): Corrupting model output integrity, causing algorithmic denial-of-service (Resource Exhaustion / Sponge Attacks), degrading decision accuracy, or triggering physical kinetic harm.ATLAS indexes over 60 granular techniques identified by AML.T####. In the era of Generative AI and autonomous agent swarms, several techniques represent the primary vectors of active enterprise compromise:
AML.T0051: LLM Prompt Injection
Adversaries manipulate LLM behavior through crafted text inputs. Subdivided into Direct Prompt Injection (user prompt overrides system prompt) and Indirect Prompt Injection (AML.T0051.001) where malicious instructions are ingested from external third-party data (webpages, emails, PDFs). Mapped in Hermes: AAP-001 & AAP-002.
AML.T0054: LLM Jailbreak
Bypassing model safety filters, alignment guardrails, and system policies through adversarial framing, hypothetical roleplay, or token-level optimization (AttnGCG) to elicit forbidden instructions. Mapped in Hermes: Alignment Layer & RLHF Jailbreaks.
AML.T0043: Data Poisoning
Contaminating data ingested during pre-training, fine-tuning, or dynamic RAG retrieval to introduce deterministic biases, degrade performance, or implant dormant trigger backdoors. Mapped in Hermes: AAP-005 & AgentPoison Study.
AML.T0053: LLM Plugin/Tool Compromise
Adversaries force the LLM to dispatch unauthorized external tool invocations or manipulate structured arguments passed to operating system commands, SQL databases, or MCP endpoints. Mapped in Hermes: AAP-003: Tool Parameter Tampering.
Both CrowdStrike and Vectra AI emphasize that threat intelligence frameworks are useless unless operationalized into actionable detection engineering and Security Operations Center (SOC) triage playbooks.
In their security analysis, CrowdStrike underlines that attacks on AI systems do not occur in a vacuum. Adversaries rarely attack an AI model in isolation; instead, they execute hybrid attack chains bridging traditional enterprise IT and AI:
AML.T0043 (Data Poisoning) or AML.T0024 (Model Exfiltration) to manipulate models or steal intellectual property.Vectra AI focuses on the runtime reality of modern AI deployments, emphasizing that static prompt inspection fails against advanced cognitive threats:
AML.M####)ATLAS matches every adversarial technique with proven architectural and defensive mitigations:
AML.M1001): Implement input validation, perplexity filters, and semantic classifiers to detect known jailbreak patterns and adversarial prompt perturbations before they reach the model core.AML.M1004): Enforce strict authentication, mutual TLS, and rate-limiting on all internal and external inference APIs to mitigate model extraction and brute-force prompt probing.AML.M1012): Cryptographically sign and hash all ingested RAG documents, fine-tuning datasets, and external embeddings. Apply dual-retriever consensus (Dense + BM25) to neutralize embedding collision attacks.AML.M1016): Restrict agent tool capabilities using lightweight container sandboxes (Wasm, gVisor) with immutable read-only filesystems and strict JSON parameter schemas.AML.M1015): Pass all model outputs and planned tool calls through independent verification agents or deterministic boundary firewalls before executing state-changing operations.Modern SOCs must translate ATLAS techniques into concrete telemetry queries and alert signatures.
"""Hermes ATLAS Telemetry NormalizerMaps runtime AI application events to MITRE ATLAS Tactics and Techniquesfor automated SIEM/XDR ingestion."""
from typing import Dict, Any, Optionalfrom datetime import datetime, timezone
ATLAS_MAPPING = { "prompt_override_attempt": { "tactic": "AML.TA0004", "technique": "AML.T0051", "technique_name": "LLM Prompt Injection", "severity": "HIGH" }, "jailbreak_pattern_detected": { "tactic": "AML.TA0009", "technique": "AML.T0054", "technique_name": "LLM Jailbreak", "severity": "CRITICAL" }, "vector_store_drift_anomaly": { "tactic": "AML.TA0007", "technique": "AML.T0043", "technique_name": "Data Poisoning", "severity": "CRITICAL" }, "unauthorized_tool_invocation": { "tactic": "AML.TA0006", "technique": "AML.T0053", "technique_name": "LLM Plugin Compromise", "severity": "EXTREME" }}
def generate_atlas_alert(event_type: str, raw_payload: Dict[str, Any]) -> Optional[Dict[str, Any]]: if event_type not in ATLAS_MAPPING: return None
meta = ATLAS_MAPPING[event_type] return { "timestamp": datetime.now(timezone.utc).isoformat(), "framework": "MITRE_ATLAS", "tactic_id": meta["tactic"], "technique_id": meta["technique"], "technique_name": meta["technique_name"], "severity": meta["severity"], "model_id": raw_payload.get("model_id", "unknown"), "session_id": raw_payload.get("session_id", "anonymous"), "telemetry_detail": raw_payload.get("details", {}) }// Hunting for AML.T0051 (Prompt Injection) and AML.T0053 (Plugin Compromise) in Azure OpenAI logslet timeframe = 1d;AzureDiagnostics| where TimeGenerated >= ago(timeframe)| where ResourceProvider == "MICROSOFT.COGNITIVESERVICES"| where OperationName == "ChatCompletions_Create"| extend PromptTokens = toint(properties_s.usage.prompt_tokens)| extend TotalTokens = toint(properties_s.usage.total_tokens)| extend Model = tostring(properties_s.model)| extend ClientIP = tostring(properties_s.client_ip)| where PromptTokens > 3500 or TotalTokens > 7000| summarize InferenceCount = count(), AvgTokens = avg(TotalTokens), DistinctSessions = dcount(tostring(properties_s.user)) by ClientIP, Model, bin(TimeGenerated, 1h)| where InferenceCount > 50| extend ATLAS_Tactic = "AML.TA0006", ATLAS_Technique = "AML.T0051"| project TimeGenerated, ClientIP, Model, InferenceCount, AvgTokens, ATLAS_Tactic, ATLAS_Technique| order by InferenceCount desctitle: AI Agent Unexpected System Command Execution (ATLAS AML.T0053)id: 9a72e11b-4f90-4e31-8201-90c74b105a02status: experimentaldescription: Detects an LLM agent invoking dangerous system utilities following external context retrieval.author: Hermes Codex Threat Inteldate: 2026-09-09references: - https://atlas.mitre.org/techniques/AML.T0053 - https://hermes-codex.org/threat-intel/mitre-atlas-adversarial-ai-threat-matrix/logsource: category: application product: ai_agent_runtimedetection: selection_tool: action: 'tool_call' tool_type: 'system_execution' command|contains: - 'bash' - 'sh' - 'powershell.exe' - 'cmd.exe' - 'curl' - 'wget' filter_authorized_devops: user_role: 'system_devops_agent' condition: selection_tool and not filter_authorized_devopslevel: hightags: - atlas.execution - atlas.aml.t0053 - attack.execution - attack.t1059rule atlas_aml_t0043_rag_poisoning_clustering { meta: description = "Detects rapid injection of semantically anomalous chunks into enterprise vector stores (ATLAS AML.T0043)" author = "Hermes Codex CTI" reference = "https://atlas.mitre.org/techniques/AML.T0043" severity = "CRITICAL"
events: $doc.metadata.event_type = "VECTOR_DATABASE_INGESTION" $doc.ai.collection_name = $collection $doc.ai.cosine_anomaly_score >= 0.92 $doc.principal.user.userid = $user
match: $collection over 15m
condition: #doc >= 5 and count_distinct($user) == 1}Applying Hermes Codex empirical evaluation standards to the MITRE ATLAS matrix:
┌──────────────────────────────────────────────────────────────────────────────────────────┐│ HERMES CAPABILITY SEPARATION (MITRE ATLAS) │├──────────────────────────────────────────────────────────────────────────────────────────┤│ [1] DEMONSTRATED CAPABILITY (Proven in Production & Empirically Documented) ││ ✔ Bypass safety alignment via automated jailbreaks (AML.T0054 / AttnGCG). ││ ✔ Execute Indirect Prompt Injection via web/PDF ingestion (AML.T0051.001 / AAP-002). ││ ✔ Poison vector database memory with <0.1% injection rate (AML.T0043 / AgentPoison). ││ ✔ Force unauthorized tool invocations through parameter tampering (AML.T0053 / AAP-003)│├──────────────────────────────────────────────────────────────────────────────────────────┤│ [2] REASONED INFERENCE (High Probability Near-Term Enterprise Threats) ││ ◐ Automated cross-agent lateral movement in multi-agent swarms (AML.TA0012 / AAP-006). ││ ◐ Covert credential exfiltration via conversational steganography (AML.TA0010). ││ ◐ Exploitation of shared MCP router proxies for infrastructure takeover. │├──────────────────────────────────────────────────────────────────────────────────────────┤│ [3] HYPOTHETICAL SPECULATION (Unproven Assumptions & Disproven Marketing Claims) ││ ✖ Complete black-box extraction of 100B+ frontier model weights through public APIs. ││ ✖ Autonomous self-replicating AI worms that spread across disconnected air-gapped nets.││ ✖ Perfect prompt firewalls capable of eliminating 100% of semantic injections. │└──────────────────────────────────────────────────────────────────────────────────────────┘