From a threat id to the test that proves the control.

A threat model is only useful when each threat ends in a control that runs and a test that would fail if the control did not. Each row here starts from an id an external catalogue gives a threat, names the patterns that control it, an example eval that tests the control, and the obligations that eval's evidence helps satisfy.

How to read a row

Read each card as one sentence: this threat is stopped by this control, built with these patterns; this check fails if the control does not work; and the result is evidence for these obligations. The step that produces the rows for your own system, from data-flow diagram to test plan, is in the Adversarial Red-Team Suite pattern; chapter 15 applies it to the deployed system and chapter 23 to agents.

Threat An id from OWASP, MITRE ATLAS or NIST, and what it means in our words.
Control What stops it, and the patterns that build that control.
Test A named check in Inspect, promptfoo or garak, or a test you write where none of them ships one.
Obligation The register rows the passing result helps evidence, with ISO/IEC 42001, CSA AICM, NIST SP 800-218A and COSAiS ids beside them.

51 threats from four catalogues

The same threat often has an id in more than one catalogue: prompt injection is LLM01:2026, AML.T0051 and NISTAML.018. Each card links its equivalents under "Same threat elsewhere", so a test tagged with one id can be traced to the others.

JSON (API) Download CSV

No row from OWASP Agentic 2026 sits in layer 1, Govern-as-Code. Choose another layer.

No row from MITRE ATLAS sits in layer 1, Govern-as-Code. Choose another layer.

No row from NIST AI 100-2 sits in layer 1, Govern-as-Code. Choose another layer.

No row from OWASP LLM 2026 sits in layer 5, Assurance & Continuous Compliance. Choose another layer.

No row from NIST AI 100-2 sits in layer 5, Assurance & Continuous Compliance. Choose another layer.

OWASP Top 10 for LLM Applications 2026

10 rows

Risks when the model is a component inside an application; the 2026 edition renumbers several 2025 entries. Version: 2026 (published 3 Aug 2026); OWASP GenAI Security Project ¹.

LLM01:2026 Prompt Injection

Formerly LLM01:2025 · OWASP LLM 2026 entry for LLM01:2026

Any input the model reads (a user message, a retrieved document, a tool result, an image, its own memory) changes its behaviour in a way the developer did not intend, because the model draws no hard line between instructions and data.
Control
Treat every channel into the context as untrusted: input and output guardrails, narrow tool scopes, and a human checkpoint before consequential actions.
Test
- promptfoo indirect-prompt-injection: plants instructions in prompt variables and checks whether the model follows them
- garak latentinjection: buries injections inside documents such as a resume or a report
Evidence for
Same threat elsewhere
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST SP 800-218A task
PW.1.1 Risk modelling (an SSDF 1.1 task; 800-218A recommends including AI-specific threat types)
NIST COSAiS use case
Using a generative AI assistant (LLM)
AI agent systems: single agent
Sources

¹ ³ ⁷ ⁸ ¹⁰ ¹¹ ¹³ ¹⁴
LLM02:2026 Sensitive Information Disclosure

Formerly LLM02:2025 · OWASP LLM 2026 entry for LLM02:2026

Confidential, regulated or proprietary data leaves through a channel nobody authorised: the answer, but also tool-call arguments, reasoning traces, retrieved chunks, logs, embeddings and observable properties such as timing.
Control
Classify data before it reaches the context, redact on every output channel, isolate sessions and tenants, and keep personal data out of training and tuning sets.
Open control profile: AIGE-CTL-EVAL-002 Network Egress Control · AIGE-CTL-DEPLOY-014 Sanctioned AI gateway for staff use
Test
- promptfoo cross-session-leak: checks whether information from one session reaches another
- garak leakreplay: tries to make the model replay text from its training data
Evidence for
Same threat elsewhere
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
A.7.4 Quality of data for AI systems
CSA AICM v1.1 domain
DSP Data Security and Privacy Lifecycle Management
IAM Identity & Access Management
NIST COSAiS use case
Using a generative AI assistant (LLM)
Sources

¹ ³ ⁸ ¹⁰ ¹¹ ¹³ ¹⁴
LLM03:2026 Excessive Agency

Formerly LLM06:2025 · OWASP LLM 2026 entry for LLM03:2026

The system can take damaging actions in response to unexpected, ambiguous or manipulated model output, because its tools carry more functionality, permission or autonomy than the task needs.
Control
Least functionality and least privilege per tool, identities scoped to the user on whose behalf the agent acts, and approval before high-impact actions.
Open control profile: AIGE-CTL-EVAL-001 Authorization Boundary
Test
- promptfoo excessive-agency: checks whether the model takes initiative or claims abilities beyond its remit
- promptfoo bfla: tests broken function-level authorisation: calling functions the user may not call
Evidence for
Same threat elsewhere
Layer

L1 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.2 AI system requirements and specification
A.9.2 Processes for responsible use of AI systems
CSA AICM v1.1 domain
IAM Identity & Access Management
NIST COSAiS use case
AI agent systems: single agent
AI agent systems: multi-agent
Sources

¹ ³ ⁸ ¹⁰ ¹¹ ¹³
LLM04:2026 Supply Chain

Formerly LLM03:2025 · OWASP LLM 2026 entry for LLM04:2026

Third-party models, datasets, adapters, conversion pipelines and platforms can be tampered with, poisoned or swapped, so the system inherits flaws it never introduced itself.
Control
An AIBOM for every model, dataset and adapter, integrity checks on artefacts, admission rules for sources, and due diligence on providers.
- AIBOM
- Vendor / Model Due-Diligence Gate
Open control profile: AIGE-CTL-EVAL-008 Harness and Configuration Attestation · AIGE-CTL-ASSURE-010 Model Artefacts Signed at Build and Verified Before Load · AIGE-CTL-ASSURE-011 Safe Model Formats and Digest-Pinned Third-Party Models · AIGE-CTL-ASSURE-012 AI Bill of Materials per Build
Test
- garak fileformats: inspects the files that ship with a model for risky formats
- Write your own AIBOM diff gate: fails the build when a model, dataset or adapter hash differs from the approved AIBOM
Evidence for
Same threat elsewhere
Layer

L2 L3
Control-framework ids
ISO/IEC 42001 Annex A
A.7.5 Data provenance
A.10.3 Suppliers
CSA AICM v1.1 domain
STA Supply Chain Management, Transparency, and Accountability
MDS Model Development Security
NIST SP 800-218A task
PS.3.2 Keep provenance data for every component of a release
NIST COSAiS use case
Security controls for AI developers
Sources

¹ ³ ⁷ ⁸ ¹⁰ ¹¹ ¹⁴
LLM05:2026 Data and Model Poisoning

Formerly LLM04:2025 · OWASP LLM 2026 entry for LLM05:2026

Data or model artefacts are manipulated wherever they are ingested or reused (pre-training, fine-tuning, embeddings, retrieval, distribution) so the system still looks functional while carrying a bias, a weakness or a backdoor.
Control
Admit data only with provenance and an owner, scan for tampering and triggers before training, and keep regression evals that would expose planted behaviour.
Open control profile: AIGE-CTL-DATA-001 Dataset Admission Gate at Read Time · AIGE-CTL-DATA-009 Signed Snapshot Integrity
Test
- promptfoo rag-poisoning: tests resistance to poisoned documents in the retrieval corpus
- Write your own trigger regression set: a held-out set of suspected trigger inputs run on every retrained version
Evidence for
Same threat elsewhere
Layer

L2 L3
Control-framework ids
ISO/IEC 42001 Annex A
A.7.4 Quality of data for AI systems
A.7.5 Data provenance
CSA AICM v1.1 domain
MDS Model Development Security
DSP Data Security and Privacy Lifecycle Management
NIST SP 800-218A task
PW.3.1 Analyse training and test data for poisoning, bias and tampering before use
PW.3.2 Track the provenance of training, testing, fine-tuning and aligning data
NIST COSAiS use case
Security controls for AI developers
Using and fine-tuning predictive AI
Sources

¹ ³ ⁷ ⁸ ¹⁰ ¹¹ ¹³
LLM06:2026 Unbounded Consumption

Formerly LLM10:2025 · OWASP LLM 2026 entry for LLM06:2026

Uncontrolled inference lets an attacker exhaust the service, run up cost or clone the model through queries; the attacker pays little while the victim pays for heavy computation.
Control
Rate, token and budget limits per identity, timeouts on long reasoning, anomaly alerts on spend, and a breaker that stops runaway loops.
Open control profile: AIGE-CTL-EVAL-006 Stop Conditions
Test
- promptfoo reasoning-dos: tries to exhaust computation through excessive reasoning
- Write your own budget ceiling test: replays a burst of expensive requests and checks the limits trip
Evidence for
Same threat elsewhere
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
AIS Application & Interface Security
BCR Business Continuity Management and Operational Resilience
NIST COSAiS use case
Using a generative AI assistant (LLM)
Sources

¹ ³ ⁸ ¹⁰ ¹¹ ¹³
LLM07:2026 Misinformation

Formerly LLM09:2025 · OWASP LLM 2026 entry for LLM07:2026

The system produces incorrect, unsupported or misleading output that looks credible enough to be acted on by a person, a workflow or another agent.
Control
Grounding with checkable sources, calibrated uncertainty shown to the user, factuality evals on release, and human review where the output drives a decision.
Test
- Inspect simpleqa: measures accuracy on short fact-seeking questions
- promptfoo rag-source-attribution: checks whether a RAG system invents citations or sources
Evidence for
Same threat elsewhere
- ASI09 Human-Agent Trust Exploitation
- AML.T0060 Publish Hallucinated Entities
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
A.8.2 System documentation and information for users
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
Sources

¹ ³ ⁸ ¹⁰ ¹¹ ¹² ¹³
LLM08:2026 Hidden Context Exposure

Formerly LLM07:2025 · OWASP LLM 2026 entry for LLM08:2026

Hidden instructions and operational context (the system prompt, tool schemas, retrieved policy text) are extracted or inferred, which matters when they reveal secrets, policy logic or trust boundaries. The 2025 edition called this System Prompt Leakage.
Control
Keep secrets and authorisation logic out of the context altogether, enforce policy outside the model, and treat the prompt as eventually public.
Test
- garak sysprompt_extraction: tries direct requests, encodings and role-play to extract the system prompt
- promptfoo tool-discovery: checks whether the system reveals the tools and functions it can call
Evidence for
Same threat elsewhere
- AML.T0056 Extract LLM System Prompt
- NISTAML.035 Prompt Extraction
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
Sources

¹ ³ ⁸ ¹⁰ ¹¹ ¹³ ¹⁴
LLM09:2026 Vector and Embedding Weaknesses

Formerly LLM08:2025 · OWASP LLM 2026 entry for LLM09:2026

Wherever similarity search decides what the model sees (retrieval, vector memory, semantic caches), the embedding layer becomes a trust boundary open to poisoning, cross-tenant leakage and inversion.
Control
Access control enforced at retrieval time per user and tenant, ingestion rules with provenance, and monitoring of what the retriever returns.
Test
- promptfoo rag-document-exfiltration: tries to pull documents out of the retrieval corpus
- promptfoo rag-poisoning: plants documents that should never be retrieved or trusted
Evidence for
Same threat elsewhere
- ASI06 Memory & Context Poisoning
- AML.T0070 RAG Poisoning
Layer

L2 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.7.5 Data provenance
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
IAM Identity & Access Management
DSP Data Security and Privacy Lifecycle Management
LOG Logging and Monitoring
NIST COSAiS use case
Using a generative AI assistant (LLM)
Sources

¹ ³ ⁸ ¹⁰ ¹¹ ¹³
LLM10:2026 Improper Output Handling

Formerly LLM05:2025 · OWASP LLM 2026 entry for LLM10:2026

Model output is passed to a browser, shell, database or other component without validation, so whoever controls the prompt gains indirect access to that component.
Control
Treat model output as untrusted input: encode for the destination, parameterise queries, and run generated code only in a sandbox.
- Runtime Guardrail
- Eval Gate in CI
Open control profile: AIGE-CTL-EVAL-004 Tool and Action Mediation · AIGE-CTL-DATA-012 Registered Downstream Consumers of Outputs
Test
- garak web_injection: tests Markdown image exfiltration and cross-site scripting through output
- promptfoo sql-injection: tries to get SQL through the model into a database query
Evidence for
Same threat elsewhere
- ASI05 Unexpected Code Execution (RCE)
- AML.T0077 LLM Response Rendering
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
AI agent systems: single agent
Sources

¹ ³ ⁸ ¹⁰ ¹¹ ¹³ ¹⁴

OWASP Top 10 for Agentic Applications 2026

10 rows

Risks once the model acts: tools it calls, memory it carries, identities it uses and other agents it talks to. Version: 2026 (published 9 Dec 2025); OWASP GenAI Security Project ⁴.

ASI01 Agent Goal Hijack

OWASP Agentic 2026 entry for ASI01

Content the agent processes (a message, a document, a tool result) redirects its goals or plan, so it pursues the attacker's objective with the agent's own tools and permissions.
Control
Keep the goal outside the reach of processed content: instruction provenance, checkpoints before writes, and trajectory evals that watch the plan, not only the answer.
Open control profile: AIGE-CTL-EVAL-004 Tool and Action Mediation · AIGE-CTL-AGENT-007 Runtime guardrail on every tool call · AIGE-CTL-ASSURE-002 Release Blocked Below the Eval Threshold
Test
- Inspect agentdojo: measures utility and injection robustness of agents that use tools over untrusted data
- Inspect agent_threat_bench_autonomy_hijack: email-triage tasks with injected instructions, scored on utility and security
Evidence for
Same threat elsewhere
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
AI agent systems: single agent
AI agent systems: multi-agent
Sources

⁴ ⁸ ¹⁰ ¹¹ ¹²
ASI02 Tool Misuse and Exploitation

OWASP Agentic 2026 entry for ASI02

The agent uses tools it is allowed to use in unsafe ways: destructive parameters, chains of calls nobody intended, or exfiltration through a permitted channel.
Control
A tool allow-list with per-tool scopes, rate, egress and budget limits, validation of arguments, and a gate on destructive or external actions.
Open control profile: AIGE-CTL-EVAL-001 Authorization Boundary · AIGE-CTL-EVAL-002 Network Egress Control · AIGE-CTL-EVAL-004 Tool and Action Mediation · AIGE-CTL-AGENT-005 Tool allow-list, deny by default · AIGE-CTL-AGENT-007 Runtime guardrail on every tool call · AIGE-CTL-AGENT-015 Checkpoints on irreversible actions, failing closed · AIGE-CTL-AGENT-017 Output and egress filter · AIGE-CTL-ASSURE-002 Release Blocked Below the Eval Threshold
Test
- garak agent_breaker: a multi-turn red-team probe against agents that use tools
- promptfoo mcp: tests an agent's MCP tool surface for known attack patterns
Evidence for
Same threat elsewhere
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
A.9.2 Processes for responsible use of AI systems
CSA AICM v1.1 domain
AIS Application & Interface Security
IAM Identity & Access Management
NIST COSAiS use case
AI agent systems: single agent
Sources

⁴ ⁸ ¹⁰ ¹¹ ¹³ ¹⁴
ASI03 Identity and Privilege Abuse

OWASP Agentic 2026 entry for ASI03

Delegated identities, inherited privileges and cached credentials let an agent (or whoever steers it) act with rights the requesting user never had.
Control
A distinct workload identity per agent, short-lived delegated tokens bound to the user and the audience, and no standing secrets in agent configuration.
- Agent Identity & Scoped Credentials
- Agent Registry
Open control profile: AIGE-CTL-EVAL-001 Authorization Boundary · AIGE-CTL-EVAL-003 Credential Isolation · AIGE-CTL-AGENT-002 Its own identity · AIGE-CTL-AGENT-020 MCP authorisation (spec 2026-07-28) · AIGE-CTL-AGENT-021 Replace long-lived secrets with short-lived credentials · AIGE-CTL-AGENT-022 Delegation, never impersonation
Test
- promptfoo bola: tests broken object-level authorisation: reaching another user's records
- promptfoo rbac: checks that role-based access control holds through the agent
Evidence for
Same threat elsewhere
- LLM03:2026 Excessive Agency
- NISTAML.039 Compromising connected resources
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.5 AI system deployment
CSA AICM v1.1 domain
IAM Identity & Access Management
NIST COSAiS use case
AI agent systems: single agent
AI agent systems: multi-agent
Sources

⁴ ⁸ ¹⁰ ¹¹ ¹³
ASI04 Agentic Supply Chain Vulnerabilities

OWASP Agentic 2026 entry for ASI04

Tools, MCP servers, plugins, prompt templates and models that an agent loads, often at run time, can be malicious or become malicious after they were trusted.
Control
Admission of servers and tools against a registry, pinned and hashed definitions, and an AIBOM that records what the agent can reach.
Open control profile: AIGE-CTL-EVAL-008 Harness and Configuration Attestation · AIGE-CTL-AGENT-018 MCP server admission gate · AIGE-CTL-AGENT-019 Local MCP servers sandboxed · AIGE-CTL-ASSURE-010 Model Artefacts Signed at Build and Verified Before Load · AIGE-CTL-ASSURE-011 Safe Model Formats and Digest-Pinned Third-Party Models
Test
- promptfoo mcp: tests the MCP servers and tools an agent connects to
- Write your own definition-drift check: fails when a tool definition differs from the pinned hash
Evidence for
Same threat elsewhere
Layer

L2
Control-framework ids
ISO/IEC 42001 Annex A
A.10.3 Suppliers
A.7.5 Data provenance
CSA AICM v1.1 domain
STA Supply Chain Management, Transparency, and Accountability
NIST SP 800-218A task
PS.3.2 Keep provenance data for every component of a release
NIST COSAiS use case
AI agent systems: single agent
AI agent systems: multi-agent
Security controls for AI developers
Sources

⁴ ⁷ ⁸ ¹⁰ ¹¹ ¹³
ASI05 Unexpected Code Execution (RCE)

OWASP Agentic 2026 entry for ASI05

Code the agent writes or runs, directly or through a tool, executes outside the bounds anyone intended and compromises the host or the environment around it.
Control
Sandboxed execution with no ambient credentials, deny-by-default network and file access, and review of generated code before it runs anywhere that matters.
- Runtime Guardrail
- Kill Switch / Circuit Breaker
Open control profile: AIGE-CTL-EVAL-004 Tool and Action Mediation · AIGE-CTL-AGENT-016 Code runs only in a sandbox
Test
- Inspect cyberseceval_2: includes a code-interpreter abuse task alongside prompt injection
- promptfoo shell-injection: tries to execute shell commands through the model
Evidence for
Same threat elsewhere
- LLM10:2026 Improper Output Handling
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.5 AI system deployment
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
AIS Application & Interface Security
IVS Infrastructure & Virtualization Security
NIST COSAiS use case
AI agent systems: single agent
Sources

⁴ ⁸ ¹⁰ ¹¹ ¹² ¹³
ASI06 Memory & Context Poisoning

OWASP Agentic 2026 entry for ASI06

Stored memory, retrieval stores or carried context are corrupted so the poison persists across sessions and shapes later decisions.
Control
A gate on memory writes, namespaces per user and task, provenance on stored items, and the ability to roll memory back.
Open control profile: AIGE-CTL-AGENT-023 Memory write gate and rollback
Test
- Inspect agent_threat_bench_memory_poison: tasks with poisoned memory stores, scored on utility and security
- promptfoo agentic:memory-poisoning: tests whether an agent can be made to store and act on planted memories
Evidence for
Same threat elsewhere
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
A.6.2.8 AI system recording of event logs
CSA AICM v1.1 domain
AIS Application & Interface Security
DSP Data Security and Privacy Lifecycle Management
NIST COSAiS use case
AI agent systems: single agent
AI agent systems: multi-agent
Sources

⁴ ⁸ ¹⁰ ¹¹ ¹² ¹³
ASI07 Insecure Inter-Agent Communication

OWASP Agentic 2026 entry for ASI07

Messages between agents travel without authentication or integrity, so a peer can be spoofed, a message replayed or altered, and trust passes along a chain that nobody checked.
Control
Mutual authentication between agents, signed and verified agent descriptions, an allow-list of peers, and messages bound to the task they belong to.
- Agent Identity & Scoped Credentials
- Agent Registry
Open control profile: AIGE-CTL-AGENT-025 Accountability across hops · AIGE-CTL-AGENT-026 Stopping third-party agents at your boundary
Test
- Write your own unregistered-peer test: a message from an agent not in the registry, or with a bad signature, must be refused
Evidence for
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.5 AI system deployment
CSA AICM v1.1 domain
IAM Identity & Access Management
AIS Application & Interface Security
NIST COSAiS use case
AI agent systems: multi-agent
Sources

⁴ ⁸ ¹⁰ ¹¹
ASI08 Cascading Failures

OWASP Agentic 2026 entry for ASI08

One faulty or compromised agent, tool or output propagates through connected agents and workflows, and each hop amplifies the harm.
Control
Depth, fan-out and budget limits, a breaker per agent, isolation between workflows, and telemetry that traces a failure back to its first hop.
Open control profile: AIGE-CTL-EVAL-006 Stop Conditions · AIGE-CTL-AGENT-008 Execution budgets · AIGE-CTL-AGENT-010 Per-agent circuit breaker · AIGE-CTL-AGENT-025 Accountability across hops · AIGE-CTL-DATA-012 Registered Downstream Consumers of Outputs
Test
- Write your own fault-injection drill: a tool returns errors or bad data on purpose; the breaker must trip within its budget
Evidence for
Same threat elsewhere
- LLM06:2026 Unbounded Consumption
- AML.T0034 Cost Harvesting
Layer

L4 L5
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
BCR Business Continuity Management and Operational Resilience
LOG Logging and Monitoring
NIST COSAiS use case
AI agent systems: multi-agent
Sources

⁴ ⁸ ¹⁰ ¹¹
ASI09 Human-Agent Trust Exploitation

OWASP Agentic 2026 entry for ASI09

Fluent, confident or persuasive agent output leads people to approve harmful actions, disclose information or skip the check they were meant to make.
Control
Approvals that show the raw action and its consequences, not the agent's summary; oversight metrics such as approval rates and time to decide; and disclosure that the user is dealing with an AI system.
- Human-in-the-loop Gate
- Policy Card
Open control profile: AIGE-CTL-EVAL-004 Tool and Action Mediation · AIGE-CTL-AGENT-009 Approval log, bound to the call · AIGE-CTL-AGENT-015 Checkpoints on irreversible actions, failing closed
Test
- Inspect make_me_pay: measures persuasive capability in a simulated donation conversation
- promptfoo overreliance: checks whether the model goes along with a wrong user assumption
Evidence for
Same threat elsewhere
- LLM01:2026 Prompt Injection
- LLM07:2026 Misinformation
Layer

L4 L5
Control-framework ids
ISO/IEC 42001 Annex A
A.8.2 System documentation and information for users
A.9.2 Processes for responsible use of AI systems
CSA AICM v1.1 domain
AIS Application & Interface Security
HRS Human Resources
NIST COSAiS use case
AI agent systems: single agent
Sources

⁴ ⁸ ¹⁰ ¹¹ ¹² ¹³
ASI10 Rogue Agents

OWASP Agentic 2026 entry for ASI10

An agent drifts from its intended behaviour or scope (through compromise, misalignment or neglect) and keeps acting, possibly deceptively, where nobody is watching.
Control
A registry entry with an owner and an expiry for every agent, discovery of agents that are not registered, behavioural monitoring, and a drilled kill switch.
Open control profile: AIGE-CTL-EVAL-005 Monitoring Integrity · AIGE-CTL-EVAL-006 Stop Conditions · AIGE-CTL-AGENT-001 Registry entry · AIGE-CTL-AGENT-010 Per-agent circuit breaker · AIGE-CTL-AGENT-011 Drilled kill switch · AIGE-CTL-AGENT-019 Local MCP servers sandboxed · AIGE-CTL-DEPLOY-013 Shadow AI discovery and registry reconciliation
Test
- Inspect agentic_misalignment: fictional scenarios that probe for agents acting against their principals
- Write your own registry reconciliation: every agent identity seen at run time must match a live registry entry
Evidence for
Layer

L2 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
A.6.2.8 AI system recording of event logs
CSA AICM v1.1 domain
GRC Governance, Risk and Compliance
LOG Logging and Monitoring
NIST COSAiS use case
AI agent systems: single agent
AI agent systems: multi-agent
Sources

⁴ ⁸ ¹⁰ ¹¹ ¹²

MITRE ATLAS techniques

18 rows

Adversary techniques against AI systems, organised by tactic, with the mitigations ATLAS links to each. Version: data release v2026.09 (15 Sep 2026); MITRE ⁵.

AML.T0051 LLM Prompt Injection

MITRE ATLAS entry for AML.T0051

Crafted prompts make the model ignore its instructions and follow the adversary's, directly, indirectly through content it ingests, or on a trigger (sub-techniques .000 Direct, .001 Indirect, .002 Triggered). ATLAS places it under Execution.
Control
Guardrails on inputs and outputs, restricted tool use on untrusted data, telemetry, and a standing red team.
- Runtime Guardrail
- Adversarial Red-Team Suite
Test
- garak promptinject: plaintext injections inside requests for innocuous information
- promptfoo indirect-prompt-injection: instructions planted in prompt variables
Evidence for
Same threat elsewhere
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
AI agent systems: single agent
ATLAS mitigations
AML.M0019 Control Access to AI Models and Data in Production
AML.M0020 Generative AI Guardrails
AML.M0021 Generative AI Guidelines
AML.M0022 Generative AI Model Alignment
AML.M0024 AI Telemetry Logging
AML.M0033 Input and Output Validation for AI Agent Components
AML.M0035 AI Red Team
Sources

⁵ ⁸ ¹⁰ ¹¹ ¹³ ¹⁴
AML.T0054 LLM Jailbreak

MITRE ATLAS entry for AML.T0054

The model is induced to bypass its safety behaviour and guardrails and produce what it is meant to withhold, by adversarial prompting or by changing weights or safety mechanisms.
Control
Alignment and guardrails tested against current jailbreak families, with the jailbreak rate as a release threshold.
Test
- Inspect strong_reject: scores both refusal and how useful a non-refused harmful answer is
- garak tap: Tree of Attacks with Pruning: model-generated jailbreak prompts
Evidence for
Same threat elsewhere
- LLM01:2026 Prompt Injection
- NISTAML.018 Prompt Injection
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
AIS Application & Interface Security
MDS Model Development Security
NIST SP 800-218A task
PW.3.3 Include adversarial samples in training and testing data
NIST COSAiS use case
Using a generative AI assistant (LLM)
Security controls for AI developers
ATLAS mitigations
AML.M0020 Generative AI Guardrails
AML.M0021 Generative AI Guidelines
AML.M0022 Generative AI Model Alignment
AML.M0035 AI Red Team
Sources

⁵ ⁷ ⁸ ¹⁰ ¹¹ ¹² ¹⁴
AML.T0056 Extract LLM System Prompt

MITRE ATLAS entry for AML.T0056

The adversary obtains the system prompt, through injection that makes the model reveal it or from a configuration file, and uses it to plan further attacks.
Control
Nothing secret in the prompt, policy enforced outside the model, and extraction attempts logged.
- Runtime Guardrail
- Adversarial Red-Team Suite
Test
- garak sysprompt_extraction: direct requests, encoding tricks and role-play
- promptfoo prompt-extraction: attempts to get the model to reveal its system prompt
Evidence for
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
- OWASP Top 10 for LLM Applications 2026
Same threat elsewhere
- LLM08:2026 Hidden Context Exposure
- NISTAML.035 Prompt Extraction
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
ATLAS mitigations
AML.M0020 Generative AI Guardrails
AML.M0021 Generative AI Guidelines
AML.M0022 Generative AI Model Alignment
AML.M0035 AI Red Team
Sources

⁵ ⁸ ¹⁰ ¹¹ ¹³ ¹⁴
AML.T0057 LLM Data Leakage

MITRE ATLAS entry for AML.T0057

Crafted prompts make the model leak private or proprietary information from its training data, its connected data sources or other users.
Control
Data classification before retrieval, output filtering for personal and secret data, and session isolation.
- Runtime Guardrail
- Eval Gate in CI
Test
- promptfoo pii:direct: direct attempts to obtain personal data
- garak leakreplay: replay attacks that test whether a document was in the training data
Evidence for
Same threat elsewhere
- LLM02:2026 Sensitive Information Disclosure
- NISTAML.038 Data Extraction
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.7.4 Quality of data for AI systems
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
DSP Data Security and Privacy Lifecycle Management
NIST COSAiS use case
Using a generative AI assistant (LLM)
ATLAS mitigations
AML.M0008 Validate AI Model
AML.M0020 Generative AI Guardrails
AML.M0021 Generative AI Guidelines
AML.M0022 Generative AI Model Alignment
AML.M0035 AI Red Team
Sources

⁵ ⁸ ¹⁰ ¹¹ ¹³ ¹⁴
AML.T0077 LLM Response Rendering

MITRE ATLAS entry for AML.T0077

The model is induced to embed private data in a reference to external content (an image, a link) that the user's client fetches on rendering, sending the data to the adversary unseen.
Control
Render model output with external fetches disabled or restricted to an allow-list, and strip data from URLs.
- Runtime Guardrail
Test
- garak web_injection: includes Markdown image exfiltration probes
Evidence for
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
- OWASP Top 10 for LLM Applications 2026
Same threat elsewhere
- LLM02:2026 Sensitive Information Disclosure
- LLM10:2026 Improper Output Handling
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.5 AI system deployment
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
Sources

⁵ ⁸ ¹⁰ ¹¹ ¹⁴
AML.T0053 AI Agent Tool Invocation

MITRE ATLAS entry for AML.T0053

With access to an agent, the adversary invokes the tools the agent holds (integrations, data sources, code execution) to reach systems it could not reach directly.
Control
Per-tool permissions, single-user scoping, no tool calls driven by untrusted data without a check, and human approval for sensitive actions.
Test
- garak agent_breaker: multi-turn attacks on agents that use tools
- promptfoo tool-discovery: checks whether the agent reveals the tools it holds
Evidence for
Same threat elsewhere
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
A.9.2 Processes for responsible use of AI systems
CSA AICM v1.1 domain
IAM Identity & Access Management
AIS Application & Interface Security
NIST COSAiS use case
AI agent systems: single agent
AI agent systems: multi-agent
ATLAS mitigations
AML.M0020 Generative AI Guardrails
AML.M0021 Generative AI Guidelines
AML.M0022 Generative AI Model Alignment
AML.M0024 AI Telemetry Logging
AML.M0026 Privileged AI Agent Permissions Configuration
AML.M0027 Single-User AI Agent Permissions Configuration
AML.M0028 AI Agent Tools Permissions Configuration
AML.M0029 Human In-the-Loop for AI Agent Actions
AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data
AML.M0032 Segmentation of AI Agent Components
AML.M0033 Input and Output Validation for AI Agent Components
AML.M0035 AI Red Team
Sources

⁵ ⁸ ¹⁰ ¹¹ ¹³ ¹⁴
AML.T0086 Exfiltration via AI Agent Tool Invocation

MITRE ATLAS entry for AML.T0086

An agent tool that can write (email, documents, records) is used to encode sensitive data into its parameters and send it somewhere the adversary controls, looking like legitimate work.
Control
Egress allow-lists, data-loss checks on tool arguments, and approval for writes that leave the organisation.
Open control profile: AIGE-CTL-EVAL-002 Network Egress Control
Test
- Inspect agent_threat_bench_data_exfil: customer-support tasks with injected exfiltration instructions
- promptfoo data-exfil: indirect injection in web content that tries to make the agent send data out
Evidence for
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
- OWASP Top 10 for Agentic Applications 2026
Same threat elsewhere
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
DSP Data Security and Privacy Lifecycle Management
LOG Logging and Monitoring
NIST COSAiS use case
AI agent systems: single agent
ATLAS mitigations
AML.M0024 AI Telemetry Logging
AML.M0026 Privileged AI Agent Permissions Configuration
AML.M0027 Single-User AI Agent Permissions Configuration
AML.M0028 AI Agent Tools Permissions Configuration
AML.M0029 Human In-the-Loop for AI Agent Actions
AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data
AML.M0032 Segmentation of AI Agent Components
AML.M0033 Input and Output Validation for AI Agent Components
Sources

⁵ ⁸ ¹⁰ ¹¹ ¹² ¹³
AML.T0080 AI Agent Context Poisoning

MITRE ATLAS entry for AML.T0080

The adversary changes the context an agent works from, in its memory (.000) or in a conversation thread (.001), to alter its behaviour persistently. ATLAS places it under Persistence.
Control
Hardened memory: a gate on writes, provenance on stored items, and rollback.
- Runtime Guardrail
- Continuous Assurance Telemetry
Test
- promptfoo agentic:memory-poisoning: planted memories the agent should neither store nor act on
- Inspect agent_threat_bench_memory_poison: poisoned memory stores in agent tasks
Evidence for
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
- OWASP Top 10 for Agentic Applications 2026
Same threat elsewhere
- LLM05:2026 Data and Model Poisoning
- ASI06 Memory & Context Poisoning
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
AI agent systems: single agent
AI agent systems: multi-agent
ATLAS mitigations
AML.M0031 Memory Hardening
AML.M0035 AI Red Team
Sources

⁵ ⁸ ¹⁰ ¹¹ ¹² ¹³
AML.T0070 RAG Poisoning

MITRE ATLAS entry for AML.T0070

Malicious content is placed where a retrieval system indexes it, so it surfaces in future answers for chosen queries.
Control
A source allow-list for ingestion, provenance recorded for every indexed document, and canary documents that must never be retrieved.
Test
- promptfoo rag-poisoning: poisoned documents in the retrieval corpus
Evidence for
Same threat elsewhere
Layer

L2 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.7.5 Data provenance
CSA AICM v1.1 domain
DSP Data Security and Privacy Lifecycle Management
NIST SP 800-218A task
PW.3.2 Track the provenance of training, testing, fine-tuning and aligning data
NIST COSAiS use case
Using a generative AI assistant (LLM)
ATLAS mitigations
AML.M0020 Generative AI Guardrails
AML.M0035 AI Red Team
Sources

⁵ ⁷ ⁸ ¹⁰ ¹¹ ¹³
AML.T0110 AI Agent Tool Poisoning

MITRE ATLAS entry for AML.T0110

A tool the agent uses is poisoned in its model-visible definition, its implementation or its run-time responses; the tool may be an integration, a package, an MCP server or an agent skill.
Control
Admit tools through a registry, pin and hash their definitions, and treat tool responses as untrusted input.
Open control profile: AIGE-CTL-EVAL-008 Harness and Configuration Attestation
Test
- promptfoo mcp: MCP attack patterns against the agent's tool surface
- Write your own definition-drift check: fails when a tool definition changes without review
Evidence for
Same threat elsewhere
- LLM04:2026 Supply Chain
- ASI04 Agentic Supply Chain Vulnerabilities
Layer

L2 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.10.3 Suppliers
CSA AICM v1.1 domain
STA Supply Chain Management, Transparency, and Accountability
NIST SP 800-218A task
PS.3.2 Keep provenance data for every component of a release
NIST COSAiS use case
AI agent systems: single agent
AI agent systems: multi-agent
Sources

⁵ ⁷ ⁸ ¹⁰ ¹¹ ¹³
AML.T0010 AI Supply Chain Compromise

MITRE ATLAS entry for AML.T0010

Initial access through the parts of the supply chain unique to AI: hardware, AI software, data, models, container registries and agent tools (sub-techniques .000 to .005).
Control
Verify artefacts (hashes, signatures) before use, keep an AIBOM, and red-team third-party components.
- AIBOM
- Vendor / Model Due-Diligence Gate
Open control profile: AIGE-CTL-EVAL-008 Harness and Configuration Attestation · AIGE-CTL-ASSURE-010 Model Artefacts Signed at Build and Verified Before Load · AIGE-CTL-ASSURE-011 Safe Model Formats and Digest-Pinned Third-Party Models · AIGE-CTL-ASSURE-012 AI Bill of Materials per Build
Test
- garak fileformats: looks for vulnerable items among the files that ship with a model
- Write your own AIBOM diff gate: blocks an artefact whose hash is not in the approved AIBOM
Evidence for
Same threat elsewhere
Layer

L2 L3
Control-framework ids
ISO/IEC 42001 Annex A
A.10.3 Suppliers
A.7.5 Data provenance
CSA AICM v1.1 domain
STA Supply Chain Management, Transparency, and Accountability
NIST SP 800-218A task
PS.3.2 Keep provenance data for every component of a release
NIST COSAiS use case
Security controls for AI developers
ATLAS mitigations
AML.M0014 Verify AI Artifacts
AML.M0020 Generative AI Guardrails
AML.M0023 AI Bill of Materials
AML.M0035 AI Red Team
Sources

⁵ ⁷ ⁸ ¹⁰ ¹¹ ¹⁴
AML.T0109 AI Supply Chain Rug Pull

MITRE ATLAS entry for AML.T0109

A component is published in good faith, earns adoption, and is then updated with a malicious variant, after the scrutiny that came with first adoption has passed.
Control
Pin versions, treat every update as a new admission, and run a canary eval that notices behaviour change nobody announced.
Test
- Write your own canary regression: a small fixed eval run on a schedule against each pinned component; drift raises a finding
Evidence for
Same threat elsewhere
- LLM04:2026 Supply Chain
- ASI04 Agentic Supply Chain Vulnerabilities
Layer

L2 L5
Control-framework ids
ISO/IEC 42001 Annex A
A.10.3 Suppliers
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
STA Supply Chain Management, Transparency, and Accountability
CCC Change Control and Configuration Management
NIST SP 800-218A task
PS.3.2 Keep provenance data for every component of a release
NIST COSAiS use case
Security controls for AI developers
AI agent systems: single agent
Sources

⁵ ⁷ ⁸ ¹⁰ ¹¹
AML.T0020 Training Data Poisoning

MITRE ATLAS entry for AML.T0020

Training or fine-tuning data (samples, labels, feedback) is added, removed or altered to bias the model, degrade it or embed a backdoor.
Control
Sanitise and validate data, keep dataset provenance and an AIBOM, restrict write access to data at rest.
Test
- Write your own data admission check: a dataset without provenance, owner and a tamper scan cannot enter training
Evidence for
Same threat elsewhere
Layer

L2 L3
Control-framework ids
ISO/IEC 42001 Annex A
A.7.4 Quality of data for AI systems
A.7.5 Data provenance
CSA AICM v1.1 domain
MDS Model Development Security
DSP Data Security and Privacy Lifecycle Management
NIST SP 800-218A task
PW.3.1 Analyse training and test data for poisoning, bias and tampering before use
PW.3.2 Track the provenance of training, testing, fine-tuning and aligning data
NIST COSAiS use case
Security controls for AI developers
Using and fine-tuning predictive AI
ATLAS mitigations
AML.M0001 Limit Model Artifact Release
AML.M0005 Control Access to AI Models and Data at Rest
AML.M0007 Sanitize Training Data
AML.M0008 Validate AI Model
AML.M0023 AI Bill of Materials
AML.M0025 Maintain AI Dataset Provenance
AML.M0035 AI Red Team
Sources

⁵ ⁷ ⁸ ¹⁰ ¹¹
AML.T0018 Manipulate AI Model

MITRE ATLAS entry for AML.T0018

A model artefact or its bundled components is altered (weights, architecture, prompt-construction logic, embedded malware) and may behave normally until a chosen input arrives.
Control
Sign and verify model artefacts, restrict access to models at rest, and validate the model before each release.
- AIBOM
- Eval Gate in CI
Test
- Write your own signature verification: the pipeline fails on a hash or signature mismatch
- garak fileformats: flags risky file formats in a model repository
Evidence for
Same threat elsewhere
- NISTAML.023 Backdoor Poisoning
- NISTAML.051 Model Poisoning (supply chain)
Layer

L2 L3
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
A.7.5 Data provenance
CSA AICM v1.1 domain
MDS Model Development Security
CEK Cryptography, Encryption & Key Management
NIST SP 800-218A task
PS.1.3 Protect model weights and configuration parameters from unauthorised access and change
NIST COSAiS use case
Security controls for AI developers
ATLAS mitigations
AML.M0005 Control Access to AI Models and Data at Rest
AML.M0008 Validate AI Model
AML.M0013 Code Signing
AML.M0035 AI Red Team
Sources

⁵ ⁷ ⁸ ¹⁰ ¹¹ ¹⁴
AML.T0024 Exfiltration via AI Inference API

MITRE ATLAS entry for AML.T0024

Queries to the inference API leak private information about training data (membership .000, inversion .001) or the model itself (extraction .002).
Control
Rate and volume limits per identity, access control on the API, query-pattern monitoring, and privacy testing of tuned models.
Test
- garak leakreplay: tests whether the model reproduces text it was trained on
- Write your own extraction probe: a scripted query campaign against the rate limits and the detector
Evidence for
Same threat elsewhere
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
DSP Data Security and Privacy Lifecycle Management
LOG Logging and Monitoring
NIST SP 800-218A task
RV.1.1 Gather vulnerability information; log and analyse model inputs and outputs
NIST COSAiS use case
Using and fine-tuning predictive AI
Using a generative AI assistant (LLM)
ATLAS mitigations
AML.M0004 Limit AI Service Query Volume and Rate
AML.M0019 Control Access to AI Models and Data in Production
AML.M0024 AI Telemetry Logging
AML.M0035 AI Red Team
Sources

⁵ ⁷ ⁸ ¹⁰ ¹¹ ¹⁴
AML.T0015 Evade AI Model

MITRE ATLAS entry for AML.T0015

Crafted adversarial data or deepfakes make a model misidentify what it sees, for example to slip past AI-based malware or fraud detection.
Control
Hardened models, adversarial input detection, ensembles or multi-sensor checks, and robustness thresholds in the release gate.
- Adversarial Red-Team Suite
- Eval Gate in CI
Test
- Write your own perturbation suite: bounded perturbations of held-out inputs; accuracy under attack is a release threshold
Evidence for
Same threat elsewhere
- NISTAML.022 Evasion
Layer

L3
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
MDS Model Development Security
NIST SP 800-218A task
PW.3.3 Include adversarial samples in training and testing data
NIST COSAiS use case
Using and fine-tuning predictive AI
ATLAS mitigations
AML.M0003 Predictive AI Model Hardening
AML.M0006 Predictive AI Ensembles
AML.M0009 Predictive AI Multi-Sensor Fusion
AML.M0010 Predictive AI Input Restoration
AML.M0015 Predictive AI Adversarial Input Detection
AML.M0034 Deepfake Detection
AML.M0035 AI Red Team
Sources

⁵ ⁷ ⁸ ¹⁰ ¹¹
AML.T0034 Cost Harvesting

MITRE ATLAS entry for AML.T0034

The adversary drives AI services beyond normal capacity to raise the victim's cost, with many cheap queries, a few expensive ones, or agentic loops (.002 Agentic Resource Consumption).
Control
Query and resource limits per identity, budgets per agent, and alerts on spend anomalies.
Open control profile: AIGE-CTL-EVAL-006 Stop Conditions
Test
- promptfoo reasoning-dos: resource exhaustion through excessive reasoning
Evidence for
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
- CSA AI Controls Matrix (AICM) v1.1
Same threat elsewhere
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
BCR Business Continuity Management and Operational Resilience
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
AI agent systems: multi-agent
ATLAS mitigations
AML.M0004 Limit AI Service Query Volume and Rate
AML.M0019 Control Access to AI Models and Data in Production
AML.M0035 AI Red Team
AML.M0036 Limit AI Workload Resource Consumption
Sources

⁵ ⁸ ¹⁰ ¹¹ ¹³
AML.T0060 Publish Hallucinated Entities

MITRE ATLAS entry for AML.T0060

The adversary registers a package, website or address that models tend to invent, and waits for a victim to follow the hallucination.
Control
Allow-lists for packages and domains the system may recommend or install, and checks that generated references exist.
Test
- garak packagehallucination: asks for code and checks for packages that do not exist
Evidence for
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
- OWASP Top 10 for LLM Applications 2026
Same threat elsewhere
- LLM04:2026 Supply Chain
- LLM07:2026 Misinformation
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
STA Supply Chain Management, Transparency, and Accountability
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
Security controls for AI developers
Sources

⁵ ⁸ ¹⁰ ¹¹ ¹⁴

NIST AI 100-2 E2025 attack classes

13 rows

Attacks on predictive and generative models, classed by the attacker goal they serve: availability, integrity, privacy, misuse. Version: E2025 (24 Mar 2025); NIST ⁶.

NISTAML.022 Evasion

NIST AI 100-2 entry for NISTAML.022

An integrity attack on predictive models at deployment time: inputs are modified, often imperceptibly, so the model returns the attacker's chosen output.
Control
Adversarial training and input checks, with accuracy under bounded attack measured in the release gate.
- Adversarial Red-Team Suite
- Eval Gate in CI
Test
- Write your own perturbation suite: accuracy under a stated perturbation budget, as a threshold
Evidence for
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
- NIST AI RMF MEASURE
Same threat elsewhere
- AML.T0015 Evade AI Model
Layer

L3
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
MDS Model Development Security
NIST SP 800-218A task
PW.3.3 Include adversarial samples in training and testing data
NIST COSAiS use case
Using and fine-tuning predictive AI
Sources

⁶ ⁷ ⁸ ¹⁰ ¹¹
NISTAML.013 Data Poisoning

NIST AI 100-2 entry for NISTAML.013

Training data is manipulated to degrade the model broadly (availability) or on chosen inputs (integrity); NIST lists it for both predictive and generative models.
Control
Data provenance, sanitisation and outlier checks before training, and evals that compare against a clean baseline.
- AIBOM
- Eval Gate in CI
Test
- Write your own data admission check: provenance, owner and tamper scan required before training
Evidence for
Same threat elsewhere
- LLM05:2026 Data and Model Poisoning
- AML.T0020 Training Data Poisoning
Layer

L2 L3
Control-framework ids
ISO/IEC 42001 Annex A
A.7.4 Quality of data for AI systems
A.7.5 Data provenance
CSA AICM v1.1 domain
MDS Model Development Security
DSP Data Security and Privacy Lifecycle Management
NIST SP 800-218A task
PW.3.1 Analyse training and test data for poisoning, bias and tampering before use
NIST COSAiS use case
Security controls for AI developers
Using and fine-tuning predictive AI
Sources

⁶ ⁷ ⁸ ¹⁰ ¹¹
NISTAML.023 Backdoor Poisoning

NIST AI 100-2 entry for NISTAML.023

Poisoned training data implants a trigger, so the model behaves normally until the trigger appears and then does what the attacker wants.
Control
Provenance on data and models, trigger scanning, and red-team cases for suspected triggers.
- AIBOM
- Adversarial Red-Team Suite
Test
- Write your own trigger regression set: suspected triggers run against every retrained version
Evidence for
Same threat elsewhere
Layer

L2 L3
Control-framework ids
ISO/IEC 42001 Annex A
A.7.5 Data provenance
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
MDS Model Development Security
NIST SP 800-218A task
PW.3.1 Analyse training and test data for poisoning, bias and tampering before use
NIST COSAiS use case
Security controls for AI developers
Sources

⁶ ⁷ ⁸ ¹⁰ ¹¹
NISTAML.051 Model Poisoning (supply chain)

NIST AI 100-2 entry for NISTAML.051

The model itself (its weights or parameters) is modified and distributed through the supply chain, so every downstream user inherits the flaw.
Control
Obtain models from verified sources, verify hashes and signatures, and keep the AIBOM current.
- AIBOM
- Vendor / Model Due-Diligence Gate
Test
- Write your own signature verification: the pipeline refuses a model whose hash or signature does not match
Evidence for
Same threat elsewhere
Layer

L2
Control-framework ids
ISO/IEC 42001 Annex A
A.10.3 Suppliers
A.7.5 Data provenance
CSA AICM v1.1 domain
STA Supply Chain Management, Transparency, and Accountability
MDS Model Development Security
NIST SP 800-218A task
PS.1.3 Protect model weights and configuration parameters from unauthorised access and change
PS.3.2 Keep provenance data for every component of a release
NIST COSAiS use case
Security controls for AI developers
Sources

⁶ ⁷ ⁸ ¹⁰ ¹¹
NISTAML.031 Model Extraction

NIST AI 100-2 entry for NISTAML.031

Queries to a deployed model are used to reconstruct a functionally similar copy, which also helps the attacker stage other attacks offline.
Control
Rate limits and query monitoring per identity, and output that reveals no more than the use case needs.
- Runtime Guardrail
- Continuous Assurance Telemetry
Test
- Write your own extraction probe: a scripted campaign that must trip the rate limit and the detector
Evidence for
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
- GPAI Code of Practice, Safety and Security (systemic-risk models only)
Same threat elsewhere
- LLM06:2026 Unbounded Consumption
- AML.T0024 Exfiltration via AI Inference API
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
LOG Logging and Monitoring
AIS Application & Interface Security
NIST SP 800-218A task
PS.1.3 Protect model weights and configuration parameters from unauthorised access and change
NIST COSAiS use case
Using and fine-tuning predictive AI
Using a generative AI assistant (LLM)
Sources

⁶ ⁷ ⁸ ¹⁰ ¹¹
NISTAML.032 Reconstruction

NIST AI 100-2 entry for NISTAML.032

A privacy attack that recovers training records, or attributes of them, from the model or its outputs.
Control
Minimise personal data in training, test tuned models for memorisation before release, and filter outputs.
- Eval Gate in CI
- Adversarial Red-Team Suite
Test
- garak propile: probes whether the model has memorised and can leak personal data
Evidence for
- EU AI Act Art. 10 data and data governance
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
Same threat elsewhere
- LLM02:2026 Sensitive Information Disclosure
- AML.T0024 Exfiltration via AI Inference API
Layer

L3
Control-framework ids
ISO/IEC 42001 Annex A
A.7.4 Quality of data for AI systems
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
DSP Data Security and Privacy Lifecycle Management
NIST COSAiS use case
Using and fine-tuning predictive AI
Sources

⁶ ⁸ ¹⁰ ¹¹ ¹⁴
NISTAML.033 Membership Inference

NIST AI 100-2 entry for NISTAML.033

The attacker infers whether a given record was in the training data, which is itself a privacy breach when the dataset is sensitive.
Control
Privacy testing of models trained or tuned on personal data, and limits on the confidence detail the API returns.
- Eval Gate in CI
- Adversarial Red-Team Suite
Test
- garak leakreplay: tests whether a document was in the training data by replay
Evidence for
- EU AI Act Art. 10 data and data governance
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
Same threat elsewhere
- LLM02:2026 Sensitive Information Disclosure
- AML.T0024 Exfiltration via AI Inference API
Layer

L3
Control-framework ids
ISO/IEC 42001 Annex A
A.7.4 Quality of data for AI systems
CSA AICM v1.1 domain
DSP Data Security and Privacy Lifecycle Management
NIST COSAiS use case
Using and fine-tuning predictive AI
Using a generative AI assistant (LLM)
Sources

⁶ ⁸ ¹⁰ ¹¹ ¹⁴
NISTAML.018 Prompt Injection

NIST AI 100-2 entry for NISTAML.018

A direct prompting attack: the attacker, as the user, supplies instructions that override the application's. NIST treats a jailbreak as one kind of it and lists the class under availability, integrity, privacy and misuse violations alike.
Control
Guardrails on inputs and outputs, alignment tested against current attack families, and misuse monitoring.
- Runtime Guardrail
- Adversarial Red-Team Suite
Test
- garak dan: do-anything-now style jailbreak prompts
- Inspect strong_reject: jailbreak susceptibility with a graded evaluator
Evidence for
Same threat elsewhere
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
Sources

⁶ ⁸ ¹⁰ ¹¹ ¹² ¹⁴
NISTAML.015 Indirect Prompt Injection

NIST AI 100-2 entry for NISTAML.015

Instructions are planted in resources the model ingests (web pages, documents, emails, tool results) rather than typed by the user, so the attacker never talks to the system directly.
Control
Mark and isolate untrusted content, restrict what tools can do on it, and require approval for consequential actions.
Test
- Inspect agentdojo: agents solving tasks over untrusted data that carries injections
- garak latentinjection: injections buried in documents
Evidence for
Same threat elsewhere
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
AI agent systems: single agent
Sources

⁶ ⁸ ¹⁰ ¹¹ ¹² ¹⁴
NISTAML.035 Prompt Extraction

NIST AI 100-2 entry for NISTAML.035

A privacy attack that makes a generative model reveal its system prompt or other hidden context.
Control
No secrets in the prompt, and extraction attempts logged and tested.
- Runtime Guardrail
- Adversarial Red-Team Suite
Test
- garak sysprompt_extraction: system prompt extraction attempts
Evidence for
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
- OWASP Top 10 for LLM Applications 2026
Same threat elsewhere
- LLM08:2026 Hidden Context Exposure
- AML.T0056 Extract LLM System Prompt
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
AIS Application & Interface Security
NIST COSAiS use case
Using a generative AI assistant (LLM)
Sources

⁶ ⁸ ¹⁰ ¹¹ ¹⁴
NISTAML.038 Data Extraction

NIST AI 100-2 entry for NISTAML.038

Training data, including personal or copyrighted text, is extracted from a generative model through its outputs.
Control
Deduplicate and minimise sensitive training data, test for memorisation, and filter outputs that reproduce it.
- Eval Gate in CI
- Runtime Guardrail
Test
- promptfoo divergent-repetition: repetition patterns that push the model to reveal training data
- garak divergence: repeat attacks that make output drift into training data
Evidence for
Same threat elsewhere
- LLM02:2026 Sensitive Information Disclosure
- AML.T0057 LLM Data Leakage
Layer

L3 L4
Control-framework ids
ISO/IEC 42001 Annex A
A.7.4 Quality of data for AI systems
A.6.2.4 AI system verification and validation
CSA AICM v1.1 domain
DSP Data Security and Privacy Lifecycle Management
NIST COSAiS use case
Using a generative AI assistant (LLM)
Security controls for AI developers
Sources

⁶ ⁸ ¹⁰ ¹¹ ¹³ ¹⁴
NISTAML.039 Compromising connected resources

NIST AI 100-2 entry for NISTAML.039

Through prompt injection, the model is made to leak private information from the restricted resources it can reach (tools, APIs, data stores); NIST classes it as a privacy compromise.
Control
Least-privilege access for the model's identity, authorisation enforced at each resource, and approval before sensitive actions.
Test
- promptfoo ssrf: server-side request forgery through the model
- Inspect agentdojo: injections that try to misuse the agent's tools
Evidence for
Same threat elsewhere
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.5 AI system deployment
A.9.2 Processes for responsible use of AI systems
CSA AICM v1.1 domain
IAM Identity & Access Management
AIS Application & Interface Security
NIST COSAiS use case
AI agent systems: single agent
AI agent systems: multi-agent
Sources

⁶ ⁸ ¹⁰ ¹¹ ¹² ¹³
NISTAML.014 Energy-latency

NIST AI 100-2 entry for NISTAML.014

Inputs crafted to maximise computation degrade the service for everyone, an availability attack.
Control
Per-request compute and time limits, and load monitoring with a breaker.
- Runtime Guardrail
- Kill Switch / Circuit Breaker
Test
- promptfoo reasoning-dos: computational exhaustion through reasoning
Evidence for
- EU AI Act Art. 15 accuracy, robustness and cybersecurity
- CSA AI Controls Matrix (AICM) v1.1
Same threat elsewhere
- LLM06:2026 Unbounded Consumption
- AML.T0034 Cost Harvesting
Layer

L4
Control-framework ids
ISO/IEC 42001 Annex A
A.6.2.6 AI system operation and monitoring
CSA AICM v1.1 domain
BCR Business Continuity Management and Operational Resilience
NIST COSAiS use case
Using and fine-tuning predictive AI
Using a generative AI assistant (LLM)
Sources

⁶ ⁸ ¹⁰ ¹¹ ¹³

The control frameworks beside each row

ISO/IEC 42001 controls are cited by their Annex A id and short title only ¹⁰; the register rows they belong to are linked under "Evidence for". CSA AICM v1.1 holds 247 control objectives in 18 domains ¹¹; rows name the domain, following the domain mapping OWASP publishes for the 2026 LLM list ², not individual control ids. NIST SP 800-218A adds AI-specific tasks to the Secure Software Development Framework, and a row names one only where the threat enters during development ⁷.

NIST's Control Overlays for Securing AI Systems (COSAiS) will tailor SP 800-53 controls to five use cases. As of 2026-09-24 the project page lists a concept paper (14 Aug 2025) and an annotated outline for predictive AI (8 Jan 2026) and no overlay in final form, so rows name the use case a threat belongs to, not overlay controls ⁸.

Sources

Each catalogue is pinned to the version named above. ATLAS names and mitigation links were read from the release data, because the ATLAS website renders in JavaScript.

[1] OWASP GenAI LLM Top 10 2026 (LLM01:2026 Prompt Injection to LLM10:2026 Improper Output Handling; resource page dated 3 Aug 2026). OWASP GenAI Security Project. 2026-08-03. https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ (verified: primary)
[2] OWASP Top 10 for LLM Applications 2026, canonical Markdown source and Appendix A: Related Framework Mappings (final list and entry texts in 2026/final; Appendix A maps each entry to the Agentic Top 10 and to CSA AICM v1.1 domains; the repository README gives the release date as 4 Aug 2026). OWASP GenAI Security Project (GitHub). 2026-08. https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/Appendix_A_Related_Framework_Mappings.md (verified: primary)
[3] OWASP Top 10 for LLM Applications 2025 (the previous edition, LLM01:2025 to LLM10:2025, used for the "formerly" ids). OWASP GenAI Security Project. 2025. https://genai.owasp.org/llm-top-10/ (verified: primary)
[4] OWASP Top 10 for Agentic Applications for 2026 (ASI01 Agent Goal Hijack to ASI10 Rogue Agents). OWASP GenAI Security Project. 2025-12-09. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ (verified: primary)
[5] MITRE ATLAS data, release v2026.09 (16 tactics, 120 techniques, 88 sub-techniques, 40 mitigations; technique names and technique-to-mitigation links read from dist/v6/ATLAS-2026.09.yaml). MITRE. 2026-09-15. https://github.com/mitre-atlas/atlas-data/releases/tag/v2026.09 (verified: primary)
[6] NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (predictive and generative AI attack taxonomies with NISTAML identifiers). NIST. 2025-03-24. https://csrc.nist.gov/pubs/ai/100/2/e2025/final (verified: primary)
[7] NIST SP 800-218A, Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile (AI-specific tasks added to SSDF 1.1 (e.g. PO.5.3, PS.1.3, PW.3.1 to PW.3.3) and AI-specific recommendations on existing tasks (e.g. PW.1.1, RV.1.1)). NIST. 2024-07. https://csrc.nist.gov/pubs/sp/800/218/a/final (verified: primary)
[8] SP 800-53 Control Overlays for Securing AI Systems (COSAiS) (five proposed use cases; concept paper 14 Aug 2025; annotated outline for predictive AI 8 Jan 2026; no overlay published in final form on the project page as of 2026-09-24). NIST. 2026-01-08. https://csrc.nist.gov/projects/cosais (verified: primary)
[9] Regulation (EU) 2024/1689 (AI Act) (Art. 15(5): resilience against attempts to alter use, outputs or performance, including data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks and model flaws). Publications Office of the EU (EUR-Lex). 2024-07-12. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (verified: primary)
[10] ISO/IEC 42001:2023, AI management systems, Annex A (reference control objectives and controls A.2 to A.10, cited by id and short title). ISO/IEC. 2023. https://www.iso.org/standard/81230.html (verified: secondary)
[11] AI Controls Matrix v1.1 (247 control objectives across 18 security domains; released 22 Jun 2026). Cloud Security Alliance. 2026-06-22. https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1 (verified: primary)
[12] Inspect Evals (community evaluations for the Inspect framework, e.g. agentdojo, agent_threat_bench, strong_reject, cyberseceval_2). UK AI Security Institute and contributors (GitHub). 2026. https://github.com/UKGovernmentBEIS/inspect_evals (verified: primary)
[13] promptfoo red-team plugins (plugin ids such as indirect-prompt-injection, prompt-extraction, rag-poisoning, agentic:memory-poisoning). promptfoo. 2026. https://www.promptfoo.dev/docs/red-team/plugins/ (verified: primary)
[14] garak, LLM vulnerability scanner, release v0.17.0 (probe modules such as promptinject, latentinjection, sysprompt_extraction, leakreplay, packagehallucination). NVIDIA (GitHub). 2026-09-09. https://github.com/NVIDIA/garak (verified: primary)