MITRE ATLAS catalogues how AI and machine learning systems actually get attacked, organised the same way MITRE ATT&CK organises conventional intrusions: by tactic, by technique, and by documented real-world case study rather than theoretical risk. It covers the full lifecycle of a model, from data collection and training through deployment and inference, and includes techniques like prompt injection, model inversion, training-data poisoning, and adversarial examples crafted to fool a classifier.
The framework matters because AI-specific attacks don’t map cleanly onto a traditional infrastructure security checklist. A firewall rule or a patch schedule doesn’t do anything against an attacker who manipulates a model’s training data or crafts an input designed to extract memorised secrets. ATLAS gives security teams a vocabulary and a threat model for the part of the attack surface that conventional frameworks were never built to describe, and it’s updated as the field moves: its January 2026 revision added case studies covering compromised MCP servers and indirect prompt injection through agent-to-agent channels.
The practical use is the same as ATT&CK’s: map your own AI systems and agents against it the way you’d map infrastructure against ATT&CK, before an incident forces the exercise. A security team that has never done this has a machine-learning attack surface with no threat model behind it.