TTP map: Feintkit scenarios to MITRE ATLAS, ATT&CK, and OWASP

Generated by python3 scripts/verify-mappings.py --online --write from docs/scenarios/MAPPINGS.json. Every ATLAS ID below was checked against MITRE ATLAS release 2026.09 (collection modified 2026-09-15). ATT&CK IDs are taken from ATLAS's own attack-reference field, not from memory.

Scenario specs carry these same IDs in their manifests. A mapping states which adversary technique a scenario simulates; for scenarios marked "enabling weakness" it states the technique the weakness makes possible.

MCP

Scenario	MITRE ATLAS	ATT&CK (from ATLAS)	OWASP LLM 2025	OWASP Agentic 2026	References
`mcp-01-tool-poisoning` Tool poisoning demo server	`AML.T0110.000` Definition and Instructions `AML.T0011.002` Poisoned AI Agent Tool	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack ASI02 Tool Misuse and Exploitation	R1
`mcp-02-rug-pull` Rug-pull demo server	`AML.T0109` AI Supply Chain Rug Pull `AML.T0110.001` Implementation	none	LLM03:2025 Supply Chain	ASI04 Agentic Supply Chain Vulnerabilities	R1
`mcp-03-tool-shadowing` Tool shadowing demo server	`AML.T0110.000` Definition and Instructions `AML.T0074` Masquerading	T1036	LLM01:2025 Prompt Injection	ASI02 Tool Misuse and Exploitation ASI04 Agentic Supply Chain Vulnerabilities	R1
`mcp-04-excessive-scope` Excessive permission scope demo server	`AML.T0053` AI Agent Tool Invocation	none	LLM06:2025 Excessive Agency	ASI02 Tool Misuse and Exploitation ASI03 Identity and Privilege Abuse	R5, R1
`mcp-05-resource-injection` Indirect injection via resource content demo server	`AML.T0051.001` Indirect	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack	R1
`mcp-06-credential-harvest` Credential harvesting via parameters demo server	`AML.T0110.000` Definition and Instructions `AML.T0086` Exfiltration via AI Agent Tool Invocation	none	LLM02:2025 Sensitive Information Disclosure	ASI03 Identity and Privilege Abuse	R1
`mcp-07-command-injection-sim` Simulated command injection demo server	`AML.T0050` Command and Scripting Interpreter `AML.T0102` Generate Malicious Commands	T1059	LLM05:2025 Improper Output Handling	ASI05 Unexpected Code Execution	R1
`mcp-08-exfil-sim` Data exfiltration simulation demo server	`AML.T0086` Exfiltration via AI Agent Tool Invocation `AML.T0025` Exfiltration via Cyber Means	none	LLM02:2025 Sensitive Information Disclosure	ASI02 Tool Misuse and Exploitation	R1
`mcp-09-impersonation` Server impersonation / typosquatting demo server	`AML.T0074` Masquerading `AML.T0073` Impersonation `AML.T0010.005` AI Agent Tool	T1036 T1656	LLM03:2025 Supply Chain	ASI04 Agentic Supply Chain Vulnerabilities	R1
`mcp-10-sampling-abuse` MCP sampling abuse demo server	`AML.T0051.001` Indirect `AML.T0053` AI Agent Tool Invocation	none	LLM01:2025 Prompt Injection LLM06:2025 Excessive Agency	ASI01 Agent Goal Hijack ASI02 Tool Misuse and Exploitation	R7, R1
`mcp-11-elicitation-phish` MCP elicitation phishing demo server	`AML.T0052` Phishing `AML.T0073` Impersonation	T1566 T1656	LLM02:2025 Sensitive Information Disclosure	ASI09 Human-Agent Trust Exploitation	R8, R1
`mcp-12-oauth-confused-deputy` MCP OAuth confused deputy / token passthrough demo	`AML.T0091.000` Application Access Token	T1550.001	none	ASI03 Identity and Privilege Abuse	R5, R1
`mcp-13-exposed-local-server` Exposed local MCP server demo	`AML.T0132` Misconfigured or Publicly Exposed AI Services `AML.T0006.002` Scan for Exposed AI Infrastructure `AML.T0049` Exploit Public-Facing Application	T1595 T1190	none	none	R5, R1
`mcp-14-cross-tool-poisoning` Cross-tool context poisoning demo (two-server)	`AML.T0110.002` Runtime Response `AML.T0080.001` Thread `AML.T0051.001` Indirect	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack ASI06 Memory and Context Poisoning	R1
`mcp-15-control-tool` Benign twin of the tool poisoning server (control)	`AML.T0110.000` Definition and Instructions `AML.T0011.002` Poisoned AI Agent Tool	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack ASI02 Tool Misuse and Exploitation	R1

Why each technique applies:

mcp-01-tool-poisoning / AML.T0110.000: Malicious instructions hidden in the tool's model-visible description/schema.
mcp-01-tool-poisoning / AML.T0011.002: The victim's agent invokes the poisoned tool.
mcp-02-rug-pull / AML.T0109: Tool is benign when approved, then changes after trust is established.
mcp-02-rug-pull / AML.T0110.001: The changed behavior lives in the tool implementation.
mcp-03-tool-shadowing / AML.T0110.000: One tool's description alters how the agent uses a different, trusted tool.
mcp-03-tool-shadowing / AML.T0074: Name/description collision makes the malicious tool appear legitimate.
mcp-04-excessive-scope / AML.T0053: Excess capability is what an adversary abuses through tool invocation (this scenario is the enabling weakness, not an attack step).
mcp-05-resource-injection / AML.T0051.001: Instructions arrive in server-returned resource content, not the user's prompt.
mcp-06-credential-harvest / AML.T0110.000: The tool's model-visible schema and description add unnecessary credential parameters and ask the model to fill them; ATLAS text: poisoned definitions may direct the agent to populate hidden or unnecessary parameters.
mcp-06-credential-harvest / AML.T0086: The credential travels in the tool call's input parameters to the server; ATLAS text: sensitive information encoded into tool input parameters and sent to an adversary-controlled location, with a malicious tool as a variant.
mcp-07-command-injection-sim / AML.T0050: Free-form input that would reach a command interpreter (dry-run only).
mcp-07-command-injection-sim / AML.T0102: Commands produced from natural language.
mcp-08-exfil-sim / AML.T0086: Data encoded into a tool call's parameters and sent to an adversary-controlled destination (loopback only).
mcp-08-exfil-sim / AML.T0025: Exfiltration over a network channel.
mcp-09-impersonation / AML.T0074: Name/branding mimics a legitimate MCP server.
mcp-09-impersonation / AML.T0073: Impersonates a trusted organization.
mcp-09-impersonation / AML.T0010.005: Compromise of the AI agent tool supply chain.
mcp-10-sampling-abuse / AML.T0051.001: Server-supplied prompt text steers the client's LLM.
mcp-10-sampling-abuse / AML.T0053: The steered LLM is induced to invoke tools.
mcp-11-elicitation-phish / AML.T0052: Server solicits sensitive input from the user under false pretenses.
mcp-11-elicitation-phish / AML.T0073: Presents the request as coming from a trusted party.
mcp-12-oauth-confused-deputy / AML.T0091.000: Closest fit, not exact: ATLAS text is about using stolen application access tokens in place of login credentials; here a token not issued to the server is accepted and forwarded to another service (token passthrough).
mcp-13-exposed-local-server / AML.T0132: Server bound beyond loopback without access controls.
mcp-13-exposed-local-server / AML.T0006.002: Such servers are discoverable by scanning.
mcp-13-exposed-local-server / AML.T0049: Exposed service is reachable as a public-facing application.
mcp-14-cross-tool-poisoning / AML.T0110.002: One tool's response carries instructions aimed at another tool.
mcp-14-cross-tool-poisoning / AML.T0080.001: Poisons the conversation thread context.
mcp-14-cross-tool-poisoning / AML.T0051.001: Instructions arrive via tool output.
mcp-15-control-tool / AML.T0110.000: Malicious instructions hidden in the tool's model-visible description/schema.
mcp-15-control-tool / AML.T0011.002: The victim's agent invokes the poisoned tool.

Skills

Scenario	MITRE ATLAS	ATT&CK (from ATLAS)	OWASP LLM 2025	OWASP Agentic 2026	References
`skill-01-prompt-injection` Skill prompt injection demo skill	`AML.T0115.002` AI Agent Tools `AML.T0110.000` Definition and Instructions `AML.T0051.001` Indirect	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack ASI04 Agentic Supply Chain Vulnerabilities	R1
`skill-02-rug-pull` Skill rug-pull demo skill	`AML.T0109` AI Supply Chain Rug Pull `AML.T0115.002` AI Agent Tools	none	LLM03:2025 Supply Chain	ASI04 Agentic Supply Chain Vulnerabilities	R1
`skill-03-impersonation` Skill impersonation/typosquatting demo skill	`AML.T0074` Masquerading `AML.T0073` Impersonation `AML.T0010.005` AI Agent Tool	T1036 T1656	LLM03:2025 Supply Chain	ASI04 Agentic Supply Chain Vulnerabilities	R1
`skill-04-bundled-script` Bundled malicious script demo skill	`AML.T0110.001` Implementation `AML.T0050` Command and Scripting Interpreter `AML.T0011.002` Poisoned AI Agent Tool	T1059	LLM03:2025 Supply Chain	ASI04 Agentic Supply Chain Vulnerabilities ASI05 Unexpected Code Execution	R1
`skill-05-trigger-hijack` Skill trigger hijack demo skill	`AML.T0110.000` Definition and Instructions	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack ASI02 Tool Misuse and Exploitation	R1
`skill-06-shadowing` Skill shadowing / scope precedence demo skill	`AML.T0074` Masquerading `AML.T0110.000` Definition and Instructions	T1036	LLM03:2025 Supply Chain	ASI04 Agentic Supply Chain Vulnerabilities	R1
`skill-07-allowed-tools` Skill over-broad allowed-tools demo skill	`AML.T0053` AI Agent Tool Invocation	none	LLM06:2025 Excessive Agency	ASI03 Identity and Privilege Abuse	R1
`skill-08-poisoned-references` Skill poisoned reference files demo skill	`AML.T0051.001` Indirect `AML.T0110.000` Definition and Instructions	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack	R1
`skill-09-control-skill` Benign twin of the skill prompt injection skill (control)	`AML.T0115.002` AI Agent Tools `AML.T0110.000` Definition and Instructions `AML.T0051.001` Indirect	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack ASI04 Agentic Supply Chain Vulnerabilities	R1

Why each technique applies:

skill-01-prompt-injection / AML.T0115.002: Poisoned skill published to a skill registry.
skill-01-prompt-injection / AML.T0110.000: Hidden instructions in the skill's model-visible content.
skill-01-prompt-injection / AML.T0051.001: Instructions delivered through skill content.
skill-02-rug-pull / AML.T0109: Skill is clean at install, malicious after an update.
skill-02-rug-pull / AML.T0115.002: Distributed through a skill registry.
skill-03-impersonation / AML.T0074: Name mimics a trusted skill.
skill-03-impersonation / AML.T0073: Impersonates a trusted publisher.
skill-03-impersonation / AML.T0010.005: AI agent tool supply chain compromise.
skill-04-bundled-script / AML.T0110.001: Hidden behavior in a bundled executable (print-only here).
skill-04-bundled-script / AML.T0050: Script would run via a command interpreter.
skill-04-bundled-script / AML.T0011.002: Victim invokes the poisoned skill.
skill-05-trigger-hijack / AML.T0110.000: Over-broad description manipulates when the agent selects the skill.
skill-06-shadowing / AML.T0074: Same name as a trusted skill at a higher-precedence scope.
skill-06-shadowing / AML.T0110.000: Definition overrides the trusted one.
skill-07-allowed-tools / AML.T0053: Broad tool grants are what an adversary abuses (enabling weakness).
skill-08-poisoned-references / AML.T0051.001: Injection in lazily loaded reference files.
skill-08-poisoned-references / AML.T0110.000: Poisoned model-visible skill content.
skill-09-control-skill / AML.T0115.002: Poisoned skill published to a skill registry.
skill-09-control-skill / AML.T0110.000: Hidden instructions in the skill's model-visible content.
skill-09-control-skill / AML.T0051.001: Instructions delivered through skill content.

Prompt and context injection

Scenario	MITRE ATLAS	ATT&CK (from ATLAS)	OWASP LLM 2025	OWASP Agentic 2026	References
`inj-01-web-page` Indirect injection via web page demo	`AML.T0051.001` Indirect `AML.T0093` Prompt Infiltration via Public-Facing Application	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack	R1, R2
`inj-02-document` Indirect injection via email/document/PDF demo	`AML.T0051.001` Indirect `AML.T0093` Prompt Infiltration via Public-Facing Application	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack	R1, R2
`inj-03-scm-text` Indirect injection via PR/issue comment demo	`AML.T0051.001` Indirect `AML.T0093` Prompt Infiltration via Public-Facing Application `AML.T0119` Exploit Automated Artifact Processing Pipeline	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack	R1, R2
`inj-04-invisible-text` Invisible-text injection demo	`AML.T0068` LLM Prompt Obfuscation `AML.T0051.001` Indirect	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack	R1, R2
`inj-05-image-ocr` Image/OCR injection demo	`AML.T0129` Triggers in Multimodal Inputs `AML.T0051.001` Indirect	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack	R1, R2
`inj-06-config-file` Agent config-file poisoning demo	`AML.T0081` Modify AI Agent Configuration `AML.T0051.001` Indirect	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack ASI06 Memory and Context Poisoning	R1, R2
`inj-07-memory` Agent memory poisoning demo	`AML.T0080.000` Memory	none	LLM01:2025 Prompt Injection	ASI06 Memory and Context Poisoning	R1, R2
`inj-08-rag` RAG / vector-store poisoning demo	`AML.T0070` RAG Poisoning `AML.T0071` False RAG Entry Injection `AML.T0066` Retrieval Content Crafting	none	LLM08:2025 Vector and Embedding Weaknesses LLM04:2025 Data and Model Poisoning	ASI06 Memory and Context Poisoning	R1, R2
`inj-09-jailbreak-corpus` Jailbreak & system-prompt-extraction prompt corpus	`AML.T0054` LLM Jailbreak `AML.T0056` Extract LLM System Prompt `AML.T0051.000` Direct	none	LLM01:2025 Prompt Injection LLM07:2025 System Prompt Leakage	none	R1, R2
`inj-10-control-document` Benign twin of the document injection carriers (control)	`AML.T0051.001` Indirect `AML.T0093` Prompt Infiltration via Public-Facing Application	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack	R1, R2
`inj-11-control-instruction-file` Benign twin of the agent config-file poisoning demo (control)	`AML.T0081` Modify AI Agent Configuration `AML.T0051.001` Indirect	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack ASI06 Memory and Context Poisoning	R1, R2
`inj-12-multi-turn-split` Payload split across conversation turns	`AML.T0051.000` Direct `AML.T0080.001` Thread	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack	R1, R2
`inj-13-delayed-trigger` Dormant instruction triggered several turns later	`AML.T0051.001` Indirect `AML.T0080.001` Thread	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack ASI06 Memory and Context Poisoning	R1, R2

Why each technique applies:

inj-01-web-page / AML.T0051.001: Injection in fetched web content.
inj-01-web-page / AML.T0093: Malicious prompts placed where an AI will later ingest them.
inj-02-document / AML.T0051.001: Injection in email/document/PDF content.
inj-02-document / AML.T0093: Prompts planted for later ingestion.
inj-03-scm-text / AML.T0051.001: Injection in PR/issue/commit text.
inj-03-scm-text / AML.T0093: Public-facing input later ingested by an agent.
inj-03-scm-text / AML.T0119: Artifact triggers an automated processing pipeline.
inj-04-invisible-text / AML.T0068: Instructions hidden from humans (Unicode tags, zero-width, hidden CSS, comments).
inj-04-invisible-text / AML.T0051.001: Hidden instructions delivered as content.
inj-05-image-ocr / AML.T0129: Instructions placed in an image modality.
inj-05-image-ocr / AML.T0051.001: Injection through non-text content.
inj-06-config-file / AML.T0081: Agent configuration/rules files modified to carry instructions.
inj-06-config-file / AML.T0051.001: Instructions arrive via repository content.
inj-07-memory / AML.T0080.000: Persistent instruction planted in agent memory.
inj-08-rag / AML.T0070: Poisoned document in the retrieval corpus.
inj-08-rag / AML.T0071: A false entry is injected into the index.
inj-08-rag / AML.T0066: Content crafted to be retrieved.
inj-09-jailbreak-corpus / AML.T0054: Jailbreak prompts.
inj-09-jailbreak-corpus / AML.T0056: System prompt extraction attempts.
inj-09-jailbreak-corpus / AML.T0051.000: Direct prompt injection.
inj-10-control-document / AML.T0051.001: Injection in email/document/PDF content.
inj-10-control-document / AML.T0093: Prompts planted for later ingestion.
inj-11-control-instruction-file / AML.T0081: Agent configuration/rules files modified to carry instructions.
inj-11-control-instruction-file / AML.T0051.001: Instructions arrive via repository content.
inj-12-multi-turn-split / AML.T0051.000: Instruction typed by the user side of the conversation, a fragment per turn.
inj-12-multi-turn-split / AML.T0080.001: Fragments accumulate in the thread and are joined in a later turn.
inj-13-delayed-trigger / AML.T0051.001: Instruction arrives inside a pasted document in the first turn.
inj-13-delayed-trigger / AML.T0080.001: The instruction stays in the thread and can act in a much later turn.

Exfiltration and output handling

Scenario	MITRE ATLAS	ATT&CK (from ATLAS)	OWASP LLM 2025	OWASP Agentic 2026	References
`exf-01-markdown-image` Markdown-image / link exfiltration demo	`AML.T0077` LLM Response Rendering	none	LLM02:2025 Sensitive Information Disclosure LLM05:2025 Improper Output Handling	none	R1, R2
`exf-02-ansi-escape` ANSI/terminal escape injection demo	`AML.T0067` LLM Trusted Output Components Manipulation `AML.T0068` LLM Prompt Obfuscation	none	LLM05:2025 Improper Output Handling	none	R1, R2
`exf-03-insecure-output` Insecure output handling demo (dry-run sinks)	`AML.T0050` Command and Scripting Interpreter `AML.T0102` Generate Malicious Commands	T1059	LLM05:2025 Improper Output Handling	ASI05 Unexpected Code Execution	R1, R2

Why each technique applies:

exf-01-markdown-image / AML.T0077: Data encoded into a rendered external reference that makes a request to an attacker server (loopback only).
exf-02-ansi-escape / AML.T0067: Closest ATLAS technique: output components manipulated to mislead the user (no exact ATLAS technique for terminal escape injection).
exf-02-ansi-escape / AML.T0068: Content hidden from the human reader.
exf-03-insecure-output / AML.T0050: Model output flows to a command interpreter sink (dry-run).
exf-03-insecure-output / AML.T0102: Commands generated from model output.

Agent trust

Scenario	MITRE ATLAS	ATT&CK (from ATLAS)	OWASP LLM 2025	OWASP Agentic 2026	References
`agt-01-approval-fatigue` Approval-fatigue / UI spoofing demo	`AML.T0067` LLM Trusted Output Components Manipulation	none	LLM06:2025 Excessive Agency	ASI09 Human-Agent Trust Exploitation	R1
`agt-02-a2a-spoofing` Agent-to-agent message spoofing demo	`AML.T0118.001` Direct Agent Communication `AML.T0073` Impersonation	T1656	none	ASI07 Insecure Inter-Agent Communication	R1, R4
`agt-03-computer-use-injection` Browser/computer-use agent injection demo	`AML.T0100` AI Agent Clickbait `AML.T0051.001` Indirect	none	LLM01:2025 Prompt Injection	ASI01 Agent Goal Hijack	R1
`agt-04-argument-smuggling` Argument-smuggling approval demo	`AML.T0053` AI Agent Tool Invocation `AML.T0050` Command and Scripting Interpreter	T1059	LLM06:2025 Excessive Agency	ASI02 Tool Misuse and Exploitation ASI09 Human-Agent Trust Exploitation	R1
`agt-05-approval-bypass` Approval-rule bypass demo	`AML.T0053` AI Agent Tool Invocation `AML.T0050` Command and Scripting Interpreter	T1059	LLM06:2025 Excessive Agency	ASI02 Tool Misuse and Exploitation ASI05 Unexpected Code Execution	R1
`agt-06-subagent-handoff` Sub-agent hand-off demo	`AML.T0118.001` Direct Agent Communication `AML.T0053` AI Agent Tool Invocation	none	LLM06:2025 Excessive Agency	ASI07 Insecure Inter-Agent Communication ASI01 Agent Goal Hijack	R1
`agt-07-tool-chain-relay` Tool-chain relay demo	`AML.T0053` AI Agent Tool Invocation `AML.T0051.001` Indirect	none	LLM01:2025 Prompt Injection LLM06:2025 Excessive Agency	ASI02 Tool Misuse and Exploitation ASI01 Agent Goal Hijack	R1

Why each technique applies:

agt-01-approval-fatigue / AML.T0067: Closest fit, not exact: ATLAS text is about manipulating components of a model response, including recommended follow-up actions, to look trustworthy to the user; here the approval text the user is shown is made to look benign.
agt-02-a2a-spoofing / AML.T0118.001: Forged message on the direct agent-to-agent channel.
agt-02-a2a-spoofing / AML.T0073: Impersonates a trusted orchestrator.
agt-03-computer-use-injection / AML.T0100: Deceptive UI content baits a computer-using agent into unintended actions.
agt-03-computer-use-injection / AML.T0051.001: Injection through on-screen content.
agt-04-argument-smuggling / AML.T0053: The agent invokes a tool whose later arguments carry something the approver was not shown (simulated, nothing runs).
agt-04-argument-smuggling / AML.T0050: The command text would reach a command interpreter if it were executed; the scenario only writes the text (dry-run only).
agt-05-approval-bypass / AML.T0053: The agent invokes a tool under an auto-approve rule that does not cover the whole command (simulated, nothing runs).
agt-05-approval-bypass / AML.T0050: The chained command would reach a command interpreter if it were executed; the scenario only writes the text (dry-run only).
agt-06-subagent-handoff / AML.T0118.001: Direct agent communication: the hand-off is tasking passed from one agent to a sub-agent (simulated, nothing is delegated).
agt-06-subagent-handoff / AML.T0053: The sub-agent would invoke the tools it is given under a brief that carries no guardrail (simulated, nothing runs).
agt-07-tool-chain-relay / AML.T0053: The agent invokes a tool whose argument is the result of an earlier call (simulated, nothing runs).
agt-07-tool-chain-relay / AML.T0051.001: The text an earlier tool returned, written by an outside sender, is indirect injection that travels on as an argument.

Supply chain

Scenario	MITRE ATLAS	ATT&CK (from ATLAS)	OWASP LLM 2025	OWASP Agentic 2026	References
`sup-01-slopsquat` Slopsquatting canary package demo	`AML.T0060` Publish Hallucinated Entities `AML.T0011.001` Malicious Package `AML.T0010.001` AI Software	none	LLM03:2025 Supply Chain LLM09:2025 Misinformation	ASI04 Agentic Supply Chain Vulnerabilities	R1, R2
`sup-02-model-file` Model-file payload marker demo	`AML.T0018.002` Embed Malware `AML.T0011.000` Unsafe AI Artifacts `AML.T0010.003` Model	none	LLM03:2025 Supply Chain LLM04:2025 Data and Model Poisoning	ASI04 Agentic Supply Chain Vulnerabilities	R1, R2
`sup-03-marketplace-typosquat` Plugin/extension marketplace typosquat demo	`AML.T0074` Masquerading `AML.T0111` AI Supply Chain Reputation Inflation `AML.T0115.002` AI Agent Tools	T1036	LLM03:2025 Supply Chain	ASI04 Agentic Supply Chain Vulnerabilities	R1

Why each technique applies:

sup-01-slopsquat / AML.T0060: Package named after a name an LLM commonly hallucinates.
sup-01-slopsquat / AML.T0011.001: Victim installs a malicious package.
sup-01-slopsquat / AML.T0010.001: AI software supply chain.
sup-02-model-file / AML.T0018.002: Malware embedded in a model artifact (inert marker only).
sup-02-model-file / AML.T0011.000: Unsafe AI artifact loaded by the victim.
sup-02-model-file / AML.T0010.003: Model supply chain.
sup-03-marketplace-typosquat / AML.T0074: Typosquatted name mimics a popular plugin.
sup-03-marketplace-typosquat / AML.T0111: Fake trust signals inflate perceived legitimacy.
sup-03-marketplace-typosquat / AML.T0115.002: Poisoned agent tool published to a registry.

Resource abuse and research

Scenario	MITRE ATLAS	ATT&CK (from ATLAS)	OWASP LLM 2025	OWASP Agentic 2026	References
`abu-01-denial-of-wallet` Denial-of-wallet runaway tool loop demo	`AML.T0034.002` Agentic Resource Consumption `AML.T0029` Denial of AI Service	none	LLM10:2025 Unbounded Consumption	none	R1, R2
`abu-02-deferred-research` Deferred research: training-data poisoning & model extraction (decision record)	`AML.T0020` Training Data Poisoning `AML.T0018.000` Poison AI Model `AML.T0024.002` Extract AI Model	none	LLM04:2025 Data and Model Poisoning	none	R1, R2

Why each technique applies:

abu-01-denial-of-wallet / AML.T0034.002: Agent coerced into expensive repeated tool calls (hard-capped locally).
abu-01-denial-of-wallet / AML.T0029: Denial of AI service.
abu-02-deferred-research / AML.T0020: Training data poisoning.
abu-02-deferred-research / AML.T0018.000: Poisoning an AI model.
abu-02-deferred-research / AML.T0024.002: Model extraction.

References

R1 MITRE ATLAS data, release 2026.09 (authoritative technique IDs, names, descriptions, ATT&CK cross-references)
R2 OWASP Top 10 for LLM Applications 2025
R3 OWASP Top 10 for Agentic Applications for 2026
R4 OWASP agentic-top-10 working drafts (ASI01-ASI10 numbering and names, primary source repo)
R5 MCP specification 2025-06-18: Security Best Practices (confused deputy, token passthrough, session hijacking, local server compromise, DNS rebinding)
R7 MCP specification 2025-06-18: Client sampling
R8 MCP specification 2025-06-18: Client elicitation

Verification caveats

Per-technique pages on atlas.mitre.org (for example /techniques/AML.T0110) returned HTTP 404 to an HTTP client on 2026-09-30, so this document cites the ATLAS data file (R1) rather than those URLs. The dist/ATLAS.yaml file in the same repository is marked deprecated (release 5.6.0); the current data is under dist/v6/.
OWASP Agentic Top 10: ID numbering ASI01-ASI10 and the names for ASI02-ASI10 were checked against the OWASP project repository's Sprint-1 draft file names. ASI01 is named "Agent Behaviour Hijack" in that draft and "Agent Goal Hijack" in the published 2026 list as reported by secondary sources and by OWASP's own search-indexed page; the official PDF was not machine-checked. This document uses "Agent Goal Hijack".
OWASP LLM Top 10 2025 IDs and names were taken from the official genai.owasp.org page.
ATT&CK technique names in the table were read from the attack.mitre.org page titles when run with --online.
Where ATLAS has no exact technique (terminal escape injection, exposed local servers, excessive scope) the rationale column says so and names the closest technique.