v2026.07

Content v2026.07

This version of ATLAS data contains 1 matrix, 16 tactics, 101 techniques, 77 sub-techniques, 37 mitigations, and 68 case studies.

Techniques

• Added new techniques

  • Publish Poisoned AI Artifacts
  • Manipulate AI Model: Modify Prompt Construction Logic
  • AI Agent Tool Poisoning: Definition and Instructions
  • AI Agent Tool Poisoning: Implementation
  • AI Agent Tool Poisoning: Runtime Response

• Updated existing techniques

  • Publish Poisoned AI Artifacts: Datasets
    • Previously "Publish Poisoned Datasets" (AML.T0019)
  • Publish Poisoned AI Artifacts: Models
    • Previously "Publish Poisoned Models" (AML.T0058)
  • Publish Poisoned AI Artifacts: AI Agent Tools
    • Previously "Publish Poisoned AI Agent Tool" (AML.T0104)
  • Training Data Poisoning
    • Previously called Poison Training Data
  • Masquerading
  • AI Agent Tool Poisoning
  • AI Agent Tool Invocation
  • AI Supply Chain Compromise: AI Agent Tool
  • User Execution: Unsafe AI Artifacts
  • User Execution: Poisoned AI Agent Tool
  • Acquire Public AI Artifacts: AI Agent Configuration
  • AI Agent Tool Data Poisoning
  • Manipulate AI Model

Mitigations

• Added new mitigations

  • AI Red Team
  • Limit AI Workload Resource Consumption

• Updated existing mitigations

  • Memory Hardening
  • Generative AI Model Alignment
  • Passive AI Output Obfuscation
    • Previously called "Passive AI Output Obfuscation"
  • Predictive AI Model Hardening
    • Previously called "Model Hardening"
  • Predictive AI Ensembles
    • Previously called "Use Ensemble Methods"
  • Predictive AI Multi-Sensor Fusion
    • Previously called "Use Multi-Modal Sensors"
  • Predictive AI Input Restoration
    • Previously called "Input Restoration"
  • Predictive AI Adversarial Input Detection
    • Previously called "Adversarial Input Detection"
  • Limit AI Service Query Volume and Rate
    • Previously called "Restrict Number of AI Model Queries"
  • Limit Public Release of Information
  • Limit Model Artifact Release
  • Control Access to AI Models and Data at Rest
  • Restrict Library Loading
  • Control Access to AI Models and Data in Production
  • Generative AI Guardrails
  • Generative AI Guidelines
  • Maintain AI Dataset Provenance
  • Segmentation of AI Agent Components

Case Studies

• Added new case studies

  • Prompt-Based Attacks Against Gemini via Calendar Invitations
  • Poisoned GGUF Templates: Inference-Time Supply Chain Attack
  • Model Namespace Reuse Supply Chain Attack
  • ZombieAgent: Data Exfiltration Attack on ChatGPT
  • Claude Code GitHub Action Secret Exposure

• Updated existing case studies

  • Web-Scale Data Poisoning: Split-View Attack
  • ShadowRay: Hijacking Exposed Ray Clusters
    • Previously called "ShadowRay"
  • Supply Chain Compromise via Poisoned ClawdBot Skill
  • Poisoned Postmark MCP Server Email Exfiltration
  • Data Exfiltration via Remote Poisoned MCP Tool

Data Tools

• Added stix-atlas-attack-enterprise.json to release artifacts
• Updated navigator layer generation