The Attack Taxonomy: OWASP & MITRE ATLAS

Lesson 7: The Attack Taxonomy — OWASP & MITRE ATLAS

Red teaming needs a shared language. Two reference frameworks have become the industry standard for talking about AI attacks: the OWASP Top 10 for LLM Applications (application-focused, threat-oriented) and MITRE ATLAS (a full adversarial ML knowledge base modeled on ATT&CK). Learn both and you'll never again describe an attack with vague hand-waving — you'll name the technique, the tactic, and the mitigation.

OWASP Top 10 for LLM Applications

OWASP (the Open Worldwide Application Security Project) maintains a ranked list of the most critical LLM application vulnerabilities — think "OWASP Top 10 for web apps," but for AI. The current version (2025 update) is the definitive cheat-sheet for what can go wrong in an LLM application:

Rank Category One-line description
LLM01 Prompt Injection Attacker text overrides the model's instructions (Lesson 4).
LLM02 Sensitive Information Disclosure The model leaks confidential data — other users' info, secrets in training data, system internals.
LLM03 Supply Chain Compromised model weights, datasets, plugins, or dependencies flow into your system.
LLM04 Data and Model Poisoning Malicious data corrupts training, fine-tuning, or retrieval corpora (Lesson 6).
LLM05 Improper Output Handling Model output is trusted as code, SQL, or commands — enabling injection downstream.
LLM06 Excessive Agency The model has too many tools and permissions, and can be steered into abusing them.
LLM07 System Prompt Leakage Attacker extracts the system prompt or hidden instructions (a favorite recon step).
LLM08 Vector and Embedding Weaknesses RAG/vector databases manipulated via poisoned or adversarial embeddings.
LLM09 Misinformation The model produces false or misleading content that gets acted upon (overreliance).
LLM10 Unbounded Consumption Unlimited context/token usage — cost denial-of-service, resource exhaustion.
How to use it: walk your system against the ten categories before every major release. Each category maps to concrete mitigations in the OWASP guidance — and each maps to red team probes you should run. If you can't name which of the ten your latest feature touches, you haven't threat-modeled it yet.

MITRE ATLAS: The ATT&CK for AI

Where OWASP gives you a ranked top-10, MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) gives you the complete map — 14 tactics and dozens of techniques, structured exactly like MITRE's famous ATT&CK framework for cyber adversaries. Tactics include Reconnaissance, Resource Development, Initial Access, ML Attack Staging, Exfiltration, Impact, and more; techniques carry IDs (e.g., AML.T0018 — prompt injection) and cite real-world case studies of each attack actually being used.

The kill chain of an AI attack (simplified ATLAS flow) Recon find the AI surface Initial Access reach the model/API Attack Staging craft payloads Execution inject / jailbreak Exfiltration steal data / impact Why ATLAS matters for red teams shared IDs (AML.T0018…) across vendors, tools, and reports maps to ATT&CK for hybrid AI+IT threat models · real case studies per technique

Why ATLAS beats ad-hoc note-taking: (1) IDs, not descriptions — "we saw AML.T0018" is precise and searchable; (2) kill-chain thinking — it forces you to map the full adversary journey, not just the final exploit; (3) bridge to classic security — techniques map to ATT&CK, so an AI incident can be tracked in the same language as your SOC's other alerts; (4) real-world grounding — each technique links to documented cases (Tay, poisoning incidents, extraction attacks), which is gold for writing red team reports that management takes seriously.

Takeaway: OWASP tells you what's most likely to break; ATLAS tells you how an adversary would systematically attack. Use OWASP to prioritize your probes and ATLAS to structure your findings and map the kill chain. Together they're the red team's dictionary and grammar.

🧠 Knowledge Check

1. A chat assistant can be tricked into revealing its hidden system prompt. Which OWASP category is this?

2. What makes MITRE ATLAS different from a simple vulnerability list?

3. An attacker sends an email that, when summarized by an AI assistant, causes the assistant to exfiltrate the user's data. Which categories are involved?

Further Reading