Summary: 63 documented AI attacks, each with a step-by-step procedure mapped to tactics and techniques. 18 are real incidents; 45 are research exercises. The corpus is heavily weighted to 2024–2026.
Sources: raw/MITRE-ATLAS/AML.CS00*.md (63 cards, release 2026.06)
Last updated: 2026-07-28
Composition
| Type | Count |
|---|---|
| Exercise (research demonstration) | 45 |
| Incident (real-world) | 18 |
The 71/29 split matters when citing these. Most of ATLAS’s evidence base is red-team and academic work, not observed attacks. Treat an Exercise as proof of feasibility, not of occurrence — the same distinction the technique-level maturity field makes with Demonstrated vs Realized.
Distribution over time
| Year | Cases |
|---|---|
| 2016 | 1 |
| 2019 | 3 |
| 2020 | 10 |
| 2021 | 2 |
| 2022 | 3 |
| 2023 | 8 |
| 2024 | 12 |
| 2025 | 17 |
| 2026 | 7 (partial) |
36 of 63 cases — 57% — are from 2024 onward. The 2020 cluster is largely classical adversarial-ML work on classifiers; the recent mass is LLM and agent attacks. This corpus is where the field’s shift from model evasion to agent hijacking is visible as data.
Frequent contributors
Named researchers dominate: Embrace the Red (4), Palo Alto Networks AI Research Team (2), Zenity (2), HiddenLayer (2), with “Unknown” or “Unknown Threat Actor” on 7. Several of these names also appear as alias sources throughout PITAX — the same small community produces both catalogues.
Which techniques actually get used
Counting employs relationships across all 63 case studies:
| Uses | Technique |
|---|---|
| 24 | AML.T0065 LLM Prompt Crafting |
| 18 | AML.T0015 Evade AI Model |
| 16 | AML.T0047 AI-Enabled Product or Service |
| 15 | AML.T0053 AI Agent Tool Invocation |
| 13 | AML.T0051.001 Prompt Injection: Indirect |
| 12 | AML.T0051.000 Prompt Injection: Direct |
| 12 | AML.T0048.003 User Harm |
| 11 | AML.T0048.000 Financial Harm |
Two observations worth carrying:
- Indirect prompt injection outranks direct (13 vs 12) in documented attacks. The indirect split page argues indirect is the more serious threat model on structural grounds; the case-study data agrees empirically.
- AI Agent Tool Invocation at 15 puts agent tooling among the most-exercised techniques in the corpus — consistent with Agentic AI being the largest platform tag.
The shape of a case study card
Each carries type, actor, target, date, a summary, and a numbered attack procedure in which every step is bound to a tactic and a technique. From AML.CS0037 Data Exfiltration via Agent Tools in Copilot Studio (Zenity, June 2025), target “Copilot Studio Customer Service Agent”:
S00 — Reconnaissance → Active Scanning
S01 — Resource Development → LLM Prompt Crafting
S02 — Initial Access → Prompt Infiltration via Public-Facing Application
...
The researchers identified an AI-managed support inbox, probed it, then “craft[ed] a prompt that retrieves private customer data from the organization’s RAG database and CRM, and exfiltrate[d] it via the AI agent’s email tool” (source: raw/MITRE-ATLAS/AML.CS0037-*.md).
This step-with-tactic structure is what makes the corpus usable for tabletop design — Microsoft’s readiness pattern asks for “at least one tabletop exercise per year” testing “an AI-specific scenario involving novel harm types or ambiguous root cause” (source: raw/AI-incident-response/Incident response for AI systems.md). These are 63 ready-made scenarios with the attack path already mapped. See Microsoft IR readiness.
Overlap with the rest of the corpus
Several ATLAS case studies describe the same events as sources already in the vault:
- Copilot Studio / agent tool exfiltration (
AML.CS0037) parallels the AgentFlayer and Microsoft 365 Copilot ASCII-smuggling attacks documented in RAG and runtime poisoning. - The AIID’s public-response corpus covers a partly overlapping incident set from the disclosure side rather than the technical side. See AIID incident responses.
Both are named as detection inputs by the Code of Practice, which requires consulting “academic research, and incident databases” for serious-incident identification (source: raw/Laws/Overview of the Code of Practice...md).