AI Security Second Brain

MITRE ATLAS — Operation Log

3 min read

⭐ Star on GitHub

Append-only. Newest entries at the bottom.

2026-07-28 — Source folder created and ingested

Source acquisition: raw/MITRE-ATLAS/ did not exist as content before today. Populated from the official MITRE data distribution, not scraped — atlas.mitre.org is a Vue SPA serving a 3.7 KB shell with no server-rendered content.

  • Repo: github.com/mitre-atlas/atlas-data (Apache 2.0, Copyright 2021-2026 MITRE)
  • File chain resolved: dist/ATLAS-latest.yaml → v6/ATLAS-latest.yaml → v6/ATLAS-2026.06.yaml (612 KB)
  • Release 2026.06 (2026-06-30), format 6.0.0

Two acquisition errors caught and corrected before ingest:

  1. First pull used dist/ATLAS.yaml, which MITRE’s README marks “deprecated and will no longer be updated.” It sits at format 5.6.0 / release 2026.04 — two releases stale, missing 3 techniques and 6 case studies. Corrected to the -latest chain.
  2. Format v6 restructured the data: objects are dicts keyed by ID, and tactic↔technique mapping moved from technique records into a separate relationships block. The first converter, written against the 5.x shape, produced empty tactic assignments without erroring.

Generation: 288 markdown cards produced by _gen_atlas.py (retained in the raw folder alongside _ATLAS-2026.06.yaml.source). Card layout mirrors the existing PITAX convention.

A sanitiser was required: ATLAS prose contains footnote citations of the form <sup>[[7]](url)</sup> and bare [[github]], which Obsidian parses as wikilinks. A naive conversion produced 84 broken links. Verified 0 broken across 2,236 wikilinks after the fix.

Pages created (7):

  • index.md, log.md
  • mitre-atlas.md — framework, versioning traps, provenance
  • atlas-matrix.md — 16 tactics, the two AI-native ones
  • atlas-mitigations.md — 35 mitigations and the 56% coverage gap
  • atlas-case-studies.md — 63 documented attacks
  • atlas-and-pitax.md — cross-taxonomy mapping

Findings recorded:

  • Agentic AI is the largest platform tag (114 techniques, vs 92 Generative AI). MITRE’s own accounting says the agent is the dominant surface.
  • 97 of 173 techniques have zero mapped mitigations — ATLAS is a much stronger threat taxonomy than control catalogue.
  • Indirect prompt injection outranks direct in documented case studies (13 vs 12 employs relationships).
  • Only 37 of 173 techniques carry an ATT&CK cross-reference; ~79% has no conventional analogue.
  • 45 of 63 case studies are research Exercises, only 18 real Incidents. 57% date from 2024 onward.
  • ATLAS has no technique for multi-turn or reasoning-budget attacks — PITAX-only territory.

Existing pages updated to remove now-stale “ATLAS is missing” claims: laws-wiki/ai-governance-practice.md, laws-wiki/index.md, ai-incident-response-wiki/cosai-framework.md, ai-incident-response-wiki/index.md, ai-attack-techniques-wiki/index.md, ai-regulations-wiki/article-15-cybersecurity.md.

Root index updated: yes.

Open items:

  • ATLAS ships monthly. Re-run _gen_atlas.py against the -latest chain to refresh; it resolves pointers automatically.
  • CoSAI’s per-component ATLAS mapping across five architecture patterns still requires the CoSAI framework PDF, which is not in raw/.

Graph View