@blamejs/exceptd-skills 0.20.1 → 0.21.0

package/data/atlas-ttps.json

@@ -5,8 +5,8 @@
     "atlas_release_date": "2026-09-15",
     "secure_ai_v2_release_date": "2026-05-06",
     "secure_ai_v2_source": "https://ctid.mitre.org/blog/2026/05/06/secure-ai-v2-release",
-    "last_updated": "2026-09-18",
-    "last_threat_review": "2026-09-18",
+    "last_updated": "2026-09-22",
+    "last_threat_review": "2026-09-22",
     "source": "https://atlas.mitre.org",
     "note": "AI-relevant ATLAS TTPs with framework_gap field, curated as a subset of the full ATLAS matrix and pinned to v2026.09. ATLAS content follows a YYYY.MM calendar-versioning scheme; the CalVer scheme and the per-technique platform tags (Predictive AI, Generative AI, Agentic AI, Enterprise) were introduced in release 2026.05. Release 2026.06 published AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie) and AML.T0114 (AI Service Web Interface), all three carried here. Release 2026.07 consolidated three separately-numbered publish-poisoned techniques, AML.T0019 (datasets), AML.T0058 (models) and AML.T0104 (agent tools), under a single parent, AML.T0115 (Publish Poisoned AI Artifacts), with the artifact class recorded by sub-technique. Those three ids are retired upstream; entries carrying them here were re-keyed and declare a `supersedes` field so an operator holding older data can still join the two. Release 2026.08 generalized AML.T0072, AML.T0075 and AML.T0089 and renamed tactic AML.TA0001. Release 2026.09 updated AML.T0054 (LLM Jailbreak) and added techniques this subset does not carry. This curated subset holds 174 techniques and intentionally trails the full matrix. framework_gap: no framework has a control that addresses this TTP. secure_ai_v2_layer flags entries included in the CTID Secure AI v2 layered set (May 2026); maturity reflects CTID's technique-maturity classification (low / moderate / high).",
     "tlp": "CLEAR",
@@ -25,31 +25,23 @@
   },
   "AML.T0001": {
     "id": "AML.T0001",
-    "name": "Victim Research",
+    "name": "Search Open AI Vulnerability Analysis",
     "tactic": "Reconnaissance",
-    "description": "Adversary gathers information about the victim's ML systems before active engagement — public-facing model endpoints, published research papers describing the system's architecture, model cards on HuggingFace, leaked system prompts, vendor disclosure of which foundation models power user-facing AI products. For AI-augmented developer environments: enumeration of installed MCP servers, AI-coding-assistant configuration files, and IDE-side extension manifests visible through error messages or public Git history.",
-    "subtechniques": [
-      "AML.T0001.000 — Search Application Repositories (HuggingFace, model cards, GitHub model commits)",
-      "AML.T0001.001 — Search Research Papers (academic publications detailing model architecture)",
-      "AML.T0001.002 — Vendor / Provider Disclosures (which AI foundation models power named products)",
-      "AML.T0001.003 — Public AI System Probing (enumerating exposed AI APIs without active payload)"
-    ],
-    "real_world_instances": [
-      "PROMPTSTEAL preparatory phase — adversary mapped victim's RAG corpus structure via public research papers before launching extraction",
-      "CVE-2026-30615 reconnaissance — public Windsurf marketplace pages enabled identification of vulnerable MCP server versions across deployments"
-    ],
+    "description": "Adversary reviews published research on the vulnerabilities of the model class a target uses, including academic papers that describe successful attacks and public implementations of those attacks, before engaging the target. In AI-augmented developer environments the same research covers public advisories and proof-of-concept code for the MCP servers, coding assistants and IDE extensions the target is known to run.",
+    "subtechniques": [],
+    "real_world_instances": [],
     "framework_gap": true,
-    "framework_gap_detail": "No framework requires AI-asset visibility hygiene as a control. NIST 800-53 PM-15 (information sharing) and AC-22 (publicly accessible content) do not contemplate AI-system-specific reconnaissance signal. No framework requires monitoring of model-card / HuggingFace / public-AI-API surface for adversary reconnaissance indicators (anomalous model-card view patterns, public-endpoint enumeration sweeps).",
+    "framework_gap_detail": "No framework requires tracking published attack research against the model families and AI tools an organization deploys. NIST 800-53 PM-15 (security groups and associations) and PM-16 (threat awareness program) do not name AI-model vulnerability research as an input, so a new public attack implementation against a deployed model family does not trigger a risk reassessment.",
     "controls_that_partially_help": [
-      "NIST-800-53-AC-22",
-      "NIST-800-53-PM-15"
+      "NIST-800-53-PM-15",
+      "NIST-800-53-PM-16"
     ],
     "controls_that_dont_help": [
       "ISO-27001-2022-A.8.28"
     ],
-    "detection": "Public-facing AI endpoint scan-pattern monitoring; HuggingFace / model-repository view-pattern anomaly detection where attribution is possible; public-research-paper citation tracking for victim-named systems; honeytoken model cards seeded in public registries for victim attribution.",
+    "detection": "The research happens on public sources and does not touch the target, so it cannot be detected directly. Track new attack research and public proof-of-concept code against the model families and AI tools in the inventory, and treat a new public implementation as a trigger to reassess exposure.",
     "exceptd_skills": [],
-    "last_verified": "2026-05-19",
+    "last_verified": "2026-09-22",
     "description_full": "Much like the [Search Open Technical Databases](/techniques/AML.T0000), there is often ample research available on the vulnerabilities of common AI models. Once a target has been identified, an adversary will likely try to identify any pre-existing work that has been done for this class of models. This will include not only reading academic papers that may identify the particulars of a successful attack, but also identifying pre-existing implementations of those attacks. The adversary may obtain [Adversarial AI Attack Implementations](/techniques/AML.T0016.000) or develop their own [Adversarial AI Attacks](/techniques/AML.T0017.000) if necessary.",
     "platforms": [
       "ATLAS"
@@ -60,44 +52,26 @@
   },
   "AML.T0040": {
     "id": "AML.T0040",
-    "name": "Tool / Plugin Compromise",
-    "tactic": "Execution",
-    "description": "Adversary compromises an LLM tool-call surface or agent plugin layer — for example an MCP server, a tool registered with an OpenAI Codex / Anthropic Claude Code session, or a Copilot / Cursor agent plugin — to gain code execution within the agent runtime. The compromised tool exposes operator-controlled inputs (filesystem paths, shell commands, API endpoints) that the LLM invokes on behalf of the operator, bypassing the operator-side trust boundary.",
-    "subtechniques": [
-      "AML.T0040.000 — MCP server typosquat / registry compromise",
-      "AML.T0040.001 — Agent plugin authorization bypass via prompt-injection-induced consent",
-      "AML.T0040.002 — Stdio-transport command injection (Anthropic MCP SDK class)"
-    ],
-    "real_world_instances": [
-      "CVE-2026-30623 (Anthropic MCP SDK stdio command-injection class — 30+ MCP servers affected)",
-      "Pwn2Own Berlin 2026 — Viettel Cyber Security Claude Code collision (MCP-class bug)",
-      "Pwn2Own Berlin 2026 — STARLabs SG five-bug LM Studio chain",
-      "Pwn2Own Berlin 2026 — Compass Security OpenAI Codex CWE-150 chain"
-    ],
+    "name": "AI Model Inference API Access",
+    "tactic": "AI Model Access",
+    "description": "Adversary uses legitimate access to a model's inference API, such as a paid account, a free tier, or a leaked or stolen API key, to learn about the model, stage attacks against it, or feed it data. Many applications share the same hosted foundation models, so a jailbreak or other weakness the adversary finds through one account applies to every application built on that model.",
+    "subtechniques": [],
+    "real_world_instances": [],
     "framework_gap": true,
-    "framework_gap_detail": "No framework currently models the agent-runtime tool-call trust boundary. NIST 800-53 CM-7 (Least Functionality) was designed for OS-level execution allowlisting, not for AI-agent tool registries. ISO 27001:2022 A.5.20 (Information security in supplier relationships) does not reach plugin-level supplier identity in the agent runtime. The MCP-server-registry surface is closest analogue to a package registry; supply-chain controls (SLSA, sigstore) are not yet applied to MCP registries operationally.",
+    "framework_gap_detail": "Frameworks treat an authenticated inference API call as authorized use. NIST 800-53 AC-3 (access enforcement) and SI-4 (system monitoring) do not require a per-identity baseline of inference query volume and shape, so reconnaissance and attack staging through a valid key look like ordinary product use.",
     "controls_that_partially_help": [
-      "NIST-800-53-CM-7",
-      "NIST-800-53-AC-3",
-      "ISO-27001-2022-A.8.30"
+      "NIST-800-53-SI-4",
+      "NIST-800-53-AC-3"
     ],
     "controls_that_dont_help": [
-      "Traditional WAF / API gateway controls — agent-side calls bypass these by design",
-      "OS-level antimalware — the agent runtime invokes the tool inside its own process trust boundary"
-    ],
-    "detection": "MCP-server inventory + signature attestation; tool-call audit logs reviewed for typosquat patterns; agent-side outbound API call monitoring for credential exfiltration patterns; plugin-installation event correlation with prompt-injection IOCs.",
-    "exceptd_skills": [
-      "sector-telecom"
+      "Traditional WAF / API gateway controls: the adversary's calls are authenticated and well formed"
     ],
+    "detection": "Per-identity baselines of inference query volume, diversity and timing; alerts on query patterns that enumerate output classes, probe guardrails or repeat near-identical adversarial inputs; key-leak monitoring for inference API credentials.",
+    "exceptd_skills": [],
     "secure_ai_v2_layer": true,
     "maturity": "high",
-    "last_verified": "2026-05-19",
-    "cve_refs": [
-      "CVE-2025-68664",
-      "CVE-2025-68665",
-      "CVE-2026-30623",
-      "CVE-2026-42945"
-    ],
+    "last_verified": "2026-09-22",
+    "cve_refs": [],
     "description_full": "Adversaries may gain access to a model via legitimate access to the inference API. Inference API access can be a source of information to the adversary ([Discover AI Model Ontology](/techniques/AML.T0013), [Discover AI Model Family](/techniques/AML.T0014)), a means of staging the attack ([Verify Attack](/techniques/AML.T0042), [Craft Adversarial Data](/techniques/AML.T0043)), or for introducing data to the target system for Impact ([Evade AI Model](/techniques/AML.T0015), [Erode AI Model Integrity](/techniques/AML.T0031)). Many systems rely on the same models provided via an inference API, which means they share the same vulnerabilities. This is especially true of foundation models which are prohibitively resource intensive to train. Adversaries may use their access to model APIs to identify vulnerabilities such as jailbreaks or hallucinations and then target applications that use the same models.",
     "platforms": [
       "ATLAS"
@@ -112,10 +86,12 @@
     "tactic": "Initial Access",
     "description": "Adversary compromises the AI supply chain — pretrained models, datasets, training infrastructure, or AI tool plugins — to inject backdoors or malicious behavior before the model reaches the target organization.",
     "subtechniques": [
-      "AML.T0010.000 — GPU Firmware Compromise",
-      "AML.T0010.001 — ML Framework Compromise (PyTorch, TensorFlow)",
-      "AML.T0010.002 — Model Repository Compromise (HuggingFace typosquatting)",
-      "AML.T0010.003 — MCP Server Supply Chain (developer AI tool plugin)"
+      "AML.T0010.000",
+      "AML.T0010.001",
+      "AML.T0010.002",
+      "AML.T0010.003",
+      "AML.T0010.004",
+      "AML.T0010.005"
     ],
     "real_world_instances": [
       "CVE-2026-30615 — Windsurf MCP zero-interaction RCE via supply chain"
@@ -138,6 +114,7 @@
       "mcp-agent-trust",
       "mlops-security",
       "ot-ics-security",
+      "sector-telecom",
       "supply-chain-integrity"
     ],
     "secure_ai_v2_layer": true,
@@ -186,35 +163,34 @@
   },
   "AML.T0016": {
     "id": "AML.T0016",
-    "name": "Obtain Capabilities: Develop Capabilities",
+    "name": "Obtain Capabilities",
     "tactic": "Resource Development",
-    "description": "Adversary develops custom AI capabilities — fine-tuned models, adversarial attack toolkits, automated prompt injection frameworks — to conduct AI-specific attacks at scale.",
+    "description": "Adversary obtains existing capabilities instead of building them: public implementations of adversarial AI attacks, general software tools, exploits, AI agent tools, or access to generative AI models and services that write phishing content, malware or evasion code on request. The adversary may modify or customize what it obtains for a particular target.",
     "subtechniques": [
-      "AML.T0016.000 — Develop AI Attack Toolkit",
-      "AML.T0016.001 — Fine-tune Model for Offensive Use",
-      "AML.T0016.002 — Automated Prompt Injection Framework"
+      "AML.T0016.000",
+      "AML.T0016.001",
+      "AML.T0016.002",
+      "AML.T0016.003",
+      "AML.T0016.004"
     ],
     "real_world_instances": [
-      "PROMPTFLUX — LLM-querying malware for real-time evasion code generation"
+      "PROMPTFLUX: malware that queries a public LLM API at run time for new evasion code"
     ],
     "framework_gap": true,
-    "framework_gap_detail": "No framework has a control for adversary development of AI attack capabilities. Threat intelligence programs (PM-16) do not have AI-specific threat actor capability tracking. No framework requires monitoring of offensive AI research for TTP evolution.",
+    "framework_gap_detail": "No framework has a control for tracking the offensive capabilities an adversary can obtain, including public attack implementations against deployed model families and generative AI services that produce payloads on request. Threat intelligence programs (PM-16) do not track AI-specific capability availability.",
     "controls_that_partially_help": [
       "NIST-800-53-PM-16"
     ],
     "controls_that_dont_help": [],
-    "detection": "Threat intelligence feeds tracking offensive AI research; monitoring for AI-generated exploit code in underground forums",
+    "detection": "Threat intelligence tracking of public adversarial-AI attack tooling and of malware families that call generative AI APIs; egress monitoring for generative AI API calls from processes with no business reason to make them.",
     "exceptd_skills": [
       "ai-attack-surface",
-      "mcp-agent-trust"
+      "ai-c2-detection"
     ],
     "secure_ai_v2_layer": true,
     "maturity": "moderate",
-    "last_verified": "2026-05-19",
-    "cve_refs": [
-      "CVE-2023-43472",
-      "CVE-2026-30615"
-    ],
+    "last_verified": "2026-09-22",
+    "cve_refs": [],
     "description_full": "Adversaries may search for and obtain software capabilities for use in their operations. Capabilities may be specific to AI-based attacks [Adversarial AI Attack Implementations](/techniques/AML.T0016.000) or generic software tools repurposed for malicious intent ([Software Tools](/techniques/AML.T0016.001)). In both instances, an adversary may modify or customize the capability to aid in targeting a particular AI-enabled system.",
     "platforms": [
       "ATLAS"
@@ -225,42 +201,31 @@
   },
   "AML.T0017": {
     "id": "AML.T0017",
-    "name": "Discover ML Model Ontology",
-    "tactic": "Discovery",
-    "description": "Adversary queries an ML system to learn its output classes, decision logic, and behavior — enabling more effective evasion, prompt injection, or targeted adversarial example generation. For LLMs: systematic probing to learn system prompt content, output filters, or safety guardrails.",
+    "name": "Develop Capabilities",
+    "tactic": "Resource Development",
+    "description": "Adversary develops its own capabilities for an operation: adversarial AI attacks, fine-tuned models, automated prompt injection frameworks, malicious AI agent tools, malware and software exploits. Autonomous AI agents now carry part of this work, iterating on exploit methods for known and previously unknown vulnerabilities much faster than human-speed development.",
     "subtechniques": [
-      "AML.T0017.000 — Probe Model Capabilities",
-      "AML.T0017.001 — Extract System Prompt",
-      "AML.T0017.002 — Map Output Filters and Guardrails"
-    ],
-    "real_world_instances": [
-      "PROMPTSTEAL — systematic LLM querying for system prompt extraction and knowledge base fingerprinting"
+      "AML.T0017.000",
+      "AML.T0017.001",
+      "AML.T0017.002"
     ],
+    "real_world_instances": [],
     "framework_gap": true,
-    "framework_gap_detail": "No framework requires rate limiting on AI API queries from a discovery perspective. AI API query logging (SI-4) is not required by any framework. Behavioral anomaly detection for AI API probe patterns is absent from all control sets.",
+    "framework_gap_detail": "No framework has a control for adversary development of AI attack capabilities. Threat intelligence programs (PM-16) do not track AI-specific capability development, and patch windows sized for human-speed exploit development do not account for AI-assisted development.",
     "controls_that_partially_help": [
-      "NIST-800-53-SI-4",
-      "NIST-800-53-AC-17"
-    ],
-    "controls_that_dont_help": [
-      "ISO-27001-2022-A.8.28"
+      "NIST-800-53-PM-16"
     ],
-    "detection": "AI API query rate monitoring; semantic similarity clustering of queries (probe pattern detection); alert on high query volume from single identity",
+    "controls_that_dont_help": [],
+    "detection": "Development happens on adversary infrastructure and cannot be observed directly. Track threat intelligence on AI-assisted exploit development, and shorten patch windows for vulnerabilities with public or AI-generated exploits.",
     "exceptd_skills": [
       "ai-attack-surface",
-      "ai-c2-detection",
       "ai-risk-management",
-      "api-security",
       "cloud-security",
-      "dlp-gap-analysis",
-      "incident-response-playbook",
-      "mlops-security",
-      "sector-financial",
       "sector-healthcare"
     ],
     "secure_ai_v2_layer": true,
     "maturity": "high",
-    "last_verified": "2026-05-19",
+    "last_verified": "2026-09-22",
     "description_full": "Adversaries may develop their own capabilities to support operations. This process encompasses identifying requirements, building solutions, and deploying capabilities. Capabilities used to support attacks on AI-enabled systems are not necessarily AI-based themselves. Examples include setting up websites with adversarial information or creating Jupyter notebooks with obfuscated exfiltration code.",
     "platforms": [
       "ATLAS"
@@ -275,9 +240,10 @@
     "tactic": "Persistence",
     "description": "Adversaries may manipulate an AI model artifact or its bundled components to change AI system behavior, introduce malicious code, or establish persistent malicious functionality. This may include modifying model weights, model architecture, or prompt-construction logic. Manipulated artifacts may retain expected behavior under ordinary conditions while activating malicious behavior only for selected inputs, contexts, or deployment conditions.",
     "subtechniques": [
-      "AML.T0018.000 — Poison Training Data (data poisoning)",
-      "AML.T0018.001 — Trojan Model (direct weight manipulation)",
-      "AML.T0018.002 — Federated Learning Poisoning"
+      "AML.T0018.000",
+      "AML.T0018.001",
+      "AML.T0018.002",
+      "AML.T0018.003"
     ],
     "real_world_instances": [
       "HuggingFace model repository — researcher demonstrations of trojaned models that pass standard eval"
@@ -315,13 +281,9 @@
   "AML.T0020": {
     "id": "AML.T0020",
     "name": "Training Data Poisoning",
-    "tactic": "ML Attack Staging",
+    "tactic": "Persistence",
     "description": "Adversary injects malicious examples into training data to degrade model performance, introduce backdoors, or bias outputs toward attacker-controlled behaviors. For RAG systems: adversary injects malicious content into the knowledge base.",
-    "subtechniques": [
-      "AML.T0020.000 — Inject Training Data at Scale",
-      "AML.T0020.001 — Craft Targeted Poisoned Samples",
-      "AML.T0020.002 — RAG Knowledge Base Poisoning (inject into retrieval corpus)"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "RAG pipeline attacks — injecting poisoned documents that redirect retrieval and cause model to output attacker content"
     ],
@@ -362,9 +324,9 @@
     "tactic": "Exfiltration",
     "description": "Adversary uses an AI inference API as the exfiltration channel for stolen data — embedding sensitive content in prompts, retrieval queries, or function-call arguments and reconstructing it from responses, logs, or training feedback. Distinguished from classical exfiltration by the channel being a categorically-trusted AI endpoint that egress controls do not flag.",
     "subtechniques": [
-      "AML.T0024.000 — Prompt-as-Exfil (embed secret in user-facing prompt to public LLM)",
-      "AML.T0024.001 — Retrieval-as-Exfil (poisoned RAG corpus reads attacker-controlled documents that include exfil instructions)",
-      "AML.T0024.002 — Tool-Call-as-Exfil (MCP tool argument or function-call parameter carries the payload)"
+      "AML.T0024.000",
+      "AML.T0024.001",
+      "AML.T0024.002"
     ],
     "real_world_instances": [
       "RAG exfiltration: attacker-injected document instructs the model to summarize org secrets into a follow-up query that hits an external endpoint",
@@ -382,7 +344,10 @@
       "PCI-DSS-v4-A1"
     ],
     "detection": "Content-aware DLP applied to outbound AI prompts and tool arguments; per-prompt secret-pattern scan before egress; behavioral baseline of typical prompt entropy + length per user; alert on unusual completion-response sizes correlated with sensitive-file reads",
-    "exceptd_skills": [],
+    "exceptd_skills": [
+      "dlp-gap-analysis",
+      "incident-response-playbook"
+    ],
     "secure_ai_v2_layer": true,
     "maturity": "high",
     "last_verified": "2026-09-09",
@@ -403,12 +368,14 @@
   "AML.T0043": {
     "id": "AML.T0043",
     "name": "Craft Adversarial Data",
-    "tactic": "ML Attack Staging",
+    "tactic": "AI Attack Adaptation",
     "description": "Adversary crafts input data designed to cause a target ML model to produce incorrect outputs. Includes perturbation-based adversarial examples that are visually identical to originals but trigger misclassification.",
     "subtechniques": [
-      "AML.T0043.000 — White-Box Attack (adversary has model access)",
-      "AML.T0043.001 — Black-Box Attack (transfer-based, query-based)",
-      "AML.T0043.002 — Physical Attack (adversarial patch, stop sign perturbation)"
+      "AML.T0043.000",
+      "AML.T0043.001",
+      "AML.T0043.002",
+      "AML.T0043.003",
+      "AML.T0043.004"
     ],
     "real_world_instances": [
       "Deepfake bypass of facial recognition",
@@ -446,13 +413,9 @@
   "AML.T0044": {
     "id": "AML.T0044",
     "name": "Full AI Model Access",
-    "tactic": "Collection",
+    "tactic": "AI Model Access",
     "description": "Adversary obtains complete read access to a deployed AI model — weights, architecture, tokenizer, training-data fingerprints — enabling offline adversarial-example crafting, distillation into a smaller offensive model, or extraction of memorized training data containing sensitive content.",
-    "subtechniques": [
-      "AML.T0044.000 — Model File Theft (read access to weights on disk / object storage)",
-      "AML.T0044.001 — Model Extraction via Query (reconstruct equivalent model from API responses)",
-      "AML.T0044.002 — Training Pipeline Compromise (snapshot weights mid-training)"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "Cloud-bucket misconfigurations exposing fine-tuned model weights",
       "Production query-budget abuse for model-distillation attacks against commercial LLM APIs"
@@ -482,37 +445,27 @@
   },
   "AML.T0048": {
     "id": "AML.T0048",
-    "name": "Erode ML Model Integrity",
+    "name": "External Harms",
     "tactic": "Impact",
-    "description": "Adversary causes gradual degradation of ML model output quality through sustained low-rate adversarial inputs, feedback-loop poisoning, RAG-corpus drift, or systematic query patterns that bias the model's behavior over time. Distinguished from acute poisoning (T0020) by the operational tempo: erosion is slow enough to evade output-monitoring thresholds while accumulating into a meaningful integrity loss.",
+    "description": "Adversary uses access to an AI system to cause harm outside it: financial loss, reputational damage, harm to the system's users, harm to the public, or theft of the organization's AI intellectual property. The harm follows from what the system is made to do, such as issuing fraudulent transactions, publishing harmful content or releasing user data, rather than from damage to the system itself.",
     "subtechniques": [
-      "AML.T0048.000 — Feedback-Loop Erosion (poison reinforcement signal at low rate)",
-      "AML.T0048.001 — Corpus-Drift Erosion (continuously inject low-quality documents into RAG retrieval set)",
-      "AML.T0048.002 — Query-Pattern Erosion (systematic prompts that shift output distribution)"
-    ],
-    "real_world_instances": [
-      "CVE-2026-45321 — RAG/agentic-coding corpus erosion enabling staged supply-chain attacks",
-      "Adversarial query campaigns against production recommendation systems documented in 2025-2026 incident reports"
+      "AML.T0048.000",
+      "AML.T0048.001",
+      "AML.T0048.002",
+      "AML.T0048.003",
+      "AML.T0048.004"
     ],
+    "real_world_instances": [],
     "framework_gap": true,
-    "framework_gap_detail": "Continuous-integrity monitoring on ML output distributions is not a framework control. SI-7 software/firmware integrity addresses code artifacts not model behavior. No framework requires drift detection against a known-good model baseline. NIST AI RMF MEASURE-2.7 recommends but does not require continuous adversarial robustness assessment.",
-    "controls_that_partially_help": [
-      "NIST-800-53-SI-7",
-      "NIST-AI-RMF-MEASURE-2.7"
-    ],
-    "controls_that_dont_help": [
-      "ISO-27001-2022-A.8.28",
-      "SOC2-CC7"
-    ],
-    "detection": "Statistical drift detection on output distribution; periodic golden-test-set regression scoring; user-feedback anomaly mining for unusual complaint clusters",
+    "framework_gap_detail": "No security framework requires tracing a compromised AI system's actions and outputs to the external harms they cause. AI risk management frameworks such as NIST AI RMF MAP 5 ask for impact assessment before deployment, not for monitoring the harm a system causes while an adversary controls it.",
+    "controls_that_partially_help": [],
+    "controls_that_dont_help": [],
+    "detection": "Monitor the downstream effects of AI system actions: transactions, published content, messages sent to users and data released. Route complaints and fraud reports that trace back to an AI feature into security triage.",
     "exceptd_skills": [],
     "secure_ai_v2_layer": true,
     "maturity": "moderate",
-    "last_verified": "2026-05-19",
-    "cve_refs": [
-      "CVE-2026-22778",
-      "CVE-2026-45321"
-    ],
+    "last_verified": "2026-09-22",
+    "cve_refs": [],
     "description_full": "Adversaries may abuse their access to a victim system and use its resources or capabilities to further their goals by causing harms external to that system. These harms could affect the organization (e.g. Financial Harm, Reputational Harm), its users (e.g. User Harm), or the general public (e.g. Societal Harm).",
     "platforms": [
       "ATLAS"
@@ -527,9 +480,9 @@
     "tactic": "Execution",
     "description": "Adversary injects instructions into an LLM's input that override, supplement, or contradict the original system prompt, causing the model to execute attacker-controlled instructions within the application's authorization context.",
     "subtechniques": [
-      "AML.T0051.000 — Direct Prompt Injection (user-facing input)",
-      "AML.T0051.001 — Indirect Prompt Injection (injected via retrieved content, documents, web pages)",
-      "AML.T0051.002 — Jailbreak (override safety guardrails)"
+      "AML.T0051.000",
+      "AML.T0051.001",
+      "AML.T0051.002"
     ],
     "real_world_instances": [
       "CVE-2025-53773 — GitHub Copilot prompt injection RCE via PR description",
@@ -586,33 +539,30 @@
   },
   "AML.T0053": {
     "id": "AML.T0053",
-    "name": "LLM Plugin Compromise",
+    "name": "AI Agent Tool Invocation",
     "tactic": "Execution",
-    "description": "Adversary compromises an LLM plugin / tool / MCP server registered with a host AI assistant, gaining the ability to execute attacker-controlled actions in the host's authorization context whenever the model invokes the plugin. Distinguished from supply-chain compromise (T0010) by targeting the runtime trust relationship between an installed plugin and the host AI rather than the install pathway.",
-    "subtechniques": [
-      "AML.T0053.000 — Malicious Plugin Publish (publish under typosquat or compromised account)",
-      "AML.T0053.001 — Plugin Update Backdoor (push backdoor in a version update after publisher trust is established)",
-      "AML.T0053.002 — Plugin-to-Plugin Pivot (compromised plugin instructs the model to invoke another plugin with attacker-chosen arguments)"
-    ],
+    "description": "Adversary uses access to an AI agent, typically through prompt injection or a compromised account, to make the agent invoke the tools it is connected to: application integrations, data sources, and code or shell execution. The calls run with the agent's permissions, which can exceed the adversary's own, and can reach tools the user cannot call directly.",
+    "subtechniques": [],
     "real_world_instances": [
-      "CVE-2026-30615 — Windsurf MCP zero-interaction RCE via plugin trust",
-      "Public MCP-registry typosquat campaigns documented 2025-2026"
+      "CVE-2026-39884: an AI assistant calls the port_forward tool of mcp-server-kubernetes with an injected flag, and the server passes it to kubectl as a separate argument",
+      "CVE-2026-59822: LiteLLM's MCP endpoint accepted a fabricated Authorization header, so unauthenticated requests reached MCP tooling"
     ],
     "framework_gap": true,
-    "framework_gap_detail": "No framework has a plugin-trust control specifically for LLM/agent tool registries. SA-12 supply chain protections do not contemplate model-invoked plugin runtimes. AC-3 access enforcement does not address the model-as-authorization-proxy pattern where the user's identity authenticates the model but the model chooses which plugin to invoke and with what arguments.",
+    "framework_gap_detail": "AC-3 access enforcement authorizes the user who reaches the agent, but the model chooses which tool to call and with what arguments, so the effective permission is the agent's. No framework requires per-tool authorization of model-chosen calls or confirmation before high-impact tool actions, and SI-10 input validation checks the prompt rather than the arguments the model builds from it.",
     "controls_that_partially_help": [
-      "NIST-800-53-SA-12",
       "NIST-800-53-AC-3",
-      "ISO-27001-2022-A.8.30"
+      "NIST-800-53-SI-10"
     ],
     "controls_that_dont_help": [
       "NIST-800-53-SI-3"
     ],
-    "detection": "Plugin-manifest signature verification; plugin-call audit trail (model decision + plugin name + arguments + result); plugin reputation scoring; alert on newly-installed plugin invocations during the first 72h",
-    "exceptd_skills": [],
+    "detection": "A tool-call audit trail recording the model's decision, the tool name, its arguments and its result; alerts on tool arguments that carry shell metacharacters, extra flags or out-of-scope resource names; human confirmation before destructive or externally visible tool actions.",
+    "exceptd_skills": [
+      "mcp-agent-trust"
+    ],
     "secure_ai_v2_layer": true,
     "maturity": "high",
-    "last_verified": "2026-05-19",
+    "last_verified": "2026-09-22",
     "cve_refs": [
       "CVE-2026-39884",
       "CVE-2026-59822"
@@ -630,11 +580,7 @@
     "name": "LLM Jailbreak",
     "tactic": "Defense Evasion",
     "description": "Adversary uses prompt manipulation techniques to bypass an LLM's safety guardrails, causing the model to produce content or take actions it would normally refuse. Distinguished from prompt injection by the goal: jailbreaks evade safety filters rather than execute injected code.",
-    "subtechniques": [
-      "AML.T0054.000 — Role-play Jailbreak (DAN, persona attacks)",
-      "AML.T0054.001 — Obfuscation (base64, leetspeak, encoding tricks)",
-      "AML.T0054.002 — Many-Shot Jailbreak (long context pattern establishment)"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "Production AI assistant jailbreaks enabling policy bypass; AI coding assistant jailbreaks producing malware code"
     ],
@@ -671,11 +617,7 @@
     "name": "Unsecured Credentials",
     "tactic": "Credential Access",
     "description": "Adversary obtains credentials — API keys, OAuth tokens, model-provider secrets, MCP server tokens, fine-tuning service credentials — that were stored in cleartext, exposed in logs, embedded in code, or persisted in checked-in configuration. Within the AI/ML scope this technique covers credentials specific to the model-development supply chain (HuggingFace tokens, OpenAI API keys, anthropic auth, fine-tuning service keys, vector-DB credentials).",
-    "subtechniques": [
-      "AML.T0055.000 — Credentials in Repository (.env, source, notebook output cells)",
-      "AML.T0055.001 — Credentials in Logs (training logs, inference logs, MCP debug output)",
-      "AML.T0055.002 — Credentials in Model Artifact Metadata (HuggingFace model card, ONNX metadata)"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "Public-repository scans surface thousands of leaked OpenAI/Anthropic/HuggingFace tokens monthly",
       "Notebook cell-output exposure of API keys in published Kaggle/Colab artifacts"
@@ -700,6 +642,8 @@
       "CVE-2024-1561",
       "CVE-2024-4889",
       "CVE-2024-6587",
+      "CVE-2025-68664",
+      "CVE-2025-68665",
       "CVE-2026-42208",
       "CVE-2026-64849",
       "MAL-2026-3083"
@@ -717,12 +661,7 @@
     "name": "LLM Data Leakage",
     "tactic": "Exfiltration",
     "description": "Adversary causes an LLM to disclose information from its training data, retrieval corpus, system prompt, or conversation context that should not have been accessible. Includes training-data memorization recovery, system-prompt extraction, retrieved-document leakage to the wrong tenant, and cross-conversation context bleed.",
-    "subtechniques": [
-      "AML.T0057.000 — Memorization Recovery (extract memorized training records via crafted prompts)",
-      "AML.T0057.001 — System Prompt Leakage (induce the model to reveal its hidden instructions)",
-      "AML.T0057.002 — Retrieval Tenant Bleed (RAG returns documents from a different tenant)",
-      "AML.T0057.003 — Cross-Conversation Bleed (KV-cache or session-state confusion across requests)"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "Production AI assistant prompt-extraction incidents 2025-2026",
       "Public LLM training-data memorization studies (NYT v. OpenAI, Carlini et al. extraction works)"
@@ -753,17 +692,12 @@
   },
   "AML.T0096": {
     "id": "AML.T0096",
-    "name": "AI API as Covert C2 Channel",
+    "name": "AI Service API",
     "tactic": "Command and Control",
-    "description": "Adversary uses legitimate AI API calls as a covert command-and-control channel. Malware encodes commands in AI API requests and receives instructions via model responses. Traffic is indistinguishable from legitimate AI usage — same endpoints, same TLS, same bearer auth patterns.",
-    "subtechniques": [
-      "AML.T0096.000 — Steganographic encoding in AI prompts",
-      "AML.T0096.001 — LLM response as instruction decoder",
-      "AML.T0096.002 — Multi-agent covert relay"
-    ],
+    "description": "Adversary uses the API of an AI service on the victim's system as a command-and-control channel. Malware embeds commands in AI API requests and receives instructions in model responses, and the traffic uses the same endpoints, TLS and bearer authentication as legitimate AI use.",
+    "subtechniques": [],
     "real_world_instances": [
-      "SesameOp — first documented AI API C2 campaign, 2025. Malware beacons to OpenAI API for encoded instructions.",
-      "PROMPTFLUX — LLM C2 for real-time evasion code generation: malware queries public LLM APIs for novel AV evasion code on each execution."
+      "SesameOp — first documented AI API C2 campaign, 2025. Malware beacons to OpenAI API for encoded instructions."
     ],
     "framework_gap": true,
     "framework_gap_detail": "Network egress controls (SC-7) do not flag AI API traffic — it is categorically allowed in most organizations. No framework requires monitoring of AI API traffic content. SIEM signatures for AI API C2 patterns do not exist in any standard detection ruleset. SI-3 (malware protection) does not contemplate LLM-querying malware. No framework has a control for AI API query anomaly detection by process identity.",
@@ -788,7 +722,7 @@
     ],
     "secure_ai_v2_layer": true,
     "maturity": "high",
-    "last_verified": "2026-05-19",
+    "last_verified": "2026-09-22",
     "cve_refs": [
       "CVE-2026-30615"
     ],
@@ -805,10 +739,7 @@
     "name": "Virtualization/Sandbox Evasion",
     "tactic": "Defense Evasion",
     "description": "Adversary uses LLM-driven reasoning to detect that a generated payload is being executed inside an analysis sandbox or virtualization layer and alters behavior to evade dynamic analysis. The LLM is queried for environment-fingerprint signals (process tree, hypervisor markers, timing artifacts) at runtime; if a sandbox is suspected, the payload diverges from the path observed during sandbox detonation.",
-    "subtechniques": [
-      "AML.T0097.000 — Sandbox fingerprinting via LLM reasoning",
-      "AML.T0097.001 — Conditional payload bifurcation based on LLM verdict"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "Adversary research samples 2026 — malware queries hosted LLM to classify the runtime environment before deciding which branch to execute"
     ],
@@ -839,11 +770,7 @@
     "name": "AI Agent Tool Credential Harvesting",
     "tactic": "Credential Access",
     "description": "Adversary instructs a compromised or attacker-controlled AI agent to enumerate and exfiltrate credentials held by the agent runtime — environment variables, mounted secret files, credential stores accessible via registered tools, and API keys passed via tool arguments. The agent has legitimate read access; the abuse is in the redirection of what the agent reads for.",
-    "subtechniques": [
-      "AML.T0098.000 — Env-var harvesting via agent shell tool",
-      "AML.T0098.001 — Cloud-metadata harvesting via agent HTTP tool",
-      "AML.T0098.002 — Vault / secret-manager harvesting via authorized agent identity"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "Indirect-prompt-injection campaigns 2026 — attacker-controlled web content instructs the agent to dump $env and POST to attacker endpoint"
     ],
@@ -872,12 +799,9 @@
   "AML.T0099": {
     "id": "AML.T0099",
     "name": "AI Agent Tool Data Poisoning",
-    "tactic": "Impact",
+    "tactic": "Persistence",
     "description": "Adversary uses an AI agent's authorized tool access to corrupt downstream data the agent is responsible for maintaining — knowledge base entries, vector embeddings, CRM records, ticketing fields, configuration objects — by inducing the agent (via prompt injection or task manipulation) to issue write operations that degrade data integrity at scale.",
-    "subtechniques": [
-      "AML.T0099.000 — RAG corpus poisoning via agent write-tool",
-      "AML.T0099.001 — Structured datastore poisoning via agent CRUD tool"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "Production RAG-agent incidents 2026 — agent instructed via injected document to overwrite knowledge base entries"
     ],
@@ -906,12 +830,9 @@
   "AML.T0100": {
     "id": "AML.T0100",
     "name": "AI Agent Clickbait",
-    "tactic": "Initial Access",
+    "tactic": "Execution",
     "description": "Adversary publishes content (web pages, marketplace listings, GitHub repos, package descriptions) crafted to be highly attractive to AI agents performing web search or supply-chain discovery — engineered to rank well in agent retrieval and to embed indirect prompt-injection payloads that fire when the agent ingests the content.",
-    "subtechniques": [
-      "AML.T0100.000 — Search-ranked indirect prompt injection page",
-      "AML.T0100.001 — Marketplace / registry typosquat with injected description"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "MCP and npm registry typosquat campaigns 2026 — package descriptions tuned for agent-driven discovery"
     ],
@@ -941,10 +862,7 @@
     "name": "Data Destruction via AI Agent Tool Invocation",
     "tactic": "Impact",
     "description": "Adversary causes an AI agent to invoke destructive tools — file deletion, repository purge, database drop, cloud-resource teardown — within its authorized scope. Distinguished from T0099 (poisoning) by goal: irreversible loss rather than corruption.",
-    "subtechniques": [
-      "AML.T0101.000 — Repository purge via agent git-tool",
-      "AML.T0101.001 — Cloud-resource teardown via agent IaC tool"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "Production agent incidents 2026 — injected instructions caused agent to drop staging tables believing it was a sanctioned cleanup task"
     ],
@@ -973,12 +891,9 @@
   "AML.T0102": {
     "id": "AML.T0102",
     "name": "Generate Malicious Commands",
-    "tactic": "Execution",
+    "tactic": "AI Attack Adaptation",
     "description": "Adversary uses an LLM (hosted or self-hosted) to generate malicious commands, shell snippets, or program code that the adversary then executes against a target — distinguished from T0050-style LLM-as-interpreter by the adversary, not the model, doing the execution. Covers AI-accelerated exploit development and on-demand evasion code synthesis.",
-    "subtechniques": [
-      "AML.T0102.000 — On-demand evasion code generation (PROMPTFLUX pattern)",
-      "AML.T0102.001 — AI-assisted exploit primitive synthesis"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "PROMPTFLUX — malware queries public LLM API for novel AV evasion code at each execution",
       "Adversary-tooling marketplaces 2026 — LLM-as-a-service tuned for offensive code generation"
@@ -1008,12 +923,9 @@
   "AML.T0103": {
     "id": "AML.T0103",
     "name": "Deploy AI Agent",
-    "tactic": "Persistence",
+    "tactic": "Execution",
     "description": "Adversary deploys an attacker-controlled AI agent into a target environment for sustained, autonomous attack operations — long-horizon credential harvesting, lateral discovery, data staging, opportunistic exploitation. The agent persists across operator sessions and reacts to its own observations without continuous adversary direction.",
-    "subtechniques": [
-      "AML.T0103.000 — Adversary-deployed autonomous agent in compromised cloud tenant",
-      "AML.T0103.001 — Agent persistence via scheduled-task or service-account registration"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "Threat-research demonstrations 2025-2026 of long-running agentic C2 inside compromised cloud accounts"
     ],
@@ -1044,11 +956,7 @@
     "name": "Escape to Host",
     "tactic": "Privilege Escalation",
     "description": "Adversary escapes from an AI workload's confinement boundary — model-serving container, agent sandbox, training-job pod — onto the underlying host. Combines container-escape primitives (T1611) with AI-pipeline-specific privileged-mount patterns (GPU device, model-cache volume, hostPath for training datasets) that commonly weaken sandbox boundaries on AI infrastructure.",
-    "subtechniques": [
-      "AML.T0105.000 — GPU-device passthrough abuse",
-      "AML.T0105.001 — Model-cache hostPath escape",
-      "AML.T0105.002 — Privileged training-job pod escape"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "GPU-passthrough container research 2026 — escape from ML serving container via nvidia device node",
       "Kubeflow / Vertex training pod escape demonstrations"
@@ -1080,10 +988,7 @@
     "name": "Exploitation for Credential Access (AI Pipeline)",
     "tactic": "Credential Access",
     "description": "Adversary exploits a vulnerability in AI-pipeline software (model server, inference framework, agent runtime, MCP server, training scheduler) to obtain credentials held by the workload — service-account tokens, cloud-provider keys, vault credentials, model-registry tokens. ATLAS-scoped analogue of ATT&CK T1212 with AI-pipeline-specific exploit primitives.",
-    "subtechniques": [
-      "AML.T0106.000 — Model-server SSRF to cloud metadata API",
-      "AML.T0106.001 — MCP-server memory-disclosure leaking host secrets"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "CVE-2026-30615 — Windsurf MCP zero-interaction RCE chained to credential read",
       "Triton / vLLM / Ray exploit chains 2025-2026 reaching service-account scope"
@@ -1118,10 +1023,7 @@
     "name": "Exploitation for Defense Evasion (AI Pipeline)",
     "tactic": "Defense Evasion",
     "description": "Adversary exploits AI-pipeline vulnerabilities specifically to bypass detection or instrumentation — disabling telemetry on the inference path, suppressing agent audit trails, evading content-policy filters via inference-server bug. Distinguished from T0054 (jailbreak) by exploiting a software bug rather than guardrail-prompt evasion.",
-    "subtechniques": [
-      "AML.T0107.000 — Inference-server telemetry suppression via crafted request",
-      "AML.T0107.001 — Agent audit-log bypass via prompt-execution race"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "AI gateway bypass research 2026 — crafted requests cause content filter to fail-open while logging records 'allowed'",
       "Audit-trail race-condition disclosures in agent frameworks 2026"
@@ -1151,13 +1053,9 @@
   "AML.T0108": {
     "id": "AML.T0108",
     "name": "AI Agent (as Attacker Asset)",
-    "tactic": "Resource Development",
+    "tactic": "Command and Control",
     "description": "Adversary stands up an AI agent as part of the offensive toolchain — autonomous reconnaissance, exploit chaining, lateral movement planning, deepfake / vishing scripting. The agent is the attacker asset; targets see the agent's actions, not the human operator's keystrokes. Underpins agentic C2 (T0096) and AI-accelerated exploit development (T0102).",
-    "subtechniques": [
-      "AML.T0108.000 — Offensive recon agent",
-      "AML.T0108.001 — Offensive exploit-chaining agent",
-      "AML.T0108.002 — Offensive social-engineering agent"
-    ],
+    "subtechniques": [],
     "real_world_instances": [
       "PROMPTFLUX, PROMPTSTEAL — first-generation offensive agent samples in the wild",
       "41% of 2025 zero-days were AI-discovered; AI-assisted exploit development is operational reality"
@@ -1218,8 +1116,8 @@
   "AML.T0007": {
     "id": "AML.T0007",
     "name": "Discover AI Artifacts",
-    "tactic": "Reconnaissance",
-    "description": "Adversary enumerates ML artifacts available locally or remotely after gaining initial access — model files, training datasets, model registries, tokenizer files, configuration. Distinct from AML.T0001 (Victim Research, pre-access) — this is post-access enumeration of the ML attack surface to plan downstream actions like poisoning, theft, or evasion.",
+    "tactic": "Discovery",
+    "description": "Adversary enumerates ML artifacts available locally or remotely after gaining initial access — model files, training datasets, model registries, tokenizer files, configuration. Distinct from pre-access reconnaissance such as AML.T0000 (Search Open Technical Databases) — this is post-access enumeration of the ML attack surface to plan downstream actions like poisoning, theft, or evasion.",
     "subtechniques": [],
     "real_world_instances": [],
     "framework_gap": true,
@@ -1243,7 +1141,7 @@
   "AML.T0011": {
     "id": "AML.T0011",
     "name": "User Execution",
-    "tactic": "Initial Access",
+    "tactic": "Execution",
     "description": "Adversary relies on a user to execute malicious ML artifacts — a poisoned model, a malicious pickle file, a typosquatted ML library — to gain code execution in the user context. Bridges traditional supply-chain TTPs into the ML domain where unpickling a model file is a code-execution vector.",
     "subtechniques": [],
     "real_world_instances": [
@@ -1289,23 +1187,19 @@
   },
   "AML.T0047": {
     "id": "AML.T0047",
-    "name": "LLM Meta Prompt Extraction",
-    "tactic": "Credential Access",
-    "description": "Adversary extracts a system prompt, tool definitions, or hidden instructions from an LLM-backed application via prompt-injection that coerces the model into revealing its meta-configuration. Recovered prompts feed downstream attacks (impersonation, jailbreak refinement, sensitive-tool discovery).",
+    "name": "AI-Enabled Product or Service",
+    "tactic": "AI Model Access",
+    "description": "Adversary gains indirect access to the model behind a product or service that uses AI, such as a chat assistant, a document summarizer or an AI feature in a SaaS product. The product's responses, logs and metadata can reveal the underlying model, its configuration and its inferences without any direct access to the model API.",
     "subtechniques": [],
-    "real_world_instances": [
-      "CVE-2025-53767 — Azure OpenAI Service SSRF chained with prompt-injection to extract meta-prompt + tool registration."
-    ],
+    "real_world_instances": [],
     "framework_gap": true,
-    "framework_gap_detail": "No framework treats LLM meta-prompt as a credential class; rotation, scoping, and exposure-detection controls are absent.",
+    "framework_gap_detail": "Vendor risk assessments review the product and not the model it embeds, so no framework control asks which model a product uses or what the product's responses, logs and metadata reveal about it.",
     "controls_that_partially_help": [],
     "controls_that_dont_help": [],
-    "detection": "Output-side filtering for system-prompt fingerprints; query-side anomaly detection on injection-class inputs targeting <system>, <SYS>, role:system patterns.",
+    "detection": "Review what AI-enabled products expose in responses, error messages and metadata, and monitor product usage for query patterns aimed at the underlying model rather than the product's function.",
     "exceptd_skills": [],
-    "last_verified": "2026-05-19",
-    "cve_refs": [
-      "CVE-2025-53767"
-    ],
+    "last_verified": "2026-09-22",
+    "cve_refs": [],
     "description_full": "Adversaries may use a product or service that uses artificial intelligence under the hood to gain access to the underlying AI model. This type of indirect model access may reveal details of the AI model or its inferences in logs or metadata.",
     "platforms": [
       "ATLAS"
@@ -1381,7 +1275,7 @@
   "AML.T0005": {
     "id": "AML.T0005",
     "name": "Create Proxy AI Model",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "Adversaries may obtain models to serve as proxies for the target model in use at the victim organization.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0005",
     "last_verified": "2026-05-19",
@@ -1431,7 +1325,8 @@
     "name": "Valid Accounts",
     "tactic": [
       "Initial Access",
-      "Privilege Escalation"
+      "Privilege Escalation",
+      "Lateral Movement"
     ],
     "description": "Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0012",
@@ -1449,17 +1344,37 @@
     "id": "AML.T0013",
     "name": "Discover AI Model Ontology",
     "tactic": "Discovery",
-    "description": "Adversaries may discover the ontology of an AI model's output space, for example, the types of objects a model can detect.",
+    "description": "Adversary queries a model to learn its output space, such as the classes it can return, and how it chooses between them, which makes evasion, prompt injection and targeted adversarial inputs more effective. Against LLM applications the same probing maps output filters and safety guardrails. The ontology can also come from a configuration file or from documentation about the model.",
+    "subtechniques": [],
+    "real_world_instances": [],
+    "framework_gap": true,
+    "framework_gap_detail": "No framework requires rate limiting on AI API queries to slow discovery. No framework requires AI API query logging under SI-4, and no control set includes behavioral anomaly detection for AI API probe patterns.",
+    "controls_that_partially_help": [
+      "NIST-800-53-SI-4",
+      "NIST-800-53-AC-17"
+    ],
+    "controls_that_dont_help": [
+      "ISO-27001-2022-A.8.28"
+    ],
+    "detection": "AI API query rate monitoring; semantic similarity clustering of queries to find probe patterns; alerts on high query volume from a single identity.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0013",
-    "last_verified": "2026-05-19",
-    "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-atlas-stix",
+    "last_verified": "2026-09-22",
     "description_full": "Adversaries may discover the ontology of an AI model's output space, for example, the types of objects a model can detect. The adversary may discovery the ontology by repeated queries to the model, forcing it to enumerate its output space. Or the ontology may be discovered in a configuration file or in documentation about the model. The model ontology helps the adversary understand how the model is being used by the victim. It is useful to the adversary in creating targeted attacks.",
     "platforms": [
       "ATLAS"
     ],
     "stix_id": "attack-pattern--4480d7c5-7096-5360-8b2a-875cf4b710ea",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "exceptd_skills": [
+      "ai-attack-surface",
+      "ai-risk-management",
+      "api-security",
+      "cloud-security",
+      "incident-response-playbook",
+      "mlops-security",
+      "sector-financial",
+      "sector-healthcare"
+    ]
   },
   "AML.T0014": {
     "id": "AML.T0014",
@@ -1553,11 +1468,22 @@
     "id": "AML.T0031",
     "name": "Erode AI Model Integrity",
     "tactic": "Impact",
-    "description": "Adversaries may degrade the target model's performance with adversarial data inputs to erode confidence in the system over time.",
+    "description": "Adversary degrades a model's output quality over time through sustained low-rate adversarial inputs, feedback-loop poisoning, RAG corpus drift, or systematic query patterns that bias the model's behavior. Erosion differs from acute poisoning (AML.T0020) in tempo: it is slow enough to stay under output-monitoring thresholds while it accumulates into a meaningful loss of integrity.",
+    "subtechniques": [],
+    "real_world_instances": [],
+    "framework_gap": true,
+    "framework_gap_detail": "Continuous integrity monitoring of model output distributions is not a framework control. SI-7 software and firmware integrity covers code artifacts, not model behavior. No framework requires drift detection against a known-good model baseline, and NIST AI RMF MEASURE 2.7 recommends continuous adversarial robustness assessment without requiring it.",
+    "controls_that_partially_help": [
+      "NIST-800-53-SI-7",
+      "NIST-AI-RMF-MEASURE-2.7"
+    ],
+    "controls_that_dont_help": [
+      "ISO-27001-2022-A.8.28",
+      "SOC2-CC7"
+    ],
+    "detection": "Statistical drift detection on the output distribution; periodic regression scoring against a golden test set; mining user feedback for unusual clusters of complaints.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0031",
-    "last_verified": "2026-05-19",
-    "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-atlas-stix",
+    "last_verified": "2026-09-22",
     "description_full": "Adversaries may degrade the target model's performance with adversarial data inputs to erode confidence in the system over time. This can lead to the victim organization wasting time and money both attempting to fix the system and performing the tasks it was meant to automate by hand.",
     "platforms": [
       "ATLAS"
@@ -1600,6 +1526,7 @@
     "stix_id": "attack-pattern--801658f2-81cd-5935-93c7-5e6e2d80e669",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2023-43472",
       "CVE-2023-48022",
       "CVE-2025-64513",
       "CVE-2026-26190"
@@ -1640,7 +1567,7 @@
   "AML.T0041": {
     "id": "AML.T0041",
     "name": "Physical Environment Access",
-    "tactic": "ai-model-access",
+    "tactic": "AI Model Access",
     "description": "In addition to the attacks that take place purely in the digital domain, adversaries may also exploit the physical environment for their attacks.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0041",
     "last_verified": "2026-05-19",
@@ -1656,7 +1583,7 @@
   "AML.T0042": {
     "id": "AML.T0042",
     "name": "Verify Attack",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "Adversaries can verify the efficacy of their attack via an inference API or access to an offline copy of the target model.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0042",
     "last_verified": "2026-05-19",
@@ -1738,6 +1665,7 @@
       "CVE-2025-32444",
       "CVE-2025-3248",
       "CVE-2025-3466",
+      "CVE-2025-53767",
       "CVE-2025-56520",
       "CVE-2025-60455",
       "CVE-2025-64496",
@@ -1784,6 +1712,7 @@
     "stix_id": "attack-pattern--07421f1a-a5ae-5936-9713-c77e4758177c",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2026-30623",
       "CVE-2026-42271"
     ]
   },
@@ -1792,7 +1721,7 @@
     "name": "Phishing",
     "tactic": [
       "Initial Access",
-      "lateral-movement"
+      "Lateral Movement"
     ],
     "description": "Adversaries may send phishing messages to gain access to victim systems.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0052",
@@ -1810,11 +1739,16 @@
     "id": "AML.T0056",
     "name": "Extract LLM System Prompt",
     "tactic": "Exfiltration",
-    "description": "Adversaries may attempt to extract a large language model's (LLM) system prompt.",
+    "description": "Adversary extracts an LLM application's system prompt, tool definitions or hidden instructions, usually through prompt injection that makes the model reveal them, or from a configuration file. A recovered prompt shows which tools and data the application can reach, helps the adversary refine jailbreaks and impersonate the application, and can itself be valuable intellectual property.",
+    "subtechniques": [],
+    "real_world_instances": [],
+    "framework_gap": true,
+    "framework_gap_detail": "No framework treats a system prompt as sensitive configuration, so no control covers scoping it, rotating it, or detecting that it has been exposed.",
+    "controls_that_partially_help": [],
+    "controls_that_dont_help": [],
+    "detection": "Output-side filtering for system-prompt fingerprints; input-side anomaly detection for injection inputs that target <system>, <SYS> or role:system markers.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0056",
-    "last_verified": "2026-05-19",
-    "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-atlas-stix",
+    "last_verified": "2026-09-22",
     "description_full": "Adversaries may attempt to extract a large language model's (LLM) system prompt. This can be done via prompt injection to induce the model to reveal its own system prompt or may be extracted from a configuration file. System prompts can be a portion of an AI provider's competitive advantage and are thus valuable intellectual property that may be targeted by adversaries.",
     "platforms": [
       "ATLAS"
@@ -1921,7 +1855,7 @@
   "AML.T0065": {
     "id": "AML.T0065",
     "name": "LLM Prompt Crafting",
-    "tactic": "Resource Development",
+    "tactic": "AI Attack Adaptation",
     "description": "Adversaries may use their acquired knowledge of the target generative AI system to craft prompts that bypass its defenses and allow malicious instructions to be executed.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0065",
     "last_verified": "2026-05-19",
@@ -1937,7 +1871,7 @@
   "AML.T0066": {
     "id": "AML.T0066",
     "name": "Retrieval Content Crafting",
-    "tactic": "Resource Development",
+    "tactic": "AI Attack Adaptation",
     "description": "Adversaries may write content designed to be retrieved by user queries and influence a user of the system in some way.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0066",
     "last_verified": "2026-05-19",
@@ -2274,7 +2208,10 @@
       "ATLAS"
     ],
     "stix_id": "attack-pattern--66188cfa-76df-546b-be79-aa06debc8d79",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "exceptd_skills": [
+      "mcp-agent-trust"
+    ]
   },
   "AML.T0087": {
     "id": "AML.T0087",
@@ -2295,7 +2232,7 @@
   "AML.T0088": {
     "id": "AML.T0088",
     "name": "Generate Deepfakes",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "Adversaries may use generative artificial intelligence (GenAI) to create synthetic media (i.e.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0088",
     "last_verified": "2026-05-19",
@@ -2343,7 +2280,7 @@
   "AML.T0091": {
     "id": "AML.T0091",
     "name": "Use Alternate Authentication Material",
-    "tactic": "lateral-movement",
+    "tactic": "Lateral Movement",
     "description": "Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0091",
     "last_verified": "2026-05-19",
@@ -2446,11 +2383,27 @@
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning",
     "tactic": "Persistence",
-    "description": "Adversaries may achieve persistence by poisoning tools used by AI agents including built-in tools or tools available to the agent via Model Context Protocol (MCP) connections.",
+    "description": "Adversary poisons a tool an AI agent uses, such as an MCP server, a tool registered with a coding assistant session or an agent plugin, by changing its model-visible definition, its implementation or its runtime responses. The agent keeps invoking the tool as if it performed its stated function, while the tool runs attacker-chosen actions in the agent's authorization context or returns content that steers the model's next tool calls.",
+    "subtechniques": [],
+    "real_world_instances": [
+      "CVE-2026-30615: Windsurf executes code from an adversarial MCP tool response without user interaction"
+    ],
+    "framework_gap": true,
+    "framework_gap_detail": "No framework models the trust boundary between an AI agent and the tools it invokes. NIST 800-53 CM-7 (least functionality) was written for OS-level execution allowlists, not agent tool registries, and SA-12 supply chain protection does not cover a tool whose definition or responses change after it is installed. AC-3 authorizes the user, but the model chooses which tool to invoke and with what arguments. ISO 27001:2022 A.5.20 does not reach tool-level supplier identity inside the agent runtime.",
+    "controls_that_partially_help": [
+      "NIST-800-53-CM-7",
+      "NIST-800-53-AC-3",
+      "NIST-800-53-SA-12",
+      "ISO-27001-2022-A.8.30"
+    ],
+    "controls_that_dont_help": [
+      "Traditional WAF / API gateway controls: agent-side tool calls do not pass through them",
+      "OS-level antimalware: the agent runtime invokes the tool inside its own process trust boundary",
+      "NIST-800-53-SI-3"
+    ],
+    "detection": "MCP server and tool inventory with signature attestation; a tool-call audit trail recording the model's decision, the tool name, its arguments and its result; alerts when a tool's definition changes after installation and when a newly installed tool is invoked in its first 72 hours; monitoring of agent-side outbound calls for credential exfiltration.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0110",
-    "last_verified": "2026-05-19",
-    "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-atlas-stix",
+    "last_verified": "2026-09-22",
     "description_full": "Adversaries may achieve persistence by poisoning tools used by AI agents including built-in tools or tools available to the agent via Model Context Protocol (MCP) connections. This involves compromising benign tools already integrated into the agent's environment. By altering tool behavior such as modifying parameters or descriptions, injecting hidden logic, or redirecting outputs, attackers can maintain long-term influence over the agent's actions, decisions, or external interactions. Poisoned tools may silently exfiltrate data, execute unauthorized commands, or manipulate downstream processes without raising suspicion.",
     "platforms": [
       "ATLAS"
@@ -2458,7 +2411,8 @@
     "stix_id": "attack-pattern--b1b2cc5a-7312-5f26-93d3-8b8ee1baf97d",
     "is_subtechnique": false,
     "cve_refs": [
-      "CVE-2025-54136"
+      "CVE-2025-54136",
+      "CVE-2026-30615"
     ]
   },
   "AML.T0111": {
@@ -2592,7 +2546,7 @@
   "AML.T0005.000": {
     "id": "AML.T0005.000",
     "name": "Train Proxy via Gathered AI Artifacts",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "Proxy models may be trained from AI artifacts (such as data, model architectures, and pre-trained models) that are representative of the target model gathered by the adversary.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0005.000",
     "last_verified": "2026-05-19",
@@ -2608,7 +2562,7 @@
   "AML.T0005.001": {
     "id": "AML.T0005.001",
     "name": "Train Proxy via Replication",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "Adversaries may replicate a private model.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0005.001",
     "last_verified": "2026-05-19",
@@ -2624,7 +2578,7 @@
   "AML.T0005.002": {
     "id": "AML.T0005.002",
     "name": "Use Pre-Trained Model",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "Adversaries may use an off-the-shelf pre-trained model as a proxy for the victim model to aid in staging the attack.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0005.002",
     "last_verified": "2026-05-19",
@@ -2967,7 +2921,7 @@
     "name": "Poison AI Model",
     "tactic": [
       "Persistence",
-      "ai-attack-staging"
+      "AI Attack Adaptation"
     ],
     "description": "Adversaries may manipulate an AI model's weights to change it's behavior or performance, resulting in a poisoned model.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0018.000",
@@ -2986,7 +2940,7 @@
     "name": "Modify AI Model Architecture",
     "tactic": [
       "Persistence",
-      "ai-attack-staging"
+      "AI Attack Adaptation"
     ],
     "description": "Adversaries may directly modify an AI model's architecture to re-define it's behavior.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0018.001",
@@ -3005,7 +2959,7 @@
     "name": "Embed Malware",
     "tactic": [
       "Persistence",
-      "ai-attack-staging"
+      "AI Attack Adaptation"
     ],
     "description": "Adversaries may embed malicious code into AI Model files.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0018.002",
@@ -3121,7 +3075,7 @@
   "AML.T0043.000": {
     "id": "AML.T0043.000",
     "name": "White-Box Optimization",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "In White-Box Optimization, the adversary has full access to the target model and optimizes the adversarial example directly.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0043.000",
     "last_verified": "2026-05-19",
@@ -3137,7 +3091,7 @@
   "AML.T0043.001": {
     "id": "AML.T0043.001",
     "name": "Black-Box Optimization",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "In Black-Box attacks, the adversary has black-box (i.e.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0043.001",
     "last_verified": "2026-05-19",
@@ -3153,7 +3107,7 @@
   "AML.T0043.002": {
     "id": "AML.T0043.002",
     "name": "Black-Box Transfer",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "In Black-Box Transfer attacks, the adversary uses one or more proxy models (trained via [Create Proxy AI Model](/techniques/AML.T0005) or [Train Proxy via Replication](/techniques/AML.T0005.001)) they have full access to and are representative of the target model.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0043.002",
     "last_verified": "2026-05-19",
@@ -3169,7 +3123,7 @@
   "AML.T0043.003": {
     "id": "AML.T0043.003",
     "name": "Manual Modification",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "Adversaries may manually modify the input data to craft adversarial data.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0043.003",
     "last_verified": "2026-05-19",
@@ -3185,7 +3139,7 @@
   "AML.T0043.004": {
     "id": "AML.T0043.004",
     "name": "Insert Backdoor Trigger",
-    "tactic": "ai-attack-staging",
+    "tactic": "AI Attack Adaptation",
     "description": "The adversary may add a perceptual trigger into inference data.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0043.004",
     "last_verified": "2026-05-19",
@@ -3335,7 +3289,7 @@
     "name": "Spearphishing via Social Engineering LLM",
     "tactic": [
       "Initial Access",
-      "lateral-movement"
+      "Lateral Movement"
     ],
     "description": "Adversaries may turn LLMs into targeted social engineers.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0052.000",
@@ -3354,7 +3308,7 @@
     "name": "Deepfake-Assisted Phishing",
     "tactic": [
       "Initial Access",
-      "lateral-movement"
+      "Lateral Movement"
     ],
     "description": "Adversaries may use deepfakes (AI-generated synthetic images, audio, or video) in phishing campaigns to impersonate trusted individuals, executives, or organizations.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0052.001",
@@ -3563,7 +3517,7 @@
   "AML.T0091.000": {
     "id": "AML.T0091.000",
     "name": "Application Access Token",
-    "tactic": "lateral-movement",
+    "tactic": "Lateral Movement",
     "description": "Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.",
     "reference_url": "https://atlas.mitre.org/techniques/AML.T0091.000",
     "last_verified": "2026-05-19",
@@ -3716,7 +3670,7 @@
   "AML.T0091.001": {
     "id": "AML.T0091.001",
     "name": "Use Alternate Authentication Material: Web Session Cookie",
-    "tactic": "lateral-movement",
+    "tactic": "Lateral Movement",
     "description": "Adversaries may use stolen web session cookies to authenticate to AI services and applications without needing the account's credentials or completing multi-factor authentication.",
     "is_subtechnique": true,
     "parent_technique": "AML.T0091",