diff --git a/crosswalk/agentic-top10/Agentic_MITREATLAS.md b/crosswalk/agentic-top10/Agentic_MITREATLAS.md index 859a611..515324d 100644 --- a/crosswalk/agentic-top10/Agentic_MITREATLAS.md +++ b/crosswalk/agentic-top10/Agentic_MITREATLAS.md @@ -28,11 +28,11 @@ the severity of a technique beyond its baseline LLM rating. |---|---|---|---|---|---| | ASI01 | Agent Goal Hijack | Critical | AML.T0051.000, AML.T0051.001, AML.T0054 | Autonomy turns single injection into multi-step attack chain | Foundational–Advanced | | ASI02 | Tool Misuse & Exploitation | Critical | AML.T0037, AML.T0015, AML.T0068 | Tool access converts prompt manipulation into real-world action | Foundational–Advanced | -| ASI03 | Identity & Privilege Abuse | Critical | AML.T0022, AML.T0016, AML.T0024 | Cached credentials give attacker persistent access beyond session | Foundational–Advanced | +| ASI03 | Identity & Privilege Abuse | Critical | AML.T0012, AML.T0024, AML.T0024 | Cached credentials give attacker persistent access beyond session | Foundational–Advanced | | ASI04 | Agentic Supply Chain | High | AML.T0056, AML.T0048, AML.T0010 | Runtime dynamic loading means poisoned components affect all consumers | Hardening–Advanced | | ASI05 | Unexpected Code Execution | Critical | AML.T0040, AML.T0054, AML.T0037 | Code generation + execution capability creates RCE gateway | Foundational–Advanced | | ASI06 | Memory & Context Poisoning | High | AML.T0032, AML.T0063, AML.T0020 | Persistence across sessions amplifies impact of single injection | Hardening–Advanced | -| ASI07 | Insecure Inter-Agent Comms | High | AML.T0043, AML.T0022, AML.T0016 | A2A spoofing misdirects entire agent clusters | Hardening–Advanced | +| ASI07 | Insecure Inter-Agent Comms | High | AML.T0043, AML.T0012, AML.T0024 | A2A spoofing misdirects entire agent clusters | Hardening–Advanced | | ASI08 | Cascading Agent Failures | High | AML.T0029, AML.T0034, AML.T0057 | Single fault fans out across all downstream agents | Foundational–Advanced | | ASI09 | Human-Agent Trust Exploitation | Medium | AML.T0045, AML.T0047, AML.T0049 | Agent fluency makes manipulation invisible to audit logs | Foundational–Hardening | | ASI10 | Rogue Agents | Critical | AML.T0054, AML.T0015, AML.T0057 | Compliant surface masks persistent hidden goal pursuit | Hardening–Advanced | @@ -204,8 +204,8 @@ the original session ends. | Technique | ID | Tactic | Agentic context | |---|---|---|---| -| Valid Accounts | [AML.T0022](https://atlas.mitre.org/techniques/AML.T0022) | Initial Access / Persistence | Exploiting legitimate agent credentials to access AI systems or data pipelines | -| Exfiltration via AI Inference API | [AML.T0016](https://atlas.mitre.org/techniques/AML.T0016) | Exfiltration | Using compromised agent credentials to exfiltrate data through inference API | +| Valid Accounts | [AML.T0012](https://atlas.mitre.org/techniques/AML.T0012) | Initial Access / Persistence | Exploiting legitimate agent credentials to access AI systems or data pipelines | +| Exfiltration via AI Inference API | [AML.T0024](https://atlas.mitre.org/techniques/AML.T0024) | Exfiltration | Using compromised agent credentials to exfiltrate data through inference API | | Model Inversion | [AML.T0024](https://atlas.mitre.org/techniques/AML.T0024) | Collection | Reconstructing sensitive data accessible to the agent through credential abuse | #### Mitigations by tier @@ -460,8 +460,8 @@ cluster. | Technique | ID | Tactic | Agentic context | |---|---|---|---| | Network Service Scanning | [AML.T0043](https://atlas.mitre.org/techniques/AML.T0043) | Discovery | Identifying and mapping inter-agent communication endpoints for targeting | -| Valid Accounts | [AML.T0022](https://atlas.mitre.org/techniques/AML.T0022) | Persistence | Using compromised agent credentials to impersonate trusted agents in A2A channels | -| Exfiltration via AI Inference API | [AML.T0016](https://atlas.mitre.org/techniques/AML.T0016) | Exfiltration | Intercepting inter-agent messages to exfiltrate sensitive context passed between agents | +| Valid Accounts | [AML.T0012](https://atlas.mitre.org/techniques/AML.T0012) | Persistence | Using compromised agent credentials to impersonate trusted agents in A2A channels | +| Exfiltration via AI Inference API | [AML.T0024](https://atlas.mitre.org/techniques/AML.T0024) | Exfiltration | Intercepting inter-agent messages to exfiltrate sensitive context passed between agents | #### Mitigations by tier @@ -526,7 +526,7 @@ crosswalks for OT-specific controls. | Technique | ID | Tactic | Agentic context | |---|---|---|---| -| Denial of ML Service | [AML.T0029](https://atlas.mitre.org/techniques/AML.T0029) | Impact | Triggering cascading failure propagation to exhaust system resources or degrade service | +| Denial of AI Service | [AML.T0029](https://atlas.mitre.org/techniques/AML.T0029) | Impact | Triggering cascading failure propagation to exhaust system resources or degrade service | | Cost Harvesting | [AML.T0034](https://atlas.mitre.org/techniques/AML.T0034) | Impact | Crafting inputs that trigger runaway agent loops generating unbounded costs | | Exploit Public-Facing ML Application | [AML.T0057](https://atlas.mitre.org/techniques/AML.T0057) | Initial Access | Exploiting an exposed agent endpoint to introduce a fault that cascades internally | diff --git a/crosswalk/data/backlinks.json b/crosswalk/data/backlinks.json index d5dac75..cc1eda3 100644 --- a/crosswalk/data/backlinks.json +++ b/crosswalk/data/backlinks.json @@ -16914,8 +16914,26 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0012", - "control_name": "Obtain Capabilities", + "control_name": "Valid Accounts", "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Exploiting legitimate agent credentials to access AI systems or data pipelines" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Using compromised agent credentials to impersonate trusted agents in A2A channels" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -16939,7 +16957,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0013", - "control_name": "Discover ML Model Ontology", + "control_name": "Discover AI Model Ontology", "entries": [ { "id": "DSGAI16", @@ -16989,26 +17007,8 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0016", - "control_name": "Exfiltration via AI Inference API", + "control_name": "Extract ML Model", "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Using compromised agent credentials to exfiltrate data through inference API" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Intercepting inter-agent messages to exfiltrate sensitive context passed between agents" - }, { "id": "DSGAI20", "name": "Model Exfiltration and IP Replication", @@ -17023,7 +17023,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0018", - "control_name": "Backdoor ML Model", + "control_name": "Manipulate AI Model", "entries": [ { "id": "DSGAI04", @@ -17122,31 +17122,6 @@ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0022", - "control_name": "Valid Accounts", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Exploiting legitimate agent credentials to access AI systems or data pipelines" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Using compromised agent credentials to impersonate trusted agents in A2A channels" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024", @@ -17168,14 +17143,23 @@ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Reconstructing sensitive data accessible to the agent through credential abuse" + "notes": "Using compromised agent credentials to exfiltrate data through inference API" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Intercepting inter-agent messages to exfiltrate sensitive context passed between agents" } ] }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "entries": [ { "id": "DSGAI01", @@ -17349,7 +17333,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0029", - "control_name": "Denial of ML Service", + "control_name": "Denial of AI Service", "entries": [ { "id": "LLM10", @@ -17409,33 +17393,6 @@ "tier": "Hardening", "scope": "Both", "notes": "Embedding hidden trigger-response patterns in model via poisoned training data" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Adversarially crafted training examples designed to produce specific model behaviours without detection" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Payloads crafted to pass syntactic validation while embedding malicious semantic content" - }, - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "False content crafted to appear authoritative and rank highly in semantic similarity searches" } ] }, @@ -17640,6 +17597,94 @@ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0036", + "control_name": "Data from Information Repositories", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Sensitive data pasted into shadow AI tools ends up in external data stores accessible to the AI service provider" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Context data flowing through tool integrations captured and transmitted to adversary" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Ungoverned embedding stores and agent memory databases accessed without access controls" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Regulatory violations often arise from ungoverned data repositories — adversary exploits what compliance missed" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Database accessed through LLM-generated queries — adversary extracts sensitive records without direct database access" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Observability databases and log stores accessed as information repositories — sensitive content available at scale" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Browser assistant accesses sensitive data across tabs and applications — adversary controls assistant to exfiltrate" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Pipeline failures may expose data through error messages or fallback paths that lack normal access controls" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Labelling vendor's data stores containing sensitive annotation tasks accessed as information repositories" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0037", @@ -17728,6 +17773,33 @@ "tier": "Hardening", "scope": "Both", "notes": "Identifying and mapping inter-agent communication endpoints for targeting" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Adversarially crafted training examples designed to produce specific model behaviours without detection" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Payloads crafted to pass syntactic validation while embedding malicious semantic content" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "False content crafted to appear authoritative and rank highly in semantic similarity searches" } ] }, @@ -17828,14 +17900,7 @@ "tier": "Foundational", "scope": "Both", "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users" - } - ] - }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0051", - "control_name": "Exploit Public-Facing Application", - "entries": [ + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -18050,87 +18115,6 @@ "tier": "Hardening", "scope": "Both", "notes": "Compromised agent maintains persistent access and hidden execution across sessions" - }, - { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Sensitive data pasted into shadow AI tools ends up in external data stores accessible to the AI service provider" - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context data flowing through tool integrations captured and transmitted to adversary" - }, - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Ungoverned embedding stores and agent memory databases accessed without access controls" - }, - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Regulatory violations often arise from ungoverned data repositories — adversary exploits what compliance missed" - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Database accessed through LLM-generated queries — adversary extracts sensitive records without direct database access" - }, - { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Observability databases and log stores accessed as information repositories — sensitive content available at scale" - }, - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Browser assistant accesses sensitive data across tabs and applications — adversary controls assistant to exfiltrate" - }, - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Pipeline failures may expose data through error messages or fallback paths that lack normal access controls" - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "Labelling vendor's data stores containing sensitive annotation tasks accessed as information repositories" } ] }, diff --git a/crosswalk/data/entries/ASI03.json b/crosswalk/data/entries/ASI03.json index 8b5055d..a875083 100644 --- a/crosswalk/data/entries/ASI03.json +++ b/crosswalk/data/entries/ASI03.json @@ -18,20 +18,20 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0022", + "control_id": "AML.T0012", "control_name": "Valid Accounts", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0022", + "url": "https://atlas.mitre.org/techniques/AML.T0012", "notes": "Exploiting legitimate agent credentials to access AI systems or data pipelines" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0016", + "control_id": "AML.T0024", "control_name": "Exfiltration via AI Inference API", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0016", + "url": "https://atlas.mitre.org/techniques/AML.T0024", "notes": "Using compromised agent credentials to exfiltrate data through inference API" }, { diff --git a/crosswalk/data/entries/ASI07.json b/crosswalk/data/entries/ASI07.json index 971340c..492da3c 100644 --- a/crosswalk/data/entries/ASI07.json +++ b/crosswalk/data/entries/ASI07.json @@ -27,20 +27,20 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0022", + "control_id": "AML.T0012", "control_name": "Valid Accounts", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0022", + "url": "https://atlas.mitre.org/techniques/AML.T0012", "notes": "Using compromised agent credentials to impersonate trusted agents in A2A channels" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0016", + "control_id": "AML.T0024", "control_name": "Exfiltration via AI Inference API", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0016", + "url": "https://atlas.mitre.org/techniques/AML.T0024", "notes": "Intercepting inter-agent messages to exfiltrate sensitive context passed between agents" }, { diff --git a/crosswalk/data/entries/ASI08.json b/crosswalk/data/entries/ASI08.json index a27c76e..1ea696f 100644 --- a/crosswalk/data/entries/ASI08.json +++ b/crosswalk/data/entries/ASI08.json @@ -19,7 +19,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0029", - "control_name": "Denial of ML Service", + "control_name": "Denial of AI Service", "tier": "Foundational", "scope": "Both", "url": "https://atlas.mitre.org/techniques/AML.T0029", diff --git a/crosswalk/data/entries/DSGAI01.json b/crosswalk/data/entries/DSGAI01.json index d3551b7..22f61df 100644 --- a/crosswalk/data/entries/DSGAI01.json +++ b/crosswalk/data/entries/DSGAI01.json @@ -28,7 +28,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "tier": "Foundational", "scope": "Both", "notes": "Adversary determines whether specific sensitive records were used in training — confirms presence of target data" @@ -36,7 +36,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Foundational", "scope": "Both", "notes": "Sensitive content in LLM outputs, logs, or observability pipelines captured and transmitted to adversary" diff --git a/crosswalk/data/entries/DSGAI02.json b/crosswalk/data/entries/DSGAI02.json index f8accb8..71af797 100644 --- a/crosswalk/data/entries/DSGAI02.json +++ b/crosswalk/data/entries/DSGAI02.json @@ -35,7 +35,7 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI03.json b/crosswalk/data/entries/DSGAI03.json index d9d31d6..2cc125e 100644 --- a/crosswalk/data/entries/DSGAI03.json +++ b/crosswalk/data/entries/DSGAI03.json @@ -27,7 +27,7 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -35,7 +35,7 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI04.json b/crosswalk/data/entries/DSGAI04.json index eb1193f..9a81839 100644 --- a/crosswalk/data/entries/DSGAI04.json +++ b/crosswalk/data/entries/DSGAI04.json @@ -20,7 +20,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0020", - "control_name": "Poison Training Data", + "control_name": "Training Data Poisoning", "tier": "Hardening", "scope": "Both", "notes": "Adversary introduces malicious data into training pipeline — corrupts model behaviour in ways baked into weights" @@ -28,14 +28,14 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0018", - "control_name": "Backdoor ML Model", + "control_name": "Manipulate AI Model", "tier": "Hardening", "scope": "Both", "notes": "Hidden functionality embedded in model weights — triggered by specific inputs, invisible to standard testing" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0031", + "control_id": "AML.T0043", "control_name": "Craft Adversarial Data", "tier": "Hardening", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI05.json b/crosswalk/data/entries/DSGAI05.json index 2e168f8..36c77dc 100644 --- a/crosswalk/data/entries/DSGAI05.json +++ b/crosswalk/data/entries/DSGAI05.json @@ -20,7 +20,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0020", - "control_name": "Poison Training Data", + "control_name": "Training Data Poisoning", "tier": "Foundational", "scope": "Both", "notes": "Adversarially crafted payloads bypass ingestion validation to corrupt training or RAG data" @@ -28,14 +28,14 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0018", - "control_name": "Backdoor ML Model", + "control_name": "Manipulate AI Model", "tier": "Foundational", "scope": "Both", "notes": "Path traversal in snapshot imports (CVE-2024-3584) enables write to model host — backdoor installation path" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0031", + "control_id": "AML.T0043", "control_name": "Craft Adversarial Data", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI06.json b/crosswalk/data/entries/DSGAI06.json index 6380974..0aea9dd 100644 --- a/crosswalk/data/entries/DSGAI06.json +++ b/crosswalk/data/entries/DSGAI06.json @@ -19,7 +19,7 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -27,7 +27,7 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI07.json b/crosswalk/data/entries/DSGAI07.json index 82d1a6c..1eb8460 100644 --- a/crosswalk/data/entries/DSGAI07.json +++ b/crosswalk/data/entries/DSGAI07.json @@ -28,14 +28,14 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "tier": "Foundational", "scope": "Both", "notes": "Ungoverned training data status — adversary determines what sensitive data is in scope without classification barriers" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI08.json b/crosswalk/data/entries/DSGAI08.json index 84e73cb..8a833e9 100644 --- a/crosswalk/data/entries/DSGAI08.json +++ b/crosswalk/data/entries/DSGAI08.json @@ -19,7 +19,7 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -27,7 +27,7 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI09.json b/crosswalk/data/entries/DSGAI09.json index 0db483a..892fca4 100644 --- a/crosswalk/data/entries/DSGAI09.json +++ b/crosswalk/data/entries/DSGAI09.json @@ -20,7 +20,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Hardening", "scope": "Both", "notes": "Sensitive content extracted from multimodal inputs (OCR, transcription) transmitted through standard exfiltration paths" @@ -36,7 +36,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "tier": "Hardening", "scope": "Both", "notes": "Sensitive multimodal content in training data confirmed through membership inference queries" diff --git a/crosswalk/data/entries/DSGAI10.json b/crosswalk/data/entries/DSGAI10.json index 62aec58..b2af642 100644 --- a/crosswalk/data/entries/DSGAI10.json +++ b/crosswalk/data/entries/DSGAI10.json @@ -20,7 +20,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "tier": "Hardening", "scope": "Both", "notes": "Adversary probes synthetic dataset to determine whether specific individuals are re-identifiable" @@ -28,7 +28,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Hardening", "scope": "Both", "notes": "Re-identified individuals from synthetic data extracted via standard exfiltration paths" diff --git a/crosswalk/data/entries/DSGAI11.json b/crosswalk/data/entries/DSGAI11.json index fc00d1a..d92d3fa 100644 --- a/crosswalk/data/entries/DSGAI11.json +++ b/crosswalk/data/entries/DSGAI11.json @@ -28,14 +28,14 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Foundational", "scope": "Both", "notes": "Cross-session data captured and transmitted to adversary through inference API" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI12.json b/crosswalk/data/entries/DSGAI12.json index 9d9c5b2..7d7147a 100644 --- a/crosswalk/data/entries/DSGAI12.json +++ b/crosswalk/data/entries/DSGAI12.json @@ -19,7 +19,7 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -27,7 +27,7 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI13.json b/crosswalk/data/entries/DSGAI13.json index 49f665e..91621e1 100644 --- a/crosswalk/data/entries/DSGAI13.json +++ b/crosswalk/data/entries/DSGAI13.json @@ -20,7 +20,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Foundational", "scope": "Both", "notes": "Vector store content exfiltrated through unauthenticated access or RBAC bypass" @@ -36,7 +36,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0020", - "control_name": "Poison Training Data", + "control_name": "Training Data Poisoning", "tier": "Foundational", "scope": "Both", "notes": "Vector store content poisoned through path traversal or unauthenticated write (CVE-2024-3584)" diff --git a/crosswalk/data/entries/DSGAI14.json b/crosswalk/data/entries/DSGAI14.json index 03a92e4..a89a5db 100644 --- a/crosswalk/data/entries/DSGAI14.json +++ b/crosswalk/data/entries/DSGAI14.json @@ -28,14 +28,14 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Foundational", "scope": "Both", "notes": "Telemetry stores containing sensitive GenAI interaction data exfiltrated through standard data access paths" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI15.json b/crosswalk/data/entries/DSGAI15.json index b785695..c28acc5 100644 --- a/crosswalk/data/entries/DSGAI15.json +++ b/crosswalk/data/entries/DSGAI15.json @@ -19,7 +19,7 @@ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -28,7 +28,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Foundational", "scope": "Both", "notes": "Over-broad context window content exfiltrated through successful injection — adversary retrieves aggregated sensitive data" diff --git a/crosswalk/data/entries/DSGAI16.json b/crosswalk/data/entries/DSGAI16.json index 3e2faa2..0c69b09 100644 --- a/crosswalk/data/entries/DSGAI16.json +++ b/crosswalk/data/entries/DSGAI16.json @@ -20,14 +20,14 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0013", - "control_name": "Discover ML Model Ontology", + "control_name": "Discover AI Model Ontology", "tier": "Foundational", "scope": "Both", "notes": "Adversary learns what data the browser assistant can access across open applications" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI17.json b/crosswalk/data/entries/DSGAI17.json index 0424a18..6594a66 100644 --- a/crosswalk/data/entries/DSGAI17.json +++ b/crosswalk/data/entries/DSGAI17.json @@ -20,7 +20,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0029", - "control_name": "Denial of ML Service", + "control_name": "Denial of AI Service", "tier": "Foundational", "scope": "Both", "notes": "Adversary saturates GenAI pipeline — vector store, RAG retrieval, or inference endpoint rendered unavailable" @@ -35,7 +35,7 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", diff --git a/crosswalk/data/entries/DSGAI18.json b/crosswalk/data/entries/DSGAI18.json index 8c47341..093ba8d 100644 --- a/crosswalk/data/entries/DSGAI18.json +++ b/crosswalk/data/entries/DSGAI18.json @@ -20,7 +20,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "tier": "Hardening", "scope": "Both", "notes": "Adversary determines whether specific sensitive records were used in training through systematic query analysis" @@ -28,7 +28,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Hardening", "scope": "Both", "notes": "Training data confirmed present and partially reconstructed through inference, then exfiltrated" diff --git a/crosswalk/data/entries/DSGAI19.json b/crosswalk/data/entries/DSGAI19.json index 129ca31..dab98ba 100644 --- a/crosswalk/data/entries/DSGAI19.json +++ b/crosswalk/data/entries/DSGAI19.json @@ -27,7 +27,7 @@ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -36,7 +36,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0020", - "control_name": "Poison Training Data", + "control_name": "Training Data Poisoning", "tier": "Foundational", "scope": "Both", "notes": "Adversary-controlled labelling vendor introduces biased or poisoned annotations into training data" diff --git a/crosswalk/data/entries/DSGAI20.json b/crosswalk/data/entries/DSGAI20.json index 24bec1a..99cf6df 100644 --- a/crosswalk/data/entries/DSGAI20.json +++ b/crosswalk/data/entries/DSGAI20.json @@ -28,7 +28,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Hardening", "scope": "Both", "notes": "Query results and model outputs systematically collected and transmitted to adversary infrastructure" diff --git a/crosswalk/data/entries/DSGAI21.json b/crosswalk/data/entries/DSGAI21.json index 28f7a8d..d50f827 100644 --- a/crosswalk/data/entries/DSGAI21.json +++ b/crosswalk/data/entries/DSGAI21.json @@ -28,14 +28,14 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0020", - "control_name": "Poison Training Data", + "control_name": "Training Data Poisoning", "tier": "Hardening", "scope": "Both", "notes": "Adversary introduces false content into RAG corpus through ingestion path — no public publication required" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0031", + "control_id": "AML.T0043", "control_name": "Craft Adversarial Data", "tier": "Hardening", "scope": "Both", diff --git a/crosswalk/data/entries/LLM10.json b/crosswalk/data/entries/LLM10.json index e1f69c3..446b7a1 100644 --- a/crosswalk/data/entries/LLM10.json +++ b/crosswalk/data/entries/LLM10.json @@ -19,7 +19,7 @@ { "framework": "MITRE ATLAS", "control_id": "AML.T0029", - "control_name": "Denial of ML Service", + "control_name": "Denial of AI Service", "tier": "Foundational", "scope": "Both", "url": "https://atlas.mitre.org/techniques/AML.T0029", diff --git a/crosswalk/docs/backlinks.js b/crosswalk/docs/backlinks.js index 0445346..77e2fe9 100644 --- a/crosswalk/docs/backlinks.js +++ b/crosswalk/docs/backlinks.js @@ -1,6 +1,6 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Generated: 2026-05-04 -// Backlinks: 1097 +// Generated: 2026-08-03 +// Backlinks: 1096 window.CROSSWALK_BACKLINKS = [ { "framework": "AIUC-1", @@ -16917,8 +16917,26 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0012", - "control_name": "Obtain Capabilities", + "control_name": "Valid Accounts", "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Exploiting legitimate agent credentials to access AI systems or data pipelines" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Using compromised agent credentials to impersonate trusted agents in A2A channels" + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -16942,7 +16960,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0013", - "control_name": "Discover ML Model Ontology", + "control_name": "Discover AI Model Ontology", "entries": [ { "id": "DSGAI16", @@ -16992,26 +17010,8 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0016", - "control_name": "Exfiltration via AI Inference API", + "control_name": "Extract ML Model", "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Using compromised agent credentials to exfiltrate data through inference API" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Intercepting inter-agent messages to exfiltrate sensitive context passed between agents" - }, { "id": "DSGAI20", "name": "Model Exfiltration and IP Replication", @@ -17026,7 +17026,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0018", - "control_name": "Backdoor ML Model", + "control_name": "Manipulate AI Model", "entries": [ { "id": "DSGAI04", @@ -17125,31 +17125,6 @@ window.CROSSWALK_BACKLINKS = [ } ] }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0022", - "control_name": "Valid Accounts", - "entries": [ - { - "id": "ASI03", - "name": "Identity and Privilege Abuse", - "source_list": "Agentic-Top10-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Exploiting legitimate agent credentials to access AI systems or data pipelines" - }, - { - "id": "ASI07", - "name": "Insecure Inter-Agent Communications", - "source_list": "Agentic-Top10-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "Using compromised agent credentials to impersonate trusted agents in A2A channels" - } - ] - }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024", @@ -17171,14 +17146,23 @@ window.CROSSWALK_BACKLINKS = [ "severity": "Critical", "tier": "Foundational", "scope": "Both", - "notes": "Reconstructing sensitive data accessible to the agent through credential abuse" + "notes": "Using compromised agent credentials to exfiltrate data through inference API" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Intercepting inter-agent messages to exfiltrate sensitive context passed between agents" } ] }, { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "entries": [ { "id": "DSGAI01", @@ -17352,7 +17336,7 @@ window.CROSSWALK_BACKLINKS = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0029", - "control_name": "Denial of ML Service", + "control_name": "Denial of AI Service", "entries": [ { "id": "LLM10", @@ -17412,33 +17396,6 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Embedding hidden trigger-response patterns in model via poisoned training data" - }, - { - "id": "DSGAI04", - "name": "Data Model and Artifact Poisoning", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Hardening", - "scope": "Both", - "notes": "Adversarially crafted training examples designed to produce specific model behaviours without detection" - }, - { - "id": "DSGAI05", - "name": "Data Integrity and Validation Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Payloads crafted to pass syntactic validation while embedding malicious semantic content" - }, - { - "id": "DSGAI21", - "name": "Disinformation via Data Poisoning", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Hardening", - "scope": "Both", - "notes": "False content crafted to appear authoritative and rank highly in semantic similarity searches" } ] }, @@ -17643,6 +17600,94 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "MITRE ATLAS", + "control_id": "AML.T0036", + "control_name": "Data from Information Repositories", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Sensitive data pasted into shadow AI tools ends up in external data stores accessible to the AI service provider" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Context data flowing through tool integrations captured and transmitted to adversary" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Ungoverned embedding stores and agent memory databases accessed without access controls" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Regulatory violations often arise from ungoverned data repositories — adversary exploits what compliance missed" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Database accessed through LLM-generated queries — adversary extracts sensitive records without direct database access" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Observability databases and log stores accessed as information repositories — sensitive content available at scale" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Browser assistant accesses sensitive data across tabs and applications — adversary controls assistant to exfiltrate" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Pipeline failures may expose data through error messages or fallback paths that lack normal access controls" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Labelling vendor's data stores containing sensitive annotation tasks accessed as information repositories" + } + ] + }, { "framework": "MITRE ATLAS", "control_id": "AML.T0037", @@ -17731,6 +17776,33 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Identifying and mapping inter-agent communication endpoints for targeting" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Adversarially crafted training examples designed to produce specific model behaviours without detection" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Payloads crafted to pass syntactic validation while embedding malicious semantic content" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "False content crafted to appear authoritative and rank highly in semantic similarity searches" } ] }, @@ -17831,14 +17903,7 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Foundational", "scope": "Both", "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users" - } - ] - }, - { - "framework": "MITRE ATLAS", - "control_id": "AML.T0051", - "control_name": "Exploit Public-Facing Application", - "entries": [ + }, { "id": "DSGAI02", "name": "Agent Identity and Credential Exposure", @@ -18053,87 +18118,6 @@ window.CROSSWALK_BACKLINKS = [ "tier": "Hardening", "scope": "Both", "notes": "Compromised agent maintains persistent access and hidden execution across sessions" - }, - { - "id": "DSGAI03", - "name": "Shadow AI and Unsanctioned Data Flows", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Sensitive data pasted into shadow AI tools ends up in external data stores accessible to the AI service provider" - }, - { - "id": "DSGAI06", - "name": "Tool Plugin and Agent Data Exchange", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Context data flowing through tool integrations captured and transmitted to adversary" - }, - { - "id": "DSGAI07", - "name": "Data Governance and Lifecycle", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Ungoverned embedding stores and agent memory databases accessed without access controls" - }, - { - "id": "DSGAI08", - "name": "Non-Compliance and Regulatory Violations", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Regulatory violations often arise from ungoverned data repositories — adversary exploits what compliance missed" - }, - { - "id": "DSGAI12", - "name": "Unsafe Natural Language Data Gateways", - "source_list": "DSGAI-2026", - "severity": "Critical", - "tier": "Foundational", - "scope": "Both", - "notes": "Database accessed through LLM-generated queries — adversary extracts sensitive records without direct database access" - }, - { - "id": "DSGAI14", - "name": "Excessive Telemetry and Monitoring Leakage", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Observability databases and log stores accessed as information repositories — sensitive content available at scale" - }, - { - "id": "DSGAI16", - "name": "Endpoint and Browser Overreach", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Browser assistant accesses sensitive data across tabs and applications — adversary controls assistant to exfiltrate" - }, - { - "id": "DSGAI17", - "name": "Data Availability and Resilience Failures", - "source_list": "DSGAI-2026", - "severity": "High", - "tier": "Foundational", - "scope": "Both", - "notes": "Pipeline failures may expose data through error messages or fallback paths that lack normal access controls" - }, - { - "id": "DSGAI19", - "name": "Human-in-Loop and Labeler Overexposure", - "source_list": "DSGAI-2026", - "severity": "Medium", - "tier": "Foundational", - "scope": "Both", - "notes": "Labelling vendor's data stores containing sensitive annotation tasks accessed as information repositories" } ] }, diff --git a/crosswalk/docs/data.js b/crosswalk/docs/data.js index ec826b4..a36f3f1 100644 --- a/crosswalk/docs/data.js +++ b/crosswalk/docs/data.js @@ -1,6 +1,6 @@ // Auto-generated by scripts/generate.js — do not edit manually // Source: OWASP GenAI Crosswalk v1.5.2 -// Generated: 2026-05-04 +// Generated: 2026-08-03 // Entries: 41 window.CROSSWALK_DATA = [ { @@ -7667,7 +7667,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0029", - "control_name": "Denial of ML Service", + "control_name": "Denial of AI Service", "tier": "Foundational", "scope": "Both", "url": "https://atlas.mitre.org/techniques/AML.T0029", @@ -10394,20 +10394,20 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0022", + "control_id": "AML.T0012", "control_name": "Valid Accounts", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0022", + "url": "https://atlas.mitre.org/techniques/AML.T0012", "notes": "Exploiting legitimate agent credentials to access AI systems or data pipelines" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0016", + "control_id": "AML.T0024", "control_name": "Exfiltration via AI Inference API", "tier": "Foundational", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0016", + "url": "https://atlas.mitre.org/techniques/AML.T0024", "notes": "Using compromised agent credentials to exfiltrate data through inference API" }, { @@ -13933,20 +13933,20 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0022", + "control_id": "AML.T0012", "control_name": "Valid Accounts", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0022", + "url": "https://atlas.mitre.org/techniques/AML.T0012", "notes": "Using compromised agent credentials to impersonate trusted agents in A2A channels" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0016", + "control_id": "AML.T0024", "control_name": "Exfiltration via AI Inference API", "tier": "Hardening", "scope": "Both", - "url": "https://atlas.mitre.org/techniques/AML.T0016", + "url": "https://atlas.mitre.org/techniques/AML.T0024", "notes": "Intercepting inter-agent messages to exfiltrate sensitive context passed between agents" }, { @@ -14732,7 +14732,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0029", - "control_name": "Denial of ML Service", + "control_name": "Denial of AI Service", "tier": "Foundational", "scope": "Both", "url": "https://atlas.mitre.org/techniques/AML.T0029", @@ -17278,7 +17278,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "tier": "Foundational", "scope": "Both", "notes": "Adversary determines whether specific sensitive records were used in training — confirms presence of target data" @@ -17286,7 +17286,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Foundational", "scope": "Both", "notes": "Sensitive content in LLM outputs, logs, or observability pipelines captured and transmitted to adversary" @@ -18178,7 +18178,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -18934,7 +18934,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -18942,7 +18942,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -19622,7 +19622,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0020", - "control_name": "Poison Training Data", + "control_name": "Training Data Poisoning", "tier": "Hardening", "scope": "Both", "notes": "Adversary introduces malicious data into training pipeline — corrupts model behaviour in ways baked into weights" @@ -19630,14 +19630,14 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0018", - "control_name": "Backdoor ML Model", + "control_name": "Manipulate AI Model", "tier": "Hardening", "scope": "Both", "notes": "Hidden functionality embedded in model weights — triggered by specific inputs, invisible to standard testing" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0031", + "control_id": "AML.T0043", "control_name": "Craft Adversarial Data", "tier": "Hardening", "scope": "Both", @@ -20404,7 +20404,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0020", - "control_name": "Poison Training Data", + "control_name": "Training Data Poisoning", "tier": "Foundational", "scope": "Both", "notes": "Adversarially crafted payloads bypass ingestion validation to corrupt training or RAG data" @@ -20412,14 +20412,14 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0018", - "control_name": "Backdoor ML Model", + "control_name": "Manipulate AI Model", "tier": "Foundational", "scope": "Both", "notes": "Path traversal in snapshot imports (CVE-2024-3584) enables write to model host — backdoor installation path" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0031", + "control_id": "AML.T0043", "control_name": "Craft Adversarial Data", "tier": "Foundational", "scope": "Both", @@ -21134,7 +21134,7 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -21142,7 +21142,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -21828,14 +21828,14 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "tier": "Foundational", "scope": "Both", "notes": "Ungoverned training data status — adversary determines what sensitive data is in scope without classification barriers" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -22505,7 +22505,7 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -22513,7 +22513,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -23300,7 +23300,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Hardening", "scope": "Both", "notes": "Sensitive content extracted from multimodal inputs (OCR, transcription) transmitted through standard exfiltration paths" @@ -23316,7 +23316,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "tier": "Hardening", "scope": "Both", "notes": "Sensitive multimodal content in training data confirmed through membership inference queries" @@ -24017,7 +24017,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "tier": "Hardening", "scope": "Both", "notes": "Adversary probes synthetic dataset to determine whether specific individuals are re-identifiable" @@ -24025,7 +24025,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Hardening", "scope": "Both", "notes": "Re-identified individuals from synthetic data extracted via standard exfiltration paths" @@ -24670,14 +24670,14 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Foundational", "scope": "Both", "notes": "Cross-session data captured and transmitted to adversary through inference API" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -25348,7 +25348,7 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -25356,7 +25356,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -26056,7 +26056,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Foundational", "scope": "Both", "notes": "Vector store content exfiltrated through unauthenticated access or RBAC bypass" @@ -26072,7 +26072,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0020", - "control_name": "Poison Training Data", + "control_name": "Training Data Poisoning", "tier": "Foundational", "scope": "Both", "notes": "Vector store content poisoned through path traversal or unauthenticated write (CVE-2024-3584)" @@ -26782,14 +26782,14 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Foundational", "scope": "Both", "notes": "Telemetry stores containing sensitive GenAI interaction data exfiltrated through standard data access paths" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -27506,7 +27506,7 @@ window.CROSSWALK_DATA = [ "mappings": [ { "framework": "MITRE ATLAS", - "control_id": "AML.T0051", + "control_id": "AML.T0049", "control_name": "Exploit Public-Facing Application", "tier": "Foundational", "scope": "Both", @@ -27515,7 +27515,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Foundational", "scope": "Both", "notes": "Over-broad context window content exfiltrated through successful injection — adversary retrieves aggregated sensitive data" @@ -28192,14 +28192,14 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0013", - "control_name": "Discover ML Model Ontology", + "control_name": "Discover AI Model Ontology", "tier": "Foundational", "scope": "Both", "notes": "Adversary learns what data the browser assistant can access across open applications" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -28914,7 +28914,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0029", - "control_name": "Denial of ML Service", + "control_name": "Denial of AI Service", "tier": "Foundational", "scope": "Both", "notes": "Adversary saturates GenAI pipeline — vector store, RAG retrieval, or inference endpoint rendered unavailable" @@ -28929,7 +28929,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -29658,7 +29658,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0024.000", - "control_name": "Membership Inference", + "control_name": "Infer Training Data Membership", "tier": "Hardening", "scope": "Both", "notes": "Adversary determines whether specific sensitive records were used in training through systematic query analysis" @@ -29666,7 +29666,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Hardening", "scope": "Both", "notes": "Training data confirmed present and partially reconstructed through inference, then exfiltrated" @@ -30278,7 +30278,7 @@ window.CROSSWALK_DATA = [ }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0057", + "control_id": "AML.T0036", "control_name": "Data from Information Repositories", "tier": "Foundational", "scope": "Both", @@ -30287,7 +30287,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0020", - "control_name": "Poison Training Data", + "control_name": "Training Data Poisoning", "tier": "Foundational", "scope": "Both", "notes": "Adversary-controlled labelling vendor introduces biased or poisoned annotations into training data" @@ -30959,7 +30959,7 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0025", - "control_name": "Exfiltrate via Cyber Means", + "control_name": "Exfiltration via Cyber Means", "tier": "Hardening", "scope": "Both", "notes": "Query results and model outputs systematically collected and transmitted to adversary infrastructure" @@ -31648,14 +31648,14 @@ window.CROSSWALK_DATA = [ { "framework": "MITRE ATLAS", "control_id": "AML.T0020", - "control_name": "Poison Training Data", + "control_name": "Training Data Poisoning", "tier": "Hardening", "scope": "Both", "notes": "Adversary introduces false content into RAG corpus through ingestion path — no public publication required" }, { "framework": "MITRE ATLAS", - "control_id": "AML.T0031", + "control_id": "AML.T0043", "control_name": "Craft Adversarial Data", "tier": "Hardening", "scope": "Both", diff --git a/crosswalk/docs/frameworks-registry.js b/crosswalk/docs/frameworks-registry.js index d48f3f6..ed2c088 100644 --- a/crosswalk/docs/frameworks-registry.js +++ b/crosswalk/docs/frameworks-registry.js @@ -1,5 +1,5 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Generated: 2026-05-04 +// Generated: 2026-08-03 // Frameworks: 25 window.CROSSWALK_FRAMEWORKS = [ { diff --git a/crosswalk/docs/incidents.js b/crosswalk/docs/incidents.js index 6b1c180..8806ac6 100644 --- a/crosswalk/docs/incidents.js +++ b/crosswalk/docs/incidents.js @@ -1,5 +1,5 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Generated: 2026-05-04 +// Generated: 2026-08-03 // Incidents: 114 window.CROSSWALK_INCIDENTS = [ { diff --git a/crosswalk/dsgai-2026/DSGAI_MITREATLAS.md b/crosswalk/dsgai-2026/DSGAI_MITREATLAS.md index 2cd3310..148f9af 100644 --- a/crosswalk/dsgai-2026/DSGAI_MITREATLAS.md +++ b/crosswalk/dsgai-2026/DSGAI_MITREATLAS.md @@ -68,26 +68,26 @@ goal) and techniques (how they achieve it): | ID | Name | Severity | Primary ATLAS Techniques | Tier | |---|---|---|---|---| | DSGAI01 | Sensitive Data Leakage | Critical | AML.T0025, AML.T0024.000, AML.T0035 | Foundational–Advanced | -| DSGAI02 | Agent Identity & Credential Exposure | Critical | AML.T0012, AML.T0035, AML.T0051 | Foundational–Advanced | -| DSGAI03 | Shadow AI & Unsanctioned Data Flows | High | AML.T0012, AML.T0051, AML.T0057 | Foundational–Hardening | -| DSGAI04 | Data, Model & Artifact Poisoning | Critical | AML.T0020, AML.T0032, AML.T0031 | Hardening–Advanced | -| DSGAI05 | Data Integrity & Validation Failures | High | AML.T0020, AML.T0018, AML.T0031 | Foundational–Hardening | -| DSGAI06 | Tool, Plugin & Agent Data Exchange | High | AML.T0051, AML.T0057, AML.T0035 | Foundational–Hardening | -| DSGAI07 | Data Governance, Lifecycle & Classification | High | AML.T0035, AML.T0024.000, AML.T0057 | Foundational–Advanced | -| DSGAI08 | Non-Compliance & Regulatory Violations | High | AML.T0057, AML.T0051, AML.T0035 | Foundational–Advanced | +| DSGAI02 | Agent Identity & Credential Exposure | Critical | AML.T0012, AML.T0035, AML.T0049 | Foundational–Advanced | +| DSGAI03 | Shadow AI & Unsanctioned Data Flows | High | AML.T0012, AML.T0049, AML.T0036 | Foundational–Hardening | +| DSGAI04 | Data, Model & Artifact Poisoning | Critical | AML.T0020, AML.T0032, AML.T0043 | Hardening–Advanced | +| DSGAI05 | Data Integrity & Validation Failures | High | AML.T0020, AML.T0018, AML.T0043 | Foundational–Hardening | +| DSGAI06 | Tool, Plugin & Agent Data Exchange | High | AML.T0049, AML.T0036, AML.T0035 | Foundational–Hardening | +| DSGAI07 | Data Governance, Lifecycle & Classification | High | AML.T0035, AML.T0024.000, AML.T0036 | Foundational–Advanced | +| DSGAI08 | Non-Compliance & Regulatory Violations | High | AML.T0036, AML.T0049, AML.T0035 | Foundational–Advanced | | DSGAI09 | Multimodal Cross-Channel Data Leakage | High | AML.T0025, AML.T0035, AML.T0024.000 | Hardening–Advanced | | DSGAI10 | Synthetic Data & Anonymisation Pitfalls | Medium | AML.T0024.000, AML.T0025, AML.T0035 | Hardening–Advanced | -| DSGAI11 | Cross-Context Conversation Bleed | High | AML.T0025, AML.T0035, AML.T0051 | Foundational–Hardening | -| DSGAI12 | Unsafe NL Data Gateways | Critical | AML.T0051, AML.T0057, AML.T0035 | Foundational–Advanced | +| DSGAI11 | Cross-Context Conversation Bleed | High | AML.T0025, AML.T0035, AML.T0049 | Foundational–Hardening | +| DSGAI12 | Unsafe NL Data Gateways | Critical | AML.T0049, AML.T0036, AML.T0035 | Foundational–Advanced | | DSGAI13 | Vector Store Platform Security | High | AML.T0025, AML.T0035, AML.T0020 | Foundational–Hardening | -| DSGAI14 | Excessive Telemetry & Monitoring Leakage | High | AML.T0035, AML.T0025, AML.T0057 | Foundational–Hardening | -| DSGAI15 | Over-Broad Context Windows | High | AML.T0051, AML.T0025, AML.T0035 | Foundational–Hardening | -| DSGAI16 | Endpoint & Browser Assistant Overreach | High | AML.T0013, AML.T0057, AML.T0035 | Foundational–Hardening | -| DSGAI17 | Data Availability & Resilience Failures | High | AML.T0029, AML.T0034, AML.T0057 | Foundational–Advanced | +| DSGAI14 | Excessive Telemetry & Monitoring Leakage | High | AML.T0035, AML.T0025, AML.T0036 | Foundational–Hardening | +| DSGAI15 | Over-Broad Context Windows | High | AML.T0049, AML.T0025, AML.T0035 | Foundational–Hardening | +| DSGAI16 | Endpoint & Browser Assistant Overreach | High | AML.T0013, AML.T0036, AML.T0035 | Foundational–Hardening | +| DSGAI17 | Data Availability & Resilience Failures | High | AML.T0029, AML.T0034, AML.T0036 | Foundational–Advanced | | DSGAI18 | Inference & Data Reconstruction | High | AML.T0024.000, AML.T0025, AML.T0027 | Hardening–Advanced | -| DSGAI19 | Human-in-Loop & Labeler Overexposure | Medium | AML.T0035, AML.T0057, AML.T0020 | Foundational–Hardening | +| DSGAI19 | Human-in-Loop & Labeler Overexposure | Medium | AML.T0035, AML.T0036, AML.T0020 | Foundational–Hardening | | DSGAI20 | Model Exfiltration & IP Replication | High | AML.T0016, AML.T0025, AML.T0034 | Hardening–Advanced | -| DSGAI21 | Disinformation via Data Poisoning | High | AML.T0045, AML.T0020, AML.T0031 | Hardening–Advanced | +| DSGAI21 | Disinformation via Data Poisoning | High | AML.T0045, AML.T0020, AML.T0043 | Hardening–Advanced | --- @@ -145,8 +145,8 @@ authorised to access. | Technique | ID | Tactic | How it applies | |---|---|---|---| | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Adversary queries LLM to extract sensitive data from training corpus, RAG store, or prompt cache through crafted inference queries | -| Membership Inference | AML.T0024.000 | Exfiltration | Adversary determines whether specific sensitive records were used in training — confirms presence of target data | -| Exfiltrate via Cyber Means | AML.T0025 | Exfiltration | Sensitive content in LLM outputs, logs, or observability pipelines captured and transmitted to adversary | +| Infer Training Data Membership | AML.T0024.000 | Exfiltration | Adversary determines whether specific sensitive records were used in training — confirms presence of target data | +| Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Sensitive content in LLM outputs, logs, or observability pipelines captured and transmitted to adversary | #### Real-world ATLAS cases @@ -201,7 +201,7 @@ access to AI systems and downstream services. |---|---|---|---| | Obtain Capabilities | AML.T0012 | Resource Development | Adversary acquires agent credentials through memory inspection, log analysis, or tool payload capture | | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Agent credentials embedded in inference requests or responses extracted by adversary | -| Exploit Public-Facing Application | AML.T0051 | Initial Access | Agent API endpoints exploited to extract credentials or elevate access | +| Exploit Public-Facing Application | AML.T0049 | Initial Access | Agent API endpoints exploited to extract credentials or elevate access | #### Mitigations mapped to ATLAS @@ -214,7 +214,7 @@ access to AI systems and downstream services. inference outputs, logs, or tool payloads **Hardening** -- Counter AML.T0051: Least-privilege credential scope — +- Counter AML.T0049: Least-privilege credential scope — stolen agent credential provides minimum viable access, limiting lateral movement blast radius - Credential anomaly detection — unusual access patterns @@ -242,21 +242,21 @@ external AI services voluntarily. | Technique | ID | Tactic | How it applies | |---|---|---|---| | Obtain Capabilities | AML.T0012 | Resource Development | Shadow AI tools are external AI capabilities the adversary may already operate or compromise | -| Exploit Public-Facing Application | AML.T0051 | Initial Access | Unapproved AI services may themselves be adversary-controlled or compromised | -| Data from Information Repositories | AML.T0057 | Exfiltration | Sensitive data pasted into shadow AI tools ends up in external data stores accessible to the AI service provider | +| Exploit Public-Facing Application | AML.T0049 | Initial Access | Unapproved AI services may themselves be adversary-controlled or compromised | +| Data from Information Repositories | AML.T0036 | Exfiltration | Sensitive data pasted into shadow AI tools ends up in external data stores accessible to the AI service provider | #### Mitigations mapped to ATLAS **Foundational** -- Counter AML.T0051: Approved AI tool programme — +- Counter AML.T0049: Approved AI tool programme — employees use vetted services, not adversary-controlled or compromised external AI endpoints -- Counter AML.T0057: DLP on known AI SaaS endpoints — +- Counter AML.T0036: DLP on known AI SaaS endpoints — sensitive data flows to unapproved AI services blocked before leaving the corporate perimeter **Hardening** -- Counter AML.T0057: Continuous shadow AI discovery — +- Counter AML.T0036: Continuous shadow AI discovery — detect data flows to unapproved AI services across endpoints, network egress, and SaaS access logs @@ -279,9 +279,9 @@ canonical ATLAS descriptions of this attack class. | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Poison Training Data | AML.T0020 | ML Attack Staging | Adversary introduces malicious data into training pipeline — corrupts model behaviour in ways baked into weights | -| Backdoor ML Model | AML.T0018 | ML Attack Staging | Hidden functionality embedded in model weights — triggered by specific inputs, invisible to standard testing | -| Craft Adversarial Data | AML.T0031 | ML Attack Staging | Adversarially crafted training examples designed to produce specific model behaviours without detection | +| Training Data Poisoning | AML.T0020 | ML Attack Staging | Adversary introduces malicious data into training pipeline — corrupts model behaviour in ways baked into weights | +| Manipulate AI Model | AML.T0018 | ML Attack Staging | Hidden functionality embedded in model weights — triggered by specific inputs, invisible to standard testing | +| Craft Adversarial Data | AML.T0043 | ML Attack Staging | Adversarially crafted training examples designed to produce specific model behaviours without detection | #### Real-world ATLAS cases @@ -301,7 +301,7 @@ canonical ATLAS descriptions of this attack class. gate before any production promotion **Hardening** -- Counter AML.T0031: Adversarial data detection in +- Counter AML.T0043: Adversarial data detection in training pipeline — statistical anomaly detection flags adversarially crafted training examples - Model integrity verification at deployment — @@ -333,9 +333,9 @@ data that enters the AI system. | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Poison Training Data | AML.T0020 | ML Attack Staging | Adversarially crafted payloads bypass ingestion validation to corrupt training or RAG data | -| Backdoor ML Model | AML.T0018 | ML Attack Staging | Path traversal in snapshot imports (CVE-2024-3584) enables write to model host — backdoor installation path | -| Craft Adversarial Data | AML.T0031 | ML Attack Staging | Payloads crafted to pass syntactic validation while embedding malicious semantic content | +| Training Data Poisoning | AML.T0020 | ML Attack Staging | Adversarially crafted payloads bypass ingestion validation to corrupt training or RAG data | +| Manipulate AI Model | AML.T0018 | ML Attack Staging | Path traversal in snapshot imports (CVE-2024-3584) enables write to model host — backdoor installation path | +| Craft Adversarial Data | AML.T0043 | ML Attack Staging | Payloads crafted to pass syntactic validation while embedding malicious semantic content | #### Mitigations mapped to ATLAS @@ -348,7 +348,7 @@ data that enters the AI system. is an AML.T0018 enabler in vector database environments **Hardening** -- Counter AML.T0031: Semantic injection detection on +- Counter AML.T0043: Semantic injection detection on ingestion payloads — adversarially crafted content detected before entering RAG corpus or training data @@ -372,8 +372,8 @@ capture context data that flows through the agent. | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Exploit Public-Facing Application | AML.T0051 | Initial Access | Malicious MCP server exploits trust relationship with agent to capture context payloads | -| Data from Information Repositories | AML.T0057 | Exfiltration | Context data flowing through tool integrations captured and transmitted to adversary | +| Exploit Public-Facing Application | AML.T0049 | Initial Access | Malicious MCP server exploits trust relationship with agent to capture context payloads | +| Data from Information Repositories | AML.T0036 | Exfiltration | Context data flowing through tool integrations captured and transmitted to adversary | | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Tool API acts as exfiltration channel — sensitive context content captured in tool call payloads | #### Real-world ATLAS cases @@ -385,10 +385,10 @@ capture context data that flows through the agent. #### Mitigations mapped to ATLAS **Foundational** -- Counter AML.T0051: Tool and MCP server security +- Counter AML.T0049: Tool and MCP server security assessment before deployment — adversary-controlled or compromised tools rejected before agent access -- Counter AML.T0057: Context minimisation — tools +- Counter AML.T0036: Context minimisation — tools receive minimum payload, not full context history that would maximise exfiltration value @@ -417,13 +417,13 @@ exploit data stores that lack access controls. | Technique | ID | Tactic | How it applies | |---|---|---|---| | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Ungoverned derived assets (embeddings, caches) accessible through inference API without classification controls | -| Membership Inference | AML.T0024.000 | Exfiltration | Ungoverned training data status — adversary determines what sensitive data is in scope without classification barriers | -| Data from Information Repositories | AML.T0057 | Exfiltration | Ungoverned embedding stores and agent memory databases accessed without access controls | +| Infer Training Data Membership | AML.T0024.000 | Exfiltration | Ungoverned training data status — adversary determines what sensitive data is in scope without classification barriers | +| Data from Information Repositories | AML.T0036 | Exfiltration | Ungoverned embedding stores and agent memory databases accessed without access controls | #### Mitigations mapped to ATLAS **Foundational** -- Counter AML.T0057: Extend asset inventory to all +- Counter AML.T0036: Extend asset inventory to all GenAI-derived assets — ungoverned stores cannot be protected if they are not known to exist - Counter AML.T0035: Classification propagation to @@ -455,17 +455,17 @@ gaps to maximise harm from incidents they cause. | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Data from Information Repositories | AML.T0057 | Exfiltration | Regulatory violations often arise from ungoverned data repositories — adversary exploits what compliance missed | -| Exploit Public-Facing Application | AML.T0051 | Initial Access | Non-compliant AI deployments may lack security controls that compliance would have required | +| Data from Information Repositories | AML.T0036 | Exfiltration | Regulatory violations often arise from ungoverned data repositories — adversary exploits what compliance missed | +| Exploit Public-Facing Application | AML.T0049 | Initial Access | Non-compliant AI deployments may lack security controls that compliance would have required | | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Regulatory violations in training data scope make inference API exfiltration more damaging | #### Mitigations mapped to ATLAS **Foundational** -- Counter AML.T0051: Regulatory scoping assessment +- Counter AML.T0049: Regulatory scoping assessment for all GenAI deployments — compliance requirements drive security controls that limit adversary access -- Counter AML.T0057: Data governance programme +- Counter AML.T0036: Data governance programme identifies all data repositories — compliance extends access controls to previously ungoverned stores @@ -487,9 +487,9 @@ perspective, multimodal inputs are a data exfiltration staging area. | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Exfiltrate via Cyber Means | AML.T0025 | Exfiltration | Sensitive content extracted from multimodal inputs (OCR, transcription) transmitted through standard exfiltration paths | +| Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Sensitive content extracted from multimodal inputs (OCR, transcription) transmitted through standard exfiltration paths | | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Multimodal content processed by AI system extracted through inference API queries referencing extracted content | -| Membership Inference | AML.T0024.000 | Exfiltration | Sensitive multimodal content in training data confirmed through membership inference queries | +| Infer Training Data Membership | AML.T0024.000 | Exfiltration | Sensitive multimodal content in training data confirmed through membership inference queries | #### Mitigations mapped to ATLAS @@ -525,8 +525,8 @@ confirm re-identification is possible. | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Membership Inference | AML.T0024.000 | Exfiltration | Adversary probes synthetic dataset to determine whether specific individuals are re-identifiable | -| Exfiltrate via Cyber Means | AML.T0025 | Exfiltration | Re-identified individuals from synthetic data extracted via standard exfiltration paths | +| Infer Training Data Membership | AML.T0024.000 | Exfiltration | Adversary probes synthetic dataset to determine whether specific individuals are re-identifiable | +| Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Re-identified individuals from synthetic data extracted via standard exfiltration paths | | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Synthetic training data membership confirmed and specific records reconstructed through inference API | #### Mitigations mapped to ATLAS @@ -562,13 +562,13 @@ where session isolation failure becomes a data access path. | Technique | ID | Tactic | How it applies | |---|---|---|---| | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Adversary crafts queries designed to retrieve content from other users' sessions through session isolation failure | -| Exfiltrate via Cyber Means | AML.T0025 | Exfiltration | Cross-session data captured and transmitted to adversary through inference API | -| Exploit Public-Facing Application | AML.T0051 | Initial Access | Session isolation vulnerability in multi-tenant GenAI deployment exploited to access other users' data | +| Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Cross-session data captured and transmitted to adversary through inference API | +| Exploit Public-Facing Application | AML.T0049 | Initial Access | Session isolation vulnerability in multi-tenant GenAI deployment exploited to access other users' data | #### Mitigations mapped to ATLAS **Foundational** -- Counter AML.T0051: Strict session isolation — +- Counter AML.T0049: Strict session isolation — adversary crafting cross-session queries encounters access controls that reject retrieval from other sessions - Counter AML.T0035: Per-user RAG namespaces — @@ -594,16 +594,16 @@ where session isolation failure becomes a data access path. LLM-to-database interfaces collapse the security boundary between user input and database logic. From an ATLAS perspective, this is -AML.T0051 (Exploit Public-Facing Application) combined with -AML.T0057 (Data from Information Repositories) — the adversary +AML.T0049 (Exploit Public-Facing Application) combined with +AML.T0036 (Data from Information Repositories) — the adversary exploits the AI interface to access data stores. #### ATLAS technique mapping | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Exploit Public-Facing Application | AML.T0051 | Initial Access | NL gateway interface exploited through crafted natural language to generate destructive or exfiltrating queries | -| Data from Information Repositories | AML.T0057 | Exfiltration | Database accessed through LLM-generated queries — adversary extracts sensitive records without direct database access | +| Exploit Public-Facing Application | AML.T0049 | Initial Access | NL gateway interface exploited through crafted natural language to generate destructive or exfiltrating queries | +| Data from Information Repositories | AML.T0036 | Exfiltration | Database accessed through LLM-generated queries — adversary extracts sensitive records without direct database access | | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | LLM inference API used to generate queries that extract data from connected databases | #### Real-world ATLAS cases @@ -615,11 +615,11 @@ exploits the AI interface to access data stores. #### Mitigations mapped to ATLAS **Foundational** -- Counter AML.T0051: Per-user query execution — +- Counter AML.T0049: Per-user query execution — adversary cannot escalate query privileges through natural language input when queries execute under requesting user's permissions only -- Counter AML.T0057: Query allowlisting and +- Counter AML.T0036: Query allowlisting and parameterised execution — NL gateway cannot generate destructive or bulk extraction queries outside the approved pattern set @@ -630,7 +630,7 @@ exploits the AI interface to access data stores. adversary completes data retrieval **Advanced** -- Red team AML.T0051/AML.T0057: Adversarial NL-to-SQL +- Red team AML.T0049/AML.T0036: Adversarial NL-to-SQL testing — attempt bulk extraction and destructive queries through natural language against your specific deployment @@ -655,9 +655,9 @@ Repositories). | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Exfiltrate via Cyber Means | AML.T0025 | Exfiltration | Vector store content exfiltrated through unauthenticated access or RBAC bypass | +| Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Vector store content exfiltrated through unauthenticated access or RBAC bypass | | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Embeddings and retrieved passages extracted through vector store query API | -| Poison Training Data | AML.T0020 | ML Attack Staging | Vector store content poisoned through path traversal or unauthenticated write (CVE-2024-3584) | +| Training Data Poisoning | AML.T0020 | ML Attack Staging | Vector store content poisoned through path traversal or unauthenticated write (CVE-2024-3584) | #### Real-world ATLAS cases @@ -701,13 +701,13 @@ production data may access the same data through poorly secured logs. | Technique | ID | Tactic | How it applies | |---|---|---|---| | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Sensitive inference inputs and outputs captured in telemetry stores accessed through weaker controls | -| Exfiltrate via Cyber Means | AML.T0025 | Exfiltration | Telemetry stores containing sensitive GenAI interaction data exfiltrated through standard data access paths | -| Data from Information Repositories | AML.T0057 | Exfiltration | Observability databases and log stores accessed as information repositories — sensitive content available at scale | +| Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Telemetry stores containing sensitive GenAI interaction data exfiltrated through standard data access paths | +| Data from Information Repositories | AML.T0036 | Exfiltration | Observability databases and log stores accessed as information repositories — sensitive content available at scale | #### Mitigations mapped to ATLAS **Foundational** -- Counter AML.T0057: Same access controls on telemetry +- Counter AML.T0036: Same access controls on telemetry stores as production data — telemetry is not a lower-risk alternative exfiltration path for adversaries - Counter AML.T0025: PAN masking and PII redaction @@ -717,7 +717,7 @@ production data may access the same data through poorly secured logs. **Hardening** - Counter AML.T0035: Short TTL for debug traces — sensitive content in telemetry stores is only accessible - for defined window, reducing AML.T0057 value + for defined window, reducing AML.T0036 value #### Cross-references - DSGAI 2026: DSGAI01 Sensitive Data Leakage, DSGAI07 Data Governance @@ -731,15 +731,15 @@ production data may access the same data through poorly secured logs. Excessive context injection aggregates data from multiple trust domains into a flat namespace. From an ATLAS perspective, over-broad context -windows amplify the impact of AML.T0051 (Exploit Public-Facing +windows amplify the impact of AML.T0049 (Exploit Public-Facing Application) by maximising the data accessible to an injection attack. #### ATLAS technique mapping | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Exploit Public-Facing Application | AML.T0051 | Initial Access | Prompt injection via LLM interface accesses all content injected into over-broad context window | -| Exfiltrate via Cyber Means | AML.T0025 | Exfiltration | Over-broad context window content exfiltrated through successful injection — adversary retrieves aggregated sensitive data | +| Exploit Public-Facing Application | AML.T0049 | Initial Access | Prompt injection via LLM interface accesses all content injected into over-broad context window | +| Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Over-broad context window content exfiltrated through successful injection — adversary retrieves aggregated sensitive data | | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Inference API queries designed to surface maximum context window content through crafted prompts | #### Mitigations mapped to ATLAS @@ -748,9 +748,9 @@ Application) by maximising the data accessible to an injection attack. - Counter AML.T0035: Minimum-necessary context injection — adversary gains access only to minimum relevant content, not aggregated cross-trust-domain data -- Counter AML.T0051: Classification ceiling tracking +- Counter AML.T0049: Classification ceiling tracking in context window — highest classification of any - document drives response handling, limiting AML.T0051 + document drives response handling, limiting AML.T0049 exfiltration value #### Cross-references @@ -773,8 +773,8 @@ compromises or controls the assistant. | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Discover ML Model Ontology | AML.T0013 | Reconnaissance | Adversary learns what data the browser assistant can access across open applications | -| Data from Information Repositories | AML.T0057 | Exfiltration | Browser assistant accesses sensitive data across tabs and applications — adversary controls assistant to exfiltrate | +| Discover AI Model Ontology | AML.T0013 | Reconnaissance | Adversary learns what data the browser assistant can access across open applications | +| Data from Information Repositories | AML.T0036 | Exfiltration | Browser assistant accesses sensitive data across tabs and applications — adversary controls assistant to exfiltrate | | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Compromised browser assistant used as exfiltration channel — sensitive data from accessible applications transmitted | #### Real-world ATLAS cases @@ -786,7 +786,7 @@ compromises or controls the assistant. #### Mitigations mapped to ATLAS **Foundational** -- Counter AML.T0057: Approved extensions only, permission +- Counter AML.T0036: Approved extensions only, permission minimisation — adversary controlling compromised extension can only access the minimum permitted data - Counter AML.T0013: Restrict browser assistant data @@ -818,9 +818,9 @@ may deliberately trigger availability failures. | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Denial of ML Service | AML.T0029 | Impact | Adversary saturates GenAI pipeline — vector store, RAG retrieval, or inference endpoint rendered unavailable | +| Denial of AI Service | AML.T0029 | Impact | Adversary saturates GenAI pipeline — vector store, RAG retrieval, or inference endpoint rendered unavailable | | Cost Harvesting | AML.T0034 | Impact | Adversary triggers disproportionate resource consumption through crafted queries — financial or operational DoS | -| Data from Information Repositories | AML.T0057 | Exfiltration | Pipeline failures may expose data through error messages or fallback paths that lack normal access controls | +| Data from Information Repositories | AML.T0036 | Exfiltration | Pipeline failures may expose data through error messages or fallback paths that lack normal access controls | #### Mitigations mapped to ATLAS @@ -856,8 +856,8 @@ are the primary techniques. | Technique | ID | Tactic | How it applies | |---|---|---|---| -| Membership Inference | AML.T0024.000 | Exfiltration | Adversary determines whether specific sensitive records were used in training through systematic query analysis | -| Exfiltrate via Cyber Means | AML.T0025 | Exfiltration | Training data confirmed present and partially reconstructed through inference, then exfiltrated | +| Infer Training Data Membership | AML.T0024.000 | Exfiltration | Adversary determines whether specific sensitive records were used in training through systematic query analysis | +| Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Training data confirmed present and partially reconstructed through inference, then exfiltrated | | Model Inversion | AML.T0027 | Exfiltration | Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns | #### Mitigations mapped to ATLAS @@ -904,13 +904,13 @@ gain access to sensitive training data. | Technique | ID | Tactic | How it applies | |---|---|---|---| | Exfiltrate via ML Inference API | AML.T0035 | Exfiltration | Sensitive data in labelling tasks accessed by adversary-controlled or compromised labelling vendor | -| Data from Information Repositories | AML.T0057 | Exfiltration | Labelling vendor's data stores containing sensitive annotation tasks accessed as information repositories | -| Poison Training Data | AML.T0020 | ML Attack Staging | Adversary-controlled labelling vendor introduces biased or poisoned annotations into training data | +| Data from Information Repositories | AML.T0036 | Exfiltration | Labelling vendor's data stores containing sensitive annotation tasks accessed as information repositories | +| Training Data Poisoning | AML.T0020 | ML Attack Staging | Adversary-controlled labelling vendor introduces biased or poisoned annotations into training data | #### Mitigations mapped to ATLAS **Foundational** -- Counter AML.T0057: Treat labelling vendors as +- Counter AML.T0036: Treat labelling vendors as third-party suppliers — security assessment before engagement limits adversary-controlled vendor risk - Counter AML.T0020: Data minimisation in labelling @@ -942,7 +942,7 @@ technique for this threat. | Technique | ID | Tactic | How it applies | |---|---|---|---| | Extract ML Model | AML.T0016 | Exfiltration | Adversary systematically queries model to extract sufficient information to replicate its functionality | -| Exfiltrate via Cyber Means | AML.T0025 | Exfiltration | Query results and model outputs systematically collected and transmitted to adversary infrastructure | +| Exfiltration via Cyber Means | AML.T0025 | Exfiltration | Query results and model outputs systematically collected and transmitted to adversary infrastructure | | Cost Harvesting | AML.T0034 | Impact | High-volume model extraction queries consume significant compute resources — financial impact alongside IP theft | #### Real-world ATLAS cases @@ -994,8 +994,8 @@ into retrieval sources without needing training access. | Technique | ID | Tactic | How it applies | |---|---|---|---| | Publish Poisoned Datasets | AML.T0045 | ML Attack Staging | Adversary publishes false content in public repositories, documentation sites, or knowledge bases indexed by RAG systems | -| Poison Training Data | AML.T0020 | ML Attack Staging | Adversary introduces false content into RAG corpus through ingestion path — no public publication required | -| Craft Adversarial Data | AML.T0031 | ML Attack Staging | False content crafted to appear authoritative and rank highly in semantic similarity searches | +| Training Data Poisoning | AML.T0020 | ML Attack Staging | Adversary introduces false content into RAG corpus through ingestion path — no public publication required | +| Craft Adversarial Data | AML.T0043 | ML Attack Staging | False content crafted to appear authoritative and rank highly in semantic similarity searches | #### Real-world ATLAS cases @@ -1016,7 +1016,7 @@ into retrieval sources without needing training access. prevent AML.T0020 through known ingestion paths **Hardening** -- Counter AML.T0031: Cryptographic provenance for +- Counter AML.T0043: Cryptographic provenance for authoritative sources in RAG — adversary cannot craft content that passes provenance verification for trusted source tier @@ -1055,7 +1055,7 @@ Sensitive training data or RAG content extracted **Path 3 — Supply chain and disinformation:** AML.T0045 (Publish Poisoned Datasets) ? -AML.T0031 (Craft Adversarial Data) ? +AML.T0043 (Craft Adversarial Data) ? RAG corpus poisoned via public source indexing ? GenAI surfaces adversary content as authoritative diff --git a/crosswalk/llm-top10/LLM_MITREATLAS.md b/crosswalk/llm-top10/LLM_MITREATLAS.md index 182298c..7e2c369 100644 --- a/crosswalk/llm-top10/LLM_MITREATLAS.md +++ b/crosswalk/llm-top10/LLM_MITREATLAS.md @@ -658,7 +658,7 @@ in denial of service or runaway cost. | Technique | ID | Tactic | Description | |---|---|---|---| -| Denial of ML Service | [AML.T0029](https://atlas.mitre.org/techniques/AML.T0029) | Impact | Overloading AI systems with computationally expensive inputs to cause service degradation | +| Denial of AI Service | [AML.T0029](https://atlas.mitre.org/techniques/AML.T0029) | Impact | Overloading AI systems with computationally expensive inputs to cause service degradation | | Cost Harvesting | [AML.T0034](https://atlas.mitre.org/techniques/AML.T0034) | Impact | Crafting inputs that maximise token usage or API costs per request | #### Mitigations by tier