170 AI attacks, four weaknesses
MITRE ATLAS catalogs 170 ways to attack an AI system. The CWE catalog has four AI-specific weaknesses to blame them on. The attack vocabulary has outrun the defensive one. Last updated: 2026-08-11
MITRE ATLAS is the attack catalog for AI systems. It lists 170 techniques an adversary can use against machine learning, from poisoning a training set to jailbreaking a model in production. I mapped all 170 to the enterprise ATT&CK framework and to the CWE weakness catalog by hand, because ATLAS ships with no links to either. Two numbers fell out that should bother anyone defending an AI system.
The attacks are well catalogued. The weaknesses are not.
Every attack exploits a weakness. So I mapped each ATLAS technique to the CWE it abuses. The 71 techniques that landed anywhere landed on just five weaknesses. Here they are, with the number of ATLAS techniques that exploit each.
| Weakness the attack exploits | CWE | ATLAS techniques |
|---|---|---|
| Improper neutralization of LLM prompt input | CWE-1427 | 33 |
| Dependency on a vulnerable component (ML supply chain) | CWE-1395 | 18 |
| Inadequate handling of adversarial input | CWE-1039 | 13 |
| Improper validation of generative AI output | CWE-1426 | 6 |
| Insecure generative AI inference settings | CWE-1434 | 1 |
From our own direct ATLAS-to-CWE mapping. Only four of these five are AI-specific. The fifth, a dependency on a vulnerable component, is an ordinary weakness that AI inherits from its software supply chain.
Now sit with the scale. The CWE catalog has more than nine hundred weaknesses. Four of them describe something particular to AI. The attack catalog has 170 entries and grows every year. You can name an AI attack precisely. You usually cannot name the weakness it exploits, because that weakness has never been written down.
Most AI attacks are new, not old attacks in new clothes
The second number is the 61%. Of the 170 techniques, 66 are the AI version of an attack that already exists in ATT&CK. Reconnaissance and initial access mostly look familiar. But 104 of them, the majority, have no equivalent at all. Poisoning a training set, evading a model with crafted input, stealing a model through its own inference API: these are not variations on old attacks. They are a new category. The frameworks most security programs run on do not describe them.
So the picture is lopsided. The attack vocabulary is specific and detailed. The weakness vocabulary is four entries. The control frameworks barely reach AI at all. You can say exactly what will be done to your model. You have almost nothing standard to map it to on the defensive side.
Why we mapped it ourselves
ATLAS does not ship with cross-references to ATT&CK or CWE, so there is no table to look this up in. Every edge here is one I authored and graded directly, the way we build every cross-walk on this site. Where a technique has no honest weakness or no enterprise analog, we record nothing rather than invent a link. The empty cells are the finding. Filling them with guesses would hide it.
This pairs with a companion piece on the one AI weakness the catalog does record. Even CWE-1427, the entry for prompt injection, went untagged on every prompt-injection CVE the NVD published. So the AI weakness catalog is both nearly empty and, where it exists, unused.
How to use this
- Security leader. If you run an AI system, do not expect a control framework or a weakness scan to describe your real risk. They do not have the words yet. Use ATLAS to enumerate what can be done to the model, and treat the defensive side as something you build, not adopt.
- Lean IT. Standard tools will not flag AI-specific risk, because the standards barely define it. If a model sits in anything that matters, the weaknesses in that table are the ones worth knowing by name.
- Researcher. The full ATLAS-to-ATT&CK and ATLAS-to-CWE mapping is on the map, direct and inspectable. The empty ce