Skip to content

Back to the catalog

MITRE ATLAS v2026.09 data release
github.comrepo

MITRE ATLAS v2026.09 data release

Release changelog for MITRE ATLAS's atlas-data repository, the structured YAML/STIX dataset behind the ATLAS knowledge base of adversary tactics and techniques targeting AI-enabled systems (prompt injection, model/data poisoning, AI agent tool abuse, AI supply chain compromise). The v2026.09 release brings the matrix to 120 techniques, 88 sub-techniques, 40 mitigations, and 73 case studies, and recent versions introduced a new v6 YAML data format with Pydantic/SQLAlchemy/FastAPI tooling, platform tagging (Predictive AI, Generative AI, Agentic AI, Enterprise), and renamed/generalized techniques like "AI Agent Tool Poisoning," "Manipulate AI Model," and "Enterprise Resource Discovery." It's the canonical, actively-maintained taxonomy practitioners use for AI red-teaming, threat modeling, and mapping real-world AI attack case studies.

TL;DR Monthly-updated release notes for MITRE ATLAS's data repo — the ATT&CK-style taxonomy of adversary techniques against AI systems, now at 120 techniques and 73 case studies.
Open original ↗
Document

What it is

The atlas-data releases page tracks monthly content drops for MITRE ATLAS. The current record is v2026.09, which contains 1 matrix, 16 tactics, 120 techniques, 88 sub-techniques, 40 mitigations, and 73 case studies. The v2026.09 changelog itself lists only empty "Added/Updated" placeholders — the substance is in the recent releases below it, which include a breaking data-format change and a wave of renamed and generalized technique/mitigation IDs. If you consume ATLAS data programmatically (STIX, Navigator layers, Excel, or the YAML directly), those changes are the reason to look.

What changed that breaks downstream consumers

Versioning scheme split (v2026.05). ATLAS now separates content versioning (YYYY.MM.N, stored in the Collection object) from data-format versioning (SemVer). A single SemVer no longer tells you whether content or format moved.

New YAML format v6.0.0 (v2026.05). The old ATLAS.yaml is deprecated. Historical content is retained under dist/legacy/; migrated v6 releases live under dist/v6/, with a manifest tracking release/version mapping. The v6 model adds a platforms field to every technique (values: Predictive AI, Generative AI, Agentic AI, Enterprise), elevates relationships to first-class typed objects (sequences, achieves, specializes, mitigates, employs), and ships Pydantic schemas, SQLAlchemy ORM models, and a FastAPI REST API for managing the data. Any parser hardcoding the old structure or the ATLAS.yaml path will break.

Renamed / generalized IDs (v2026.07–v2026.08). These invalidate hardcoded technique names and mappings:

  • AI Attack Staging tactic → AI Attack Adaptation
  • Cloud Service Discovery → Enterprise Resource Discovery; Process Discovery → Enterprise Environment Discovery; Reverse Shell → Cyber Communication Channel
  • Publish Poisoned Datasets (AML.T0019) / Publish Poisoned Models (AML.T0058) / Publish Poisoned AI Agent Tool (AML.T0104) folded under Publish Poisoned AI Artifacts sub-techniques
  • Mitigation renames: Model Hardening → Predictive AI Model Hardening, Adversarial Input Detection → Predictive AI Adversarial Input Detection, Restrict Number of AI Model Queries → Limit AI Service Query Volume and Rate, and others

New agentic-AI coverage (v2026.07). Techniques added for the agent tool-chain threat surface: AI Agent Tool Poisoning, AI Agent Tool Invocation, AI Agent Tool Data Poisoning, AI Supply Chain Compromise: AI Agent Tool, and User Execution: Poisoned AI Agent Tool. A new stix-atlas-attack-enterprise.json artifact was added to release assets.

What to do

If you ingest ATLAS: pin to a specific YYYY.MM.N content version, migrate off ATLAS.yaml to the dist/v6/ outputs, and update any stored technique/mitigation identifiers against the rename list above before upgrading past v2026.05.

Organisations named here

  • AML.T0019
  • AML.T0058
  • AML.T0104

Technologies named here

  • MITRE ATLAS
  • ATLAS Navigator
  • stix-atlas-attack-enterprise.json
  • FastAPI REST API
  • SQLAlchemy ORM models
  • Pydantic schemas
  • Excel generation workflow

Techniques named here

  • Enterprise Resource Discovery
  • Enterprise Environment Discovery
  • Cyber Communication Channel
  • Develop Capabilities
  • LLM Prompt Crafting
  • Retrieval Content Crafting
  • Publish Poisoned AI Artifacts
  • Training Data Poisoning
  • Masquerading
  • AI Agent Tool Poisoning
  • AI Agent Tool Invocation
  • AI Supply Chain Compromise
  • User Execution
  • Acquire Public AI Artifacts
  • AI Agent Tool Data Poisoning
  • Manipulate AI Model
  • AI Attack Adaptation

Related in AI Security