Summary: 16 tactics in attack-chain order, from Reconnaissance to Impact, with two AI-specific tactics that have no ATT&CK equivalent.
Sources: raw/MITRE-ATLAS/index.md and the 16 AML.TA* tactic cards (release 2026.06)
Last updated: 2026-07-28
The 16 tactics
In matrix order, with top-level technique counts:
| # | Tactic | ID | Techniques |
|---|---|---|---|
| 1 | Reconnaissance | AML.TA0002 | 8 |
| 2 | Resource Development | AML.TA0003 | 13 |
| 3 | Initial Access | AML.TA0004 | 7 |
| 4 | AI Model Access | AML.TA0000 | 4 |
| 5 | Execution | AML.TA0005 | 6 |
| 6 | Persistence | AML.TA0006 | 9 |
| 7 | Privilege Escalation | AML.TA0012 | 4 |
| 8 | Defense Evasion | AML.TA0007 | 15 |
| 9 | Credential Access | AML.TA0013 | 7 |
| 10 | Discovery | AML.TA0008 | 9 |
| 11 | Lateral Movement | AML.TA0015 | 2 |
| 12 | Collection | AML.TA0009 | 4 |
| 13 | AI Attack Staging | AML.TA0001 | 6 |
| 14 | Command and Control | AML.TA0014 | 4 |
| 15 | Exfiltration | AML.TA0010 | 6 |
| 16 | Impact | AML.TA0011 | 9 |
Column counts sum to 113, above the 103 distinct top-level techniques — ten techniques serve more than one tactic and appear in multiple columns, exactly as in ATT&CK.
The two AI-native tactics
Fourteen of the sixteen are ATT&CK tactics carried over. Two are new, and they are where the AI-specific threat model actually lives:
AI Model Access (AML.TA0000) — sits at position 4, between Initial Access and Execution. It encodes the insight that access to the model is a distinct objective from access to the system. An attacker may hold no infrastructure foothold at all and still have what they need, because the API is the attack surface. This is the tactic that makes model extraction legible as an attack chain rather than as API misuse.
AI Attack Staging (AML.TA0001) — position 13, after Collection. Building proxy models, crafting adversarial data, verifying attacks offline before firing them at the target. It has no conventional analogue because conventional exploits do not require you to train something first.
Defense Evasion is the largest column at 15 techniques — consistent with PITAX, where evasion of safety measures is the single biggest theme.
Sub-techniques
70 of the 173 techniques are sub-techniques, using dotted IDs (AML.T0051.001) and linked by specializes relationships. There is no subtechnique-of field — parentage is expressed only through the relationship graph, which is a common source of conversion bugs.
The most consequential example for this vault:
AML.T0051LLM Prompt Injection →.000Direct ·.001Indirect ·.002Triggered
ATLAS splits prompt injection on exactly the axis PITAX uses for delivery, and adds a third for trigger-gated payloads that PITAX handles as a separate technique (T44). See atlas-and-pitax.
Reading the matrix against this vault
Three columns carry most of the vault’s existing material:
- AI Model Access → Model theft, weight-level attacks
- Defense Evasion → persuasion and framing, obfuscation
- Execution →
AML.T0051prompt injection,AML.T0053AI Agent Tool Invocation → agentic and tool attacks
Resource Development (13 techniques) is where data poisoning sits — the adversary builds capability before touching the target. That placement is itself the point: poisoning is preparation, and its effects surface much later, which is why detection lags run 6–24 months.