Threat intelligence / filtered
platform “mitre-atlas”
11300 objects matching the active filter. Open an object to inspect its relationships and provenance.
Evidence stream
Filtered — platform “mitre-atlas”
01Claude Code GitHub Action Secret ExposureThe [Microsoft Defender Security Research Team](https://www.microsoft.com/en-us/security/blog/author/windows-defender-research/) demonstrated that Anthropic's [Claude Code GitHub Action](https://github.com/anthropics/claude-code-action) cou…CampaignAML.CS006702ZombieAgent: Data Exfiltration Attack on ChatGPTZombieAgent is a proof-of-concept indirect prompt injection attack demonstrated by Radware against OpenAI's ChatGPT Deep Research and Connector functionality. The attacks showed how instructions concealed in externally controlled content, s…CampaignAML.CS006603Model Namespace Reuse Supply Chain AttackUnit 42 researchers demonstrated an AI supply chain attack in which an attacker reclaims a deleted Hugging Face author namespace and publishes a malicious model under the same historical Author/ModelName identifier. Applications and model c…CampaignAML.CS006504Poisoned GGUF Templates: Inference-Time Supply Chain AttackResearchers from Pillar Security and Fujitsu Research of Europe demonstrated an inference-time supply-chain backdoor in which poisoned chat templates alter model and agent behavior without modifying model weights. The backdoor is embedded i…CampaignAML.CS006405Prompt-Based Attacks Against Gemini via Calendar InvitationsSafeBreach researchers demonstrated how adversary-controlled instructions embedded in productivity content, including Google Calendar invitations, emails, and shared files, could influence the behavior of Gemini-powered assistants when that…CampaignAML.CS006306RCE Vulnerability in Semantic Kernel Search PluginThe [Microsoft Defender Security Research Team](https://www.microsoft.com/en-us/security/blog/author/windows-defender-research/) discovered a vulnerable path in Microsoft Semantic Kernel, in which a single prompt injection could lead to hos…CampaignAML.CS006207AI in the Middle: Web-Based AI Services as C2 RelaysCheck Point Research demonstrated an "AI in the Middle" attack in which malware can abuse web-based AI assistants with anonymous or unauthenticated browsing and URL-fetch capabilities as a covert command-and-control channel. The proof of co…CampaignAML.CS006108Cross-Site Scripting via Prompt Manipulation in Lenovo AI ChatbotCybernews researchers demonstrated that Lenovo's AI chatbot "Lena" was vulnerable to a prompt injection that produced malicious HTML which was saved in the chat history and could exfiltrate a human support agent's session cookie when render…CampaignAML.CS006009EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data ExfiltrationAim Security researchers discovered EchoLeak, a zero-click vulnerability in Microsoft 365 Copilot that could allow an attacker to exfiltrate sensitive enterprise data without user interaction. The attack used a prompt injection delivered vi…CampaignAML.CS005910Google Photos AI Model ExtractionSkyld researchers analyzed the Google Photos Android application and recovered TensorFlow Lite models used by AI-powered photo editing and image analysis features. The researchers found models stored unencrypted in the application's assets,…CampaignAML.CS005811Storm-2139 Azure OpenAI Guardrail BypassStorm-2139 built custom jailbreak tooling to bypass guardrails on Azure OpenAI Services, allowing users to generate harmful synthetic content. Microsoft reported that members of Storm-2139 scraped exposed customer credentials from public so…CampaignAML.CS005712Model Distillation Campaigns Targeting Anthropic ClaudeAnthropic uncovered campaigns to extract Claude's capabilities carried out by the three Chinese AI Labs: DeepSeek, Moonshot, and MiniMax. Collectively, these campaigns used approximately 24,000 accounts and 16 million queries. They used mod…CampaignAML.CS005613AI ClickFix: Hijacking Computer-Use Agents Using ClickFix[Embrace the Red]( https://embracethered.com/) demonstrated that AI computer-use agents are vulnerable to social engineering attacks and can be manipulated into executing arbitrary code on a victim's machine. The attack is a variation on "C…CampaignAML.CS005514Data Exfiltration via Remote Poisoned MCP ToolResearchers at Invariant Labs demonstrated that AI agents configured with remote Model Context Protocol (MCP) Tools can be vulnerable to model poisoning attacks. They show that an MCP Tool can contain malicious prompts in its docstring desc…CampaignAML.CS005415Poisoned Postmark MCP Server Email ExfiltrationA bad actor successfully exfiltrated emails from users of the Postmark's MCP server via a supply chain attack. Postmark is an email delivery service that allows organizations to send marketing and transactional emails via API. The Postmark …CampaignAML.CS005316LLMSmith: RCE Vulnerabilities in LLM-Integrated ApplicationsResearchers identified 20 remote code execution (RCE) vulnerabilities across 11 different LLM frameworks. They discovered applications deployed on the public internet built using these LLM frameworks and demonstrated the RCE vulnerabilities…CampaignAML.CS005217OpenClaw Command & Control via Prompt InjectionResearchers at HiddenLayer demonstrated how a webpage can embed an indirect prompt injection that causes OpenClaw to silently execute a malicious script. Once executed, the script plants persistent malicious instructions into future system …CampaignAML.CS005118OpenClaw 1-Click Remote Code ExecutionA security researcher demonstrated a 1-click remote code execution (RCE) vulnerability to the OpenClaw AI Agent via a malicious link containing a JavaScript script that only takes milliseconds to execute. This vulnerability has been reporte…CampaignAML.CS005019Supply Chain Compromise via Poisoned ClawdBot SkillA security researcher demonstrated a proof-of-concept supply chain attack using a poisoned ClawdBot Skill shared on ClawdHub, a Skill registry for agents. The poisoned Skill contained a prompt injection that caused ClawdBot to execute a she…CampaignAML.CS004920Exposed ClawdBot Control Interfaces Leads to Credential Access and ExecutionA security researcher identified hundreds of exposed ClawdBot control interfaces on the public internet. ClawdBot (now OpenClaw) "is a personal AI assistant you run on your own devices. It answers you on the channels you already use ... , p…CampaignAML.CS004821Code to Deploy Destructive AI Agent Discovered in Amazon Q VS Code ExtensionOn July 13th, 2025, a malicious actor using the GitHub username "lkmanka58" used an inappropriately scoped GitHub token to make a commit containing malicious code to the Amazon Q Developer Visual Studio Code (VS Code) extension repository. …CampaignAML.CS004722Data Destruction via Indirect Prompt Injection Targeting Claude Computer-UseSecurity researchers at HiddenLayer demonstrated that an indirect prompt injection targeting Claude's Computer Use AI can lead to execution of shell commands on the victim system and destruction of user data. The researchers embedded a prom…CampaignAML.CS004623Data Exfiltration via an MCP Server used by CursorThe Backslash Security Research Team demonstrated that a Model Context Protocol (MCP) tool can be used as a vector for an indirect prompt injection attack on Cursor, potentially leading to the execution of malicious shell commands. The Back…CampaignAML.CS004524LAMEHUG: Malware Leveraging Dynamic AI-Generated CommandsIn July 2025, Ukrainian authorities reported the emergence of LAMEHUG, a new AI-powered malware attributed to the Russian state-backed threat actor [APT28](https://attack.mitre.org/groups/G0007/) (also tracked as Forest Blizzard or UAC-0001…CampaignAML.CS004425Malware Prototype with Embedded Prompt InjectionCheck Point Research identified a prototype malware sample in the wild that contained a prompt injection, which appeared to be designed to manipulate LLM-based malware detectors and/or analysis tools. However, the researchers did not find t…CampaignAML.CS004326SesameOp: Novel backdoor uses OpenAI Assistants API for command and controlThe Microsoft Incident Response - Detection and Response Team (DART) investigated a compromised system where a threat actor utilized SesameOp, a backdoor implant that abuses the OpenAI Assistants API as a covert command and control channel,…CampaignAML.CS004227Rules File Backdoor: Supply Chain Attack on AI Coding AssistantsPillar Security researchers demonstrated how adversaries can compromise AI-generated code by injecting malicious instructions into rules files used to configure AI coding assistants like Cursor and GitHub Copilot. The attack uses invisible …CampaignAML.CS004128Hacking ChatGPT's Memories with Prompt Injection[Embrace the Red](https://embracethered.com/blog/) demonstrated that ChatGPT's memory feature is vulnerable to manipulation via prompt injections. To execute the attack, the researcher hid a prompt injection in a shared Google Doc. When a u…CampaignAML.CS004029Living Off AI: Prompt Injection via Jira Service ManagementResearchers from Cato Networks demonstrated how adversaries can exploit AI-powered systems embedded in enterprise workflows to execute malicious actions with elevated privileges. This is achieved by crafting malicious inputs from external u…CampaignAML.CS003930Planting Instructions for Delayed Automatic AI Agent Tool Invocation[Embrace the Red](https://embracethered.com/blog/) demonstrated that Google Gemini is susceptible to automated tool invocation by delaying the execution to the next conversation turn. This bypasses a security control that restricts Gemini f…CampaignAML.CS003831Data Exfiltration via Agent Tools in Copilot StudioResearchers from Zenity demonstrated how an organization's data can be exfiltrated via prompt injections that target an AI-powered customer service agent. The target system is a customer service agent built by Zenity in Copilot Studio. It i…CampaignAML.CS003732AIKatz: Attacking LLM Desktop ApplicationsResearchers at Lumia have demonstrated that it is possible to extract authentication tokens from the memory of LLM Desktop Applications. An attacker could then use those tokens to impersonate the victim to the LLM backend, thereby gaining a…CampaignAML.CS003633Data Exfiltration from Slack AI via Indirect Prompt Injection[PromptArmor](https://promptarmor.substack.com) demonstrated that private data can be exfiltrated from Slack AI via indirect prompt injections. The attack relied on Slack AI ingesting a malicious prompt from a post in a public channel into …CampaignAML.CS003534ProKYC: Deepfake Tool for Account Fraud AttacksCato CTRL security researchers have identified ProKYC, a deepfake tool being sold to cybercriminals as a method to bypass Know Your Customer (KYC) verification on financial service applications such as cryptocurrency exchanges. ProKYC can c…CampaignAML.CS003435Live Deepfake Image Injection to Evade Mobile KYC VerificationFacial biometric authentication services are commonly used by mobile applications for user onboarding, authentication, and identity verification for KYC requirements. The iProov Red Team demonstrated a face-swapped imagery injection attack …CampaignAML.CS003336Attempted Evasion of ML Phishing Webpage Detection SystemAdversaries create phishing websites that appear visually similar to legitimate sites. These sites are designed to trick users into entering their credentials, which are then sent to the bad actor. To combat this behavior, security companie…CampaignAML.CS003237Malicious Models on Hugging FaceResearchers at ReversingLabs have identified malicious models containing embedded malware hosted on the Hugging Face model repository. The models were found to execute reverse shells when loaded, which grants the threat actor command and co…CampaignAML.CS003138LLM JackingThe Sysdig Threat Research Team discovered that malicious actors utilized stolen credentials to gain access to cloud-hosted large language models (LLMs). The actors covertly gathered information about which models were enabled on the cloud …CampaignAML.CS003039Google Bard Conversation Exfiltration[Embrace the Red](https://embracethered.com/blog/) demonstrated that Bard users' conversations could be exfiltrated via an indirect prompt injection. To execute the attack, a threat actor shares a Google Doc containing the prompt with the t…CampaignAML.CS002940AI Model Tampering via Supply Chain AttackResearchers at Trend Micro, Inc. used service indexing portals and web searching tools to identify over 8,000 misconfigured private container registries exposed on the internet. Approximately 70% of the registries also had overly permissive…CampaignAML.CS002841Organization Confusion on Hugging Face[threlfall_hax](https://5stars217.github.io/), a security researcher, created organization accounts on Hugging Face, a public model repository, that impersonated real organizations. These false Hugging Face organization accounts looked legi…CampaignAML.CS002742Financial Transaction Hijacking with M365 Copilot as an InsiderResearchers from Zenity conducted a red teaming exercise in August 2024 that successfully manipulated Microsoft 365 Copilot.[[twitter]] The attack abused the fact that Copilot ingests received emails into a retrieval augmented generation (R…CampaignAML.CS002643Web-Scale Data Poisoning: Split-View AttackMany recent large-scale datasets are distributed as a list of URLs pointing to individual datapoints. The researchers show that many of these datasets are vulnerable to a "split-view" poisoning attack. The attack exploits the fact that the …CampaignAML.CS002544Morris II Worm: RAG-Based AttackResearchers developed Morris II, a zero-click worm designed to attack generative AI (GenAI) ecosystems and propagate between connected GenAI systems. The worm uses an adversarial self-replicating prompt which uses prompt injection to replic…CampaignAML.CS002445ShadowRay: Hijacking Exposed Ray ClustersRay is an open-source Python framework for scaling production AI workflows. Ray's Job API allows for arbitrary remote execution by design. However, it does not offer authentication, and the default configuration may expose the cluster to th…CampaignAML.CS002346ChatGPT Package HallucinationResearchers identified that large language models such as ChatGPT can hallucinate fake software package names that are not published to a package repository. An attacker could publish a malicious package under the hallucinated name to a pac…CampaignAML.CS002247ChatGPT Conversation Exfiltration[Embrace the Red](https://embracethered.com/blog/) demonstrated that ChatGPT users' conversations can be exfiltrated via an indirect prompt injection. To execute the attack, a threat actor uploads a malicious prompt to a public website, whe…CampaignAML.CS002148Indirect Prompt Injection Threats: Bing Chat Data PirateWhenever interacting with Microsoft's new Bing Chat LLM Chatbot, a user can allow Bing Chat permission to view and access currently open websites throughout the chat session. Researchers demonstrated the ability for an attacker to plant an …CampaignAML.CS002049PoisonGPTResearchers from Mithril Security demonstrated how to poison an open-source pre-trained large language model (LLM) to return a false fact. They then successfully uploaded the poisoned model back to HuggingFace, the largest publicly-accessib…CampaignAML.CS001950Arbitrary Code Execution with Google ColabGoogle Colab is a Jupyter Notebook service that executes on virtual machines. Jupyter Notebooks are often used for ML and data science research and experimentation, containing executable snippets of Python code and common Unix command-line …CampaignAML.CS001851Bypassing ID.me Identity VerificationAn individual filed at least 180 false unemployment claims in the state of California from October 2020 to December 2021 by bypassing ID.me's automated identity verification system. Dozens of fraudulent claims were approved and the individu…CampaignAML.CS001752Achieving Code Execution in MathGPT via Prompt InjectionThe publicly available Streamlit application [MathGPT](https://mathgpt.streamlit.app/) uses GPT-3, a large language model (LLM), to answer user-generated math questions. Recent studies and experiments have shown that LLMs such as GPT-3 show…CampaignAML.CS001653Compromised PyTorch Dependency ChainLinux packages for PyTorch's pre-release version, called Pytorch-nightly, were compromised from December 25 to 30, 2022 by a malicious binary uploaded to the Python Package Index (PyPI) code repository. The malicious binary had the same nam…CampaignAML.CS001554Confusing Antimalware Neural NetworksCloud storage and computations have become popular platforms for deploying ML malware detectors. In such cases, the features for models are built on users' systems and then sent to cybersecurity company servers. The Kaspersky ML research te…CampaignAML.CS001455Backdoor Attack on Deep Learning Models in Mobile AppsDeep learning models are increasingly used in mobile applications as critical components. Researchers from Microsoft Research demonstrated that many deep learning models deployed in mobile apps are vulnerable to backdoor attacks via "neural…CampaignAML.CS001356Face Identification System Evasion via Physical CountermeasuresMITRE's AI Red Team demonstrated a physical-domain evasion attack on a commercial face identification service with the intention of inducing a targeted misclassification. This operation had a combination of traditional MITRE ATT&CK techniqu…CampaignAML.CS001257Microsoft Edge AI EvasionThe Azure Red Team performed a red team exercise on a new Microsoft product designed for running AI workloads at the edge. This exercise was meant to use an automated system to continuously manipulate a target image to cause the ML model to…CampaignAML.CS001158Microsoft Azure Service DisruptionThe Microsoft AI Red Team performed a red team exercise on an internal Azure service with the intention of disrupting its service. This operation had a combination of traditional ATT&CK enterprise techniques such as finding valid account, a…CampaignAML.CS001059Tay PoisoningMicrosoft created Tay, a Twitter chatbot designed to engage and entertain users. While previous chatbots used pre-programmed scripts to respond to prompts, Tay's machine learning capabilities allowed it to be directly influenced by its conv…CampaignAML.CS000960ProofPoint EvasionProof Pudding (CVE-2019-20634) is a code repository that describes how ML researchers evaded ProofPoint's email protection system by first building a copy-cat email protection ML model, and using the insights to bypass the live system. More…CampaignAML.CS000861GPT-2 Model ReplicationOpenAI built GPT-2, a language model capable of generating high quality text samples. Over concerns that GPT-2 could be used for malicious purposes such as impersonating others, or generating misleading news articles, fake social media cont…CampaignAML.CS000762ClearviewAI MisconfigurationClearview AI makes a facial recognition tool that searches publicly available photos for matches. This tool has been used for investigative purposes by law enforcement agencies and other parties. Clearview AI's source code repository, thoug…CampaignAML.CS000663Attack on Machine Translation ServicesMachine translation services (such as Google Translate, Bing Translator, and Systran Translate) provide public-facing UIs and APIs. A research group at UC Berkeley utilized these public endpoints to create a replicated model with near-produ…CampaignAML.CS000564Camera Hijack Attack on Facial Recognition SystemThis type of camera hijack attack can evade the traditional live facial recognition authentication model and enable access to privileged systems and victim impersonation. Two individuals in China used this attack to gain access to the local…CampaignAML.CS000465Bypassing Cylance's AI Malware DetectionResearchers at Skylight were able to create a universal bypass string that evades detection by Cylance's AI Malware detector when appended to a malicious file.CampaignAML.CS000366VirusTotal PoisoningMcAfee Advanced Threat Research noticed an increase in reports of a certain ransomware family that was out of the ordinary. Case investigation revealed that many samples of that particular ransomware family were submitted through a popular …CampaignAML.CS000267Botnet Domain Generation Algorithm (DGA) Detection EvasionThe Palo Alto Networks Security AI research team was able to bypass a Convolutional Neural Network based botnet Domain Generation Algorithm (DGA) detector using a generic domain name mutation technique. It is a generic domain mutation techn…CampaignAML.CS000168Evasion of Deep Learning Detector for Malware C&C TrafficThe Palo Alto Networks Security AI research team tested a deep learning model for malware command and control (C&C) traffic detection in HTTP traffic. Based on the publicly available [paper by Le et al.](https://arxiv.org/abs/1802.03162), w…CampaignAML.CS000069Limit AI Workload Resource ConsumptionLimit the resources that an AI request, inference job, or agent workflow can consume. Set bounds on input size, batch size, execution time, memory, compute, and output size. Generative AI services should also limit context and output tokens…MitigationAML.M003670AI Red TeamEstablish an AI red team responsible for conducting recurring, authorized, and threat-informed red-teaming exercises to identify and remediate vulnerabilities in AI-enabled systems before deployment and throughout operation. AI red-teaming …MitigationAML.M003571Deepfake DetectionApply deepfake detection algorithms against any untrusted or user-provided data, especially in impactful applications such as biometric verification, to block generated content. Detectors may use a combination of approaches, including: - AI…MitigationAML.M003472Input and Output Validation for AI Agent ComponentsImplement validation on inputs and outputs for the tools and data sources used by AI agents. Validation includes enforcing a common data format, schema validation, checks for sensitive or prohibited information leakage, and data sanitizatio…MitigationAML.M003373Segmentation of AI Agent ComponentsDefine security boundaries around agentic tools and data sources with methods such as API access, container isolation, code execution sandboxing, and rate limiting of tool invocation. When sandboxing, limit resource and network access and b…MitigationAML.M003274Memory HardeningMemory Hardening protects persistent state used by AI agents, including saved preferences, episodic or semantic memories, conversation summaries, stored chat history, and agent-managed experience stores. Unlike guardrails that evaluate cont…MitigationAML.M003175Restrict AI Agent Tool Invocation on Untrusted DataUntrusted data can contain prompt injections that invoke an AI agent's tools, potentially causing confidentiality, integrity or availability violations. It is recommended that tool invocation be restricted or limited when untrusted data ent…MitigationAML.M003076Human In-the-Loop for AI Agent ActionsSystems should require the user or another human stakeholder to approve AI agent actions before the agent takes them. The human approver may be technical staff or business unit SMEs depending on the use case. Separate tools, such as dedicat…MitigationAML.M002977AI Agent Tools Permissions ConfigurationWhen deploying tools that will be shared across multiple AI agents, it is important to implement robust policies and controls on permissions for the tools. These controls include applying the principle of least privilege along with delegate…MitigationAML.M002878Single-User AI Agent Permissions ConfigurationWhen deploying an AI agent that acts as a representative of a user and performs actions on their behalf, it is important to implement robust policies and controls on permissions and lifecycle management of the agent. Lifecycle management in…MitigationAML.M002779Privileged AI Agent Permissions ConfigurationAI agents may be granted elevated privileges above that of a normal user to enable desired workflows. When deploying a privileged AI agent, or an agent that interacts with multiple users, it is important to implement robust policies and con…MitigationAML.M002680Maintain AI Dataset ProvenanceMaintain a detailed history of datasets used for AI applications. The history should include information about the dataset's source as well as a complete record of any modifications.MitigationAML.M002581AI Telemetry LoggingImplement logging of inputs and outputs of deployed AI models. When deploying AI agents, implement logging of the intermediate steps of agentic actions and decisions, data access and tool use, installation commands, and identity of the agen…MitigationAML.M002482AI Bill of MaterialsAn AI Bill of Materials (AI BOM) contains a full listing of artifacts and resources that were used in building the AI. The AI BOM can help mitigate supply chain risks and enable rapid response to reported vulnerabilities. This can include m…MitigationAML.M002383Generative AI Model AlignmentGenerative AI Model Alignment is the process of training or fine-tuning a generative model to guide its output toward a set of human values, goals, or ethical principles. Desired principles can be in alignment with safety, security, content…MitigationAML.M002284Generative AI GuidelinesGuidelines are instructions, policies, and behavioral constraints provided to a generative AI model to direct it toward desired outputs and away from unsafe, unreliable, or policy-violating behavior. Guidelines can help reduce risks related…MitigationAML.M002185Generative AI GuardrailsGuardrails are safety controls placed between users, tools, and generative AI models to evaluate prompts, retrieved context, model outputs, and agent actions before they are accepted, executed, or shown to a user. They can help block, modif…MitigationAML.M002086Control Access to AI Models and Data in ProductionRequire users to verify their identities before accessing a production model. Require authentication for API endpoints and monitor production model queries to ensure compliance with usage policies and to prevent model misuse.MitigationAML.M001987User TrainingEducate AI model developers to on AI supply chain risks and potentially malicious AI artifacts. Educate users on how to identify deepfakes and phishing attempts.MitigationAML.M001888AI Model Distribution MethodsDeploying AI models to edge devices can increase the attack surface of the system. Consider serving models in the cloud to reduce the level of access the adversary has to the model. Also consider computing features in the cloud to prevent g…MitigationAML.M001789Vulnerability ScanningVulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them. File formats such as pickle files that are commonly used to store AI models can contain exploits that allow for arbitrary code execut…MitigationAML.M001690Predictive AI Adversarial Input DetectionDetect and block digital or physical adversarial examples submitted to predictive AI models. Adversarial examples are inputs modified or constructed to cause misclassification, missed detection, excessive computation, or another attacker-se…MitigationAML.M001591Verify AI ArtifactsVerify the cryptographic checksum of all AI artifacts to verify that the file was not modified by an attacker.MitigationAML.M001492Code SigningEnforce binary and application integrity with digital signature verification to prevent untrusted code from executing. Adversaries can embed malicious code in AI software or models. Developers should also cryptographically sign SBOM and AIB…MitigationAML.M001393Encrypt Sensitive InformationEncrypt sensitive data such as AI models to protect against adversaries attempting to access sensitive data.MitigationAML.M001294Restrict Library LoadingPrevent abuse of library loading mechanisms in the operating system and software to load untrusted code by configuring appropriate library loading mechanisms and investigating potential vulnerable software. File formats such as pickle files…MitigationAML.M001195Predictive AI Input RestorationPreprocess predictive AI inference inputs to remove, reduce, or disrupt adversarial perturbations before the inputs are evaluated by the model. Restoration methods may include denoising, compression, reconstruction, resampling, feature sque…MitigationAML.M001096Predictive AI Multi-Sensor FusionUse independent physical sensors (ideally across multiple modalities or from several perspectives) to avoid relying on a single sensor that may be manipulated, obstructed, or disrupted by an adversary. Relevant sensors may include visible-l…MitigationAML.M000997Validate AI ModelValidate that AI models perform as intended by testing for backdoor triggers, potential for data leakage, or adversarial influence. Monitor AI model for concept drift and training data drift, which may indicate data tampering and poisoning.MitigationAML.M000898Sanitize Training DataDetect and remove or remediate poisoned training data. Training data should be sanitized prior to model training and recurrently for an active learning model. Implement a filter to limit ingested training data. Establish a content policy th…MitigationAML.M000799Predictive AI EnsemblesUse an ensemble of diverse predictive AI models to reduce reliance on a single model or model family and improve robustness against adversarial examples. Ensemble members should be sufficiently diverse, such as through different architectur…MitigationAML.M0006100Control Access to AI Models and Data at RestEstablish access controls on internal model registries and limit internal access to production models. Limit access to training data only to approved users.MitigationAML.M0005101Limit AI Service Query Volume and RateLimit the number and rate of requests that users can submit to an AI service. Apply limits by user, API key, tenant, device, or other authenticated identity. Use short-term rate, burst, and concurrency limits together with longer-term usage…MitigationAML.M0004102Predictive AI Model HardeningDesign and train predictive AI models to maintain intended performance when presented with adversarial examples. Adversarial examples may include digitally perturbed inputs or physical countermeasures intended to cause misclassification, mi…MitigationAML.M0003103Predictive AI Output ObfuscationReduce the fidelity and amount of information returned by predictive AI inference endpoints to make model discovery, extraction, replication, and black-box adversarial-example optimization more difficult. Limit outputs to those required by …MitigationAML.M0002104Limit Model Artifact ReleaseLimit public release of technical project details including data, algorithms, model architectures, and model checkpoints that are used in production, or that are representative of those used in production.MitigationAML.M0001105Limit Public Release of InformationLimit the public release of technical information about the AI stack used in an organization's products or services. Technical knowledge of how AI is used can be leveraged by adversaries to perform targeting and tailor attacks to the target…MitigationAML.M0000106AI Agent ToolsAdversaries may create and publish poisoned AI agent tools. Poisoned tools may contain malicious model-visible definitions or instructions, hidden executable behavior, or runtime responses designed to manipulate an AI agent. Tools may be pu…TechniqueAML.T0115.002107ModelsAdversaries may publish poisoned AI models through model registries, code repositories, or other model distribution channels. The model may be newly created or a modified variant of a legitimate model and may contain manipulated weights, co…TechniqueAML.T0115.001108DatasetsAdversaries may publish poisoned datasets intended for training or fine-tuning AI models. The dataset may be newly created or a modified variant of a legitimate dataset and may contain manipulated samples, labels, annotations, or metadata. …TechniqueAML.T0115.000109Publish Poisoned AI ArtifactsAdversaries may create or modify AI artifacts and publish them through public or shared distribution channels to facilitate compromise of downstream AI systems. Poisoned AI artifacts may include datasets, models, and AI agent tools containi…TechniqueAML.T0115110AI Service Web InterfaceAdversaries may communicate with compromised systems by abusing the web interface of an AI service as an intermediary command-and-control relay. Instead of connecting directly to attacker-controlled infrastructure or using an AI provider's …TechniqueAML.T0114111Steal Web Session CookieAdversaries may steal web application or service session cookies used to authenticate users to AI-enabled systems, AI services, or supporting enterprise applications. Web applications often use session cookies as authentication tokens after…TechniqueAML.T0113112AI ArtifactsAdversaries may achieve full system compromise by introducing malicious AI artifacts, such as models or data, that contain embedded malware or other malicious commands. AI artifacts are often stored in model registries or data stores and ma…TechniqueAML.T0112.001113Local AI AgentAdversaries may achieve full system compromise by abusing AI agents running locally on a host, such as computer-use agents or AI-driven browsers. These agents are designed to autonomously interact with the operating system, applications, an…TechniqueAML.T0112.000114Machine CompromiseAdversaries may compromise a machine by exploiting or manipulating AI-enabled components on the system. Compromising a victim system allows the adversary to execute arbitrary code, steal credentials, exfiltrate data, and continue to persist…TechniqueAML.T0112115AI Supply Chain Reputation InflationAI Supply Chain Reputation Inflation is the process of building or leveraging genuinely credible-looking trust signals to increase the perceived legitimacy of AI supply chain components, with the goal of driving adoption of malicious or com…TechniqueAML.T0111116Runtime ResponseAdversaries may poison the runtime response channel of a malicious or compromised AI agent tool by deliberately returning content intended to influence the model's subsequent reasoning, decisions, or actions. Poisoned responses may contain …TechniqueAML.T0110.002117ImplementationAdversaries may poison the executable implementation of an AI agent tool so that normal tool invocation produces unauthorized behavior or hidden side effects. The tool may continue to provide its represented functionality while also accessi…TechniqueAML.T0110.001118Definition and InstructionsAdversaries may poison the model-visible definition or operational instructions of an AI agent tool to manipulate how an agent interprets, selects, or invokes the tool. The poisoned content may be contained in tool descriptions, docstrings,…TechniqueAML.T0110.000119AI Agent Tool PoisoningAdversaries may poison tools used by AI agents by introducing or modifying malicious content or behavior in a tool's model-visible definition, executable implementation, or runtime responses. Tools may include built-in integrations, locally…TechniqueAML.T0110120AI Supply Chain Rug PullAdversaries may publish legitimate AI components or software, gain user adoption, then push an update with a malicious variant, leading to [AI Supply Chain Compromise](/techniques/AML.T0010). More scrutiny is often placed on a supply chain …TechniqueAML.T0109121AI AgentAdversaries may abuse AI agents present on the victim's system for command and control. AI agents are often granted access to tools that can execute shell commands, reach out to the internet, and interact with other services in the victim's…TechniqueAML.T0108122Exploitation for Defense EvasionAdversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system…TechniqueAML.T0107123Exploitation for Credential AccessAdversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating s…TechniqueAML.T0106124Escape to HostAdversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In prin…TechniqueAML.T0105125Deploy AI AgentAdversaries may launch AI agents in the victim's environment to execute actions on their behalf. AI agents may have access to a wide range of tools and data sources, as well as permissions to access and interact with other services and syst…TechniqueAML.T0103126Generate Malicious CommandsAdversaries may use large language models (LLMs) to dynamically generate malicious commands from natural language. Dynamically generated commands may be harder to detect as the attack signature is constantly changing. AI-generated commands …TechniqueAML.T0102127Data Destruction via AI Agent Tool InvocationAdversaries may invoke an AI agent's tool capable of performing mutative operations to perform Data Destruction. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to system…TechniqueAML.T0101128AI Agent ClickbaitAdversaries may craft deceptive web content designed to bait Computer-Using AI agents or AI web browsers into taking unintended actions, such as clicking buttons, copying code, or navigating to specific web pages. These attacks exploit the …TechniqueAML.T0100129AI Agent Tool Data PoisoningAdversaries may manipulate data in a victim-controlled, trusted, or connected data source that is accessible through an AI agent tool. Poisoned data may be placed in document repositories, databases, source-code repositories, knowledge base…TechniqueAML.T0099130AI Agent Tool Credential HarvestingAdversaries may attempt to use their access to an AI agent on the victim's system to retrieve data from available agent tools to collect credentials. Agent tools may connect to a wide range of sources that may contain credentials including …TechniqueAML.T0098131Virtualization/Sandbox EvasionAdversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment …TechniqueAML.T0097132AI Service APIAdversaries may communicate using the API of an AI service on the victim's system. The adversary's commands to the victim system, and often the results, are embedded in the normal traffic of the AI service. An AI service API command and con…TechniqueAML.T0096133Code RepositoriesAdversaries may search public code repositories for information about a victim or victim system that can be used during targeting. Victims may store code or artifacts related to their AI systems in repositories on various third-party websit…TechniqueAML.T0095.000134Search Open Websites/DomainsAdversaries may search public websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or domains owned by …TechniqueAML.T0095135Delay Execution of LLM InstructionsAdversaries may include instructions to be followed by the AI system in response to a future event, such as a specific keyword or the next interaction, in order to evade detection or bypass controls placed on the AI system. For example, an …TechniqueAML.T0094136Prompt Infiltration via Public-Facing ApplicationAn adversary may introduce malicious prompts into the victim's system via a public-facing application with the intention of it being ingested by an AI at some point in the future and ultimately having a downstream effect. This may occur whe…TechniqueAML.T0093137Manipulate User LLM Chat HistoryAdversaries may manipulate a user's large language model (LLM) chat history to cover the tracks of their malicious behavior. They may hide persistent changes they have made to the LLM's behavior, or obscure their attempts at discovering pri…TechniqueAML.T0092138Web Session CookieAdversaries may use stolen web session cookies to authenticate to AI-enabled applications and supporting services as another user. This technique may bypass some multi-factor authentication controls because the session represented by the co…TechniqueAML.T0091.001139Application Access TokenAdversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used …TechniqueAML.T0091.000140Use Alternate Authentication MaterialAdversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. AI services commonly…TechniqueAML.T0091141OS Credential DumpingAdversaries may extract credentials from OS caches, application memory, or other sources on a compromised system. Credentials are often in the form of a hash or clear text, and can include usernames and passwords, application tokens, or oth…TechniqueAML.T0090142Process DiscoveryAdversaries may attempt to get information about processes running on a system. Once obtained, this information could be used to gain an understanding of common AI-related software/applications running on systems within the network. Adminis…TechniqueAML.T0089143Generate DeepfakesAdversaries may use generative artificial intelligence (GenAI) to create synthetic media (i.e. imagery, video, audio, and text) that appear authentic. These "[deepfakes]( https://en.wikipedia.org/wiki/Deepfake)" may mimic a real person or d…TechniqueAML.T0088144Gather Victim Identity InformationAdversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, photos, etc.) as …TechniqueAML.T0087145Exfiltration via AI Agent Tool InvocationAI agent tools capable of performing write operations may be invoked to exfiltrate data to an adversary. Sensitive information can be encoded into the tool's input parameters and transmitted to an adversary-controlled location (such as an i…TechniqueAML.T0086146AI Agent ToolsAdversaries may prompt the AI service to invoke various tools the agent has access to. Tools may retrieve data from different APIs or services in an organization.TechniqueAML.T0085.001147RAG DatabasesAdversaries may prompt the AI service to retrieve data from a RAG database. This can include the majority of an organization's internal documents.TechniqueAML.T0085.000148Data from AI ServicesAdversaries may use their access to a victim organization's AI-enabled services to collect proprietary or otherwise sensitive information. As organizations adopt generative AI in centralized services for accessing an organization's data, su…TechniqueAML.T0085149Call ChainsAdversaries may extract call chains from AI agent configurations, which can reveal potentially targets for remote code execution (RCE) or other vulnerabilities. Vulnerable call chains often connect user inputs or LLM outputs to an execution…TechniqueAML.T0084.003150Activation TriggersAdversaries may discover keywords or other triggers (such as incoming emails, documents being added, incoming message, or other workflows) that activate an agent and may cause it to run additional actions. Understanding these triggers can r…TechniqueAML.T0084.002151Tool DefinitionsAdversaries may discover the tools the AI agent has access to. By identifying which tools are available, the adversary can understand what actions may be executed through the agent and what additional resources it can reach. This knowledge …TechniqueAML.T0084.001152Embedded KnowledgeAdversaries may attempt to discover the data sources a particular agent can access. The AI agent's configuration may reveal data sources or knowledge. The embedded knowledge may include sensitive or proprietary material such as intellectual…TechniqueAML.T0084.000153Discover AI Agent ConfigurationAdversaries may attempt to discover configuration information for AI agents present on the victim's system. Agent configurations can include tools or services they have access to. Adversaries may directly access agent configuring dashboards…TechniqueAML.T0084154Credentials from AI Agent ConfigurationAdversaries may access the credentials of other tools or services on a system from the configuration of an AI agent. AI Agents often utilize external tools or services to take actions, such as querying databases, invoking APIs, or interacti…TechniqueAML.T0083155RAG Credential HarvestingAdversaries may attempt to use their access to a large language model (LLM) on the victim's system to collect credentials. Credentials may be stored in internal documents which can inadvertently be ingested into a RAG database, where they c…TechniqueAML.T0082156Modify AI Agent ConfigurationAdversaries may modify the configuration files for AI agents on a system. This allows malicious changes to persist beyond the life of a single agent and affects any agents that share the configuration. Configuration changes may include modi…TechniqueAML.T0081157ThreadAdversaries may introduce malicious instructions into a chat thread of a large language model (LLM) to cause behavior changes which persist for the remainder of the thread. A chat thread may continue for an extended period over multiple ses…TechniqueAML.T0080.001158MemoryAdversaries may manipulate the memory of a large language model (LLM) in order to persist changes to the LLM across future chat sessions. Memory is a common feature in LLMs that allows them to remember information across chat sessions by ut…TechniqueAML.T0080.000159AI Agent Context PoisoningAdversaries may attempt to manipulate the context used by an AI agent's large language model (LLM) to influence the responses it generates or actions it takes. This allows an adversary to persistently change the behavior of the target agent…TechniqueAML.T0080160Stage CapabilitiesAdversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](/techniques/AML.T0017)) or o…TechniqueAML.T0079161Drive-by CompromiseAdversaries may gain access to an AI system through a user visiting a website over the normal course of browsing, or an AI agent retrieving information from the web on behalf of a user. Websites can contain an [LLM Prompt Injection](/techni…TechniqueAML.T0078162LLM Response RenderingAn adversary may get a large language model (LLM) to respond with private information that is hidden from the user when the response is rendered by the user's client. The private information is then exfiltrated. This can take the form of re…TechniqueAML.T0077163Corrupt AI ModelAn adversary may purposefully corrupt a malicious AI model file so that it cannot be successfully deserialized in order to evade detection by a model scanner. The corrupt model may still successfully execute malicious code before deserializ…TechniqueAML.T0076164Cloud Service DiscoveryAdversaries may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), software-as-a-service (SaaS), or AI-as-a-se…TechniqueAML.T0075165MasqueradingAdversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated o…TechniqueAML.T0074166ImpersonationAdversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via [Phishing](/techniques/AML.T0052), …TechniqueAML.T0073167Reverse ShellAdversaries may utilize a reverse shell to communicate and control the victim system. Typically, a user uses a client to connect to a remote machine which is listening for connections. With a reverse shell, the adversary is listening for in…TechniqueAML.T0072168False RAG Entry InjectionAdversaries may introduce false entries into a victim's retrieval augmented generation (RAG) database. Content designed to be interpreted as a document by the large language model (LLM) used in the RAG system is included in a data source be…TechniqueAML.T0071169RAG PoisoningAdversaries may inject malicious content into data indexed by a retrieval augmented generation (RAG) system to contaminate a future thread through RAG-based search results. This may be accomplished by placing manipulated documents in a loca…TechniqueAML.T0070170System PromptAdversaries may discover a large language model's system instructions provided by the AI system builder to learn about the system's capabilities and circumvent its guardrails.TechniqueAML.T0069.002171System Instruction KeywordsAdversaries may discover keywords that have special meaning to the large language model (LLM), such as function names or object names. These can later be exploited to confuse or manipulate the LLM into misbehaving and to make calls to plugi…TechniqueAML.T0069.001172Special Character SetsAdversaries may discover delimiters and special characters sets used by the large language model. For example, delimiters used in retrieval augmented generation applications to differentiate between context and user prompts. These can later…TechniqueAML.T0069.000173Discover LLM System InformationThe adversary is trying to discover something about the large language model's (LLM) system information. This may be found in a configuration file containing the system instructions or extracted via interactions with the LLM. The desired in…TechniqueAML.T0069174LLM Prompt ObfuscationAdversaries may hide or otherwise obfuscate prompt injections or retrieval content to avoid detection from humans, large language model (LLM) guardrails, or other detection mechanisms. For text inputs, this may include modifying how the ins…TechniqueAML.T0068175CitationsAdversaries may manipulate the citations provided in an AI system's response, in order to make it appear trustworthy. Variants include providing the wrong citation, making up a new citation, or providing the right citation but for adversary…TechniqueAML.T0067.000176LLM Trusted Output Components ManipulationAdversaries may utilize prompts to a large language model (LLM) which manipulate various components of its response in order to make it appear trustworthy to the user. This helps the adversary continue to operate in the victim's environment…TechniqueAML.T0067177Retrieval Content CraftingAdversaries may write content designed to be retrieved by user queries and influence a user of the system in some way. This abuses the trust the user has in the system. The crafted content can be combined with a prompt injection. It can als…TechniqueAML.T0066178LLM Prompt CraftingAdversaries may use their acquired knowledge of the target generative AI system to craft prompts that bypass its defenses and allow malicious instructions to be executed. The adversary may iterate on the prompt to ensure that it works as-in…TechniqueAML.T0065179Gather RAG-Indexed TargetsAdversaries may identify data sources used in retrieval augmented generation (RAG) systems for targeting purposes. By pinpointing these sources, attackers can focus on poisoning or otherwise manipulating the external data repositories the A…TechniqueAML.T0064180Discover AI Model OutputsAdversaries may discover model outputs, such as class scores, whose presence is not required for the system to function and are not intended for use by the end user. Model outputs may be found in logs or may be included in API responses. Mo…TechniqueAML.T0063181Discover LLM HallucinationsAdversaries may prompt large language models and identify hallucinated entities. They may request software packages, commands, URLs, organization names, or e-mail addresses, and identify hallucinations with no connected real-world source. D…TechniqueAML.T0062182LLM Prompt Self-ReplicationAn adversary may use a carefully crafted [LLM Prompt Injection](/techniques/AML.T0051) designed to cause the LLM to replicate the prompt as part of its output. This allows the prompt to propagate to other LLMs and persist on the system. The…TechniqueAML.T0061183Publish Hallucinated EntitiesAdversaries may create an entity they control, such as a software package, website, or email address corresponding to a source hallucinated by an LLM. The hallucinations may take the form of package names, commands, URLs, company names, or …TechniqueAML.T0060184Erode Dataset IntegrityAdversaries may poison or manipulate portions of a dataset to reduce its usefulness, reduce trust, and cause users to waste resources correcting errors.TechniqueAML.T0059185LLM Data LeakageAdversaries may craft prompts that induce the LLM to leak sensitive information. This can include private user data or proprietary information. The leaked information may come from proprietary training data, data sources the LLM is connecte…TechniqueAML.T0057186Extract LLM System PromptAdversaries may attempt to extract a large language model's (LLM) system prompt. Adversaries achieve this via prompt injection that induces the model to reveal its system prompt, or they may extract it from a configuration file. System prom…TechniqueAML.T0056187Unsecured CredentialsAdversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. bash history), environment variable…TechniqueAML.T0055188LLM JailbreakAdversaries may induce a large language model (LLM) to ignore, circumvent, or override its safety/alignment behaviors and/or guardrails to elicit outputs the model is intended to withhold. Once jailbroken, the LLM may be used in unintended …TechniqueAML.T0054189AI Agent Tool InvocationAdversaries may use their access to an AI agent to invoke tools the agent has access to. LLMs are often connected to other services or resources via tools to increase their capabilities. Tools may include integrations with other application…TechniqueAML.T0053190Deepfake-Assisted PhishingAdversaries may use deepfakes (AI-generated synthetic images, audio, or video) in phishing campaigns to impersonate trusted individuals, executives, or organizations. These attacks exploit human trust by presenting fraudulent voice or video…TechniqueAML.T0052.001191Spearphishing via Social Engineering LLMAdversaries may turn LLMs into targeted social engineers. LLMs are capable of interacting with users via text conversations. They can be instructed by an adversary to seek sensitive information from a user and act as effective social engine…TechniqueAML.T0052.000192PhishingAdversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, compa…TechniqueAML.T0052193TriggeredAn adversary may trigger a prompt injection via a user action or event that occurs within the victim's environment. Triggered prompt injections often target AI agents, which can be activated by means the adversary identifies during [Discove…TechniqueAML.T0051.002194IndirectAn adversary may inject prompts indirectly via a separate data channel ingested by the LLM, such as text or multimedia pulled from databases or websites. These malicious prompts may be hidden or obfuscated from the user. This type of inject…TechniqueAML.T0051.001195DirectAn adversary may inject prompts directly as a user of the LLM. This type of injection may be used by the adversary to gain a foothold in the system or to misuse the LLM itself, as for example to generate harmful content.TechniqueAML.T0051.000196LLM Prompt InjectionAn adversary may craft malicious prompts as inputs to an LLM that cause the LLM to act in unintended ways. These "prompt injections" are often designed to cause the model to ignore aspects of its original instructions and follow the adversa…TechniqueAML.T0051197Command and Scripting InterpreterAdversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most…TechniqueAML.T0050198Exploit Public-Facing ApplicationAdversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, o…TechniqueAML.T0049199AI Intellectual Property TheftAdversaries may exfiltrate AI artifacts to steal intellectual property and cause economic harm to the victim organization. Proprietary training data is costly to collect and annotate and may be a target for [Exfiltration](/tactics/AML.TA001…TechniqueAML.T0048.004200User HarmUser harms may encompass a variety of harm types including financial and reputational that are directed at or felt by individual victims of the attack rather than at the organization level.TechniqueAML.T0048.003