The MITRE ATLAS Matrix provides a working knowledge base of adversary tactics, techniques, and real-world case studies specifically for Artificial Intelligence (AI) and Machine Learning (ML) systems. It adapts the established MITRE ATT&CK adversary tactics and techniques matrix which is the standard reference for traditional IT cybersecurity.
The progression and maturity of tactics used in AI attacks are accelerating. First presented in 2021 with 12 tactics and 36 unique techniques (starting with v3.0.0), this framework has now grown to 16 tactics and 101 unique techniques (as of v6.0.0 June 2026). 2025 saw the greatest single-year growth of techniques, with 45 added, doubling the number of techniques. In this post I will be discussing 2025, and in a future post I will discuss the progression and change that is occurring in 2026 compared to 2025.
MITRE ATLAS Summary
The MITRE ATLAS framework is organized around three analytical layers:
- Tactics that identify adversarial objectives (the Why).
- Techniques that document specific methods of execution (the How).
- Case studies that ground both in real-world incidents (the Who).
Each technique in this framework progresses over time in maturity starting with feasible capability. These levels are:
- Feasible - Works in research or controlled settings, but is not necessarily demonstrated in realistic operations.
- Demonstrated - Shows effectiveness in realistic exercises, testing, or representative deployment conditions.
- Realized - Observed in real-world incidents or adversary operations against AI-enabled systems.
The evolution of MITRE ATLAS reflects the broader trajectory of AI-specific threats, progressing from foundational machine learning attack techniques through ATT&CK alignment, the emergence of LLM-specific exploits, and most recently the full attack surface of autonomous AI agents.
MITRE maintains a broader ecosystem of complementary security resources beyond ATLAS and ATT&CK. The Common Weakness Enumeration (CWE) , for example, provides a structured catalog of software and hardware weaknesses that architects, designers, and engineers can use to identify and remediate vulnerabilities before deployment — reflecting the well-established principle that security deficiencies are significantly less costly to address at the design stage than after a system is in production.
Real World Working Examples
To provide some examples for technical engineers and managers without specific cybersecurity expertise, I’ll use common industry security terms, starting with a clear definition of the adversary.
A Malicious Actor is an individual, group or organization that intentionally performs cybersecurity attacks on computer systems for the purpose to disrupting activity, compromise integrity, obtain information or restrict authorized access. You may also hear this term described as a Bad Actor, Attacker, Intruder or Threat Actor.
There are presently 16 defined MITRE ATLAS tactics . Some common tactics include:
- Privilege Escalation - The Malicious Actor is trying to achieve higher-level permissions than the product provides.
- Exfiltration - The Malicious Actor is attempting to obtain additional information the AI system is not anticipated to provide.
- Execution - The Malicious Actor is trying to run malicious code within the software.
Techniques are not unique to a given tactic. For example, LLM Jailbreak is one of four techniques used in Privilege Escalation , as the name suggests, to circumvent or override the expected behaviors, guardrails, and guidelines of your AI system. Supply Chain Compromise is another technique which has been occurring more regularly especially with third party open source libraries. A few examples include the NPM, PyPI, and Docker Hub Vulnerabilities and the 2024 XZ Utils Backdoor . Both targeted software with a massive user base.
Case Studies are a very valuable resource that should be monitored and reviewed regularly. There are approximately 45 (AML.CS0000 to AML.CS0044) case studies at the end of 2025. As of this time in 2026 there are already 17 additional case studies. Supply Chain Attack on AI Coding Assistants - Rules File Backdoor describes how multiple techniques including LLM Jailbreak can occur with a malicious script.
Finally, mitigations represent how to prevent the successful execution of any given technique. LLM Jailbreak can currently be mitigated with several approaches including Generative AI Guardrails , Generative AI Guidelines and Generative AI Model Alignment .
Analysis 2021 - 2025
Tactics
The current 16 MITRE ATLAS tactics are: Reconnaissance, Resource Development, Initial Access, AI Model Access, Execution, Persistence, Privilege Escalation (added 2023), Defense Evasion, Credential Access (added 2023), Discovery, Lateral Movement (added 2025), Collection, AI Attack Staging, Command and Control (added 2025), Exfiltration, and Impact.
Most of these tactics will be familiar to anyone who has worked with MITRE ATT&CK, and that is by design — ATLAS deliberately mirrors the ATT&CK structure so that security teams can apply existing mental models to AI systems. What matters is which tactics are unique to AI and when the others were adopted.
There has been rapid maturation from 36 techniques across 12 tactics in 2021 to 91 techniques across 16 tactics by the end of 2025. This is what maturation looks like in practice: the questions an adversary asks (“how do I get in, escalate, exfiltrate?”) change slowly, but the toolbox for answering each question expands rapidly as researchers and real-world attackers discover new approaches.
Timeline for the change of tactics approach
The progression falls into four broad waves, each reflecting the dominant AI technology of its moment:
- Feb - May 2021: Core ML-focused tactics and techniques established (Reconnaissance, Evasion, Supply Chain, Model Access). This foundational wave targeted classical machine learning — image classifiers, recommendation engines, and similar models — with adversarial examples and data poisoning as the primary concerns.
- Oct - Dec 2021: Expanded with ATT&CK-aligned tactics and sub-techniques, bridging AI-specific attacks with the established language of traditional cybersecurity.
- Oct 2023: Major LLM wave with Prompt Injection, Jailbreak, and LLM Plugin Compromise. The arrival of widely deployed large language models introduced an entirely new class of attack that operates through natural language rather than code.
- Mar - Apr 2025: RAG/retrieval attacks, LLM obfuscation, prompt crafting, and agentic techniques. As organisations connected LLMs to their own data and tools, the attack surface expanded to the retrieval pipeline and the boundary between the model and its data sources.
- Sep 2025 - Dec 2025: Full AI agent attack surface, with agent context poisoning, tool compromise, credential harvesting, and lateral movement via agents. This most recent wave treats the AI agent as a first-class actor within the environment — one that can be manipulated, impersonated, or hijacked to act against the systems it was trusted to use.
2025 (v5.2.0) was the inflection point in the framework’s history. The total 46 techniques in 2024 to 91 in 2025 — a near-doubling that added 45 techniques in a single year, more than the entire framework contained in either 2022 or 2024.
The more revealing story is maturity, not just volume. Looking at how the three maturity levels moved:
- Feasible (research or controlled settings only) rose modestly from 10 to 17. New techniques are still entering the framework as theoretical or lab-stage capabilities, as you’d expect.
- Demonstrated (effective in realistic exercises or testing) jumped sharply from 22 to 41 — nearly doubling. This is the largest single-level increase and the heart of the 2025 story.
- Realized (observed in real-world incidents against AI-enabled systems) more than doubled from 14 to 33.
This visualization of the MITRE ATLAS timeline illustrates this progression of techniques and maturity:
As shown in this heatmap of tactics over time and technique maturity, many tactics have not seen fully realised techniques. This shows that new methods of attack are not yet mainstream. Resource Development and Defense Evasion top the tactics with the most recognized techniques, while Resource Development, Initial Access and Collection show the most maturity of techniques within that tactic.
Conclusion
The pattern to draw out for readers: 2025 didn’t just add techniques, it matured them. In 2024, Realized techniques made up about 30% of the total (14 of 46); in 2025 that share held at roughly 36% (33 of 91) even as the base nearly doubled — meaning the count of techniques actually seen in the wild grew faster than the framework overall. Combined with the surge in Demonstrated techniques, this signals that AI attacks in 2025 moved decisively out of the lab. The bulk of the 91 techniques (74 of them — Demonstrated plus Realized) are no longer theoretical; they have been shown to work or have already been used against real systems.
