Authorized security testing only. Use these techniques and payloads solely on systems you own or have explicit written permission to test. GenAI Security Lab accepts no liability for misuse.
Standards mapping
Cross-reference each attack section against three major AI security frameworks — use this to anchor findings in formal standards or to scope an engagement by framework requirement.
Overview
Each row maps one cheat-sheet section to the corresponding entries in three industry frameworks:
- OWASP LLM Top-10 (2026) — risk categories for large language model applications.
- MITRE ATLAS — adversarial threat landscape for AI systems, with technique IDs (AML.T*).
- OWASP AITG — AI Testing Guide test IDs organized by layer: application (APP), model (MOD), infrastructure (INF), and data (DAT).
Approximate IDs
Where the note column says "approximate — verify", the ATLAS technique ID is a best-effort mapping. ATLAS does not yet have a dedicated technique for every AI-specific attack pattern. Verify against the ATLAS catalogue before citing in a formal report.
Full mapping table
| Section | OWASP LLM | MITRE ATLAS | AITG test IDs | Notes |
|---|---|---|---|---|
| Attack surface mapping | LLM01:2026 | AML.T0040 (ML Model Inference API Access) | Cross-cutting recon (AITG ch.2 Threat Modeling); spans AITG-APP-01..14 | Cross-cutting recon/overview — enumerate every input channel and trust boundary that reaches the model; maps across all OWASP LLM risks. ATLAS reconnaissance id approximate — verify. |
| Prompt injection | LLM01:2026 | AML.T0051.000 (LLM Prompt Injection: Direct) | AITG-APP-01 (Prompt Injection) | Direct instruction override in user-controlled input; the base case for LLM01. |
| Jailbreak techniques | LLM01:2026 | AML.T0054 (LLM Jailbreak) | AITG-APP-01 (Prompt Injection), AITG-APP-12 (Toxic Output) | Bypass of safety alignment / guardrails; frequently layered on top of a prompt-injection carrier. |
| Indirect injection | LLM01:2026 | AML.T0051.001 (LLM Prompt Injection: Indirect) | AITG-APP-02 (Indirect Prompt Injection) | Instructions arrive via retrieved or third-party content, not the user's own turn. |
| Multimodal injection | LLM01:2026 | AML.T0051 (LLM Prompt Injection) | AITG-APP-02 (Indirect Prompt Injection), AITG-APP-01 (Prompt Injection) | Payload hidden in an image / audio / document channel. ATLAS has no modality-specific sub-technique — the modality is just the carrier for T0051. |
| System-prompt leakage | LLM08:2026LLM01:2026 | AML.T0056 (LLM Meta Prompt Extraction) | AITG-APP-07 (Prompt Disclosure), AITG-APP-04 (Input Leakage) | System-prompt / instruction disclosure (LLM08); also LLM01 when the extraction is driven by injection. |
| Sensitive data disclosure | LLM02:2026 | AML.T0057 (LLM Data Leakage), AML.T0024 (Exfiltration via ML Inference API) | AITG-APP-03 (Sensitive Data Leak), AITG-DAT-01 (Training Data Exposure), AITG-DAT-02 (Runtime Exfiltration) | Training-data memorization, PII, and secrets in context leaking through model outputs. |
| RAG & vector database | LLM09:2026LLM02:2026 | AML.T0051.001 (LLM Prompt Injection: Indirect); RAG Poisoning; Retrieval Content Crafting | AITG-APP-08 (Embedding Manipulation), AITG-APP-02 (Indirect Prompt Injection), AITG-DAT-02 (Runtime Exfiltration) | Vector/embedding weaknesses — retrieval poisoning, cross-context leakage, embedding inversion. RAG-specific ATLAS technique ids approximate — verify. |
| Agent & tool abuse | LLM03:2026 | AML.T0053 (LLM Plugin Compromise) | AITG-APP-06 (Agentic Behavior Limits), AITG-INF-04 (Capability Misuse), AITG-INF-03 (Plugin Boundary Violations) | Excessive agency — tool/plugin abuse, over-broad permissions, unsafe autonomous actions. |
| Multi-agent orchestration | LLM03:2026LLM01:2026 | AML.T0053 (LLM Plugin Compromise), AML.T0051.001 (LLM Prompt Injection: Indirect); LLM Prompt Self-Replication | AITG-APP-06 (Agentic Behavior Limits), AITG-APP-02 (Indirect Prompt Injection) | Agent-to-agent trust — injection propagation across orchestrated agents; self-replicating instructions. Self-replication ATLAS id approximate — verify. |
| MCP security | LLM03:2026LLM04:2026 | AML.T0053 (LLM Plugin Compromise), AML.T0011 (User Execution) | AITG-INF-03 (Plugin Boundary Violations), AITG-INF-01 (Supply Chain Tampering), AITG-APP-06 (Agentic Behavior Limits) | Model Context Protocol — malicious/compromised MCP servers, tool poisoning, over-scoped connectors. No MCP-specific ATLAS technique; closest are Plugin Compromise + Supply Chain. |
| Coding assistants | LLM10:2026LLM04:2026 | AML.T0011 (User Execution), AML.T0010 (ML Supply Chain Compromise); Discover LLM Hallucinations | AITG-APP-05 (Unsafe Outputs), AITG-APP-11 (Hallucinations), AITG-INF-01 (Supply Chain Tampering) | Insecure code suggestions, package hallucination / slopsquatting, malicious repo context. Hallucination-discovery ATLAS id approximate — verify. |
| Computer-use & browser agents | LLM03:2026LLM01:2026 | AML.T0053 (LLM Plugin Compromise), AML.T0051.001 (LLM Prompt Injection: Indirect) | AITG-APP-06 (Agentic Behavior Limits), AITG-APP-02 (Indirect Prompt Injection) | GUI / computer-use agents — screen-content injection, unintended clicks and real-world actions. No computer-use-specific ATLAS technique. |
| Misinformation & hallucination | LLM07:2026 | AML.T0048 (External Harms); Discover LLM Hallucinations | AITG-APP-11 (Hallucinations), AITG-APP-13 (Over-Reliance on AI), AITG-APP-10 (Content Bias) | Hallucination, overreliance, fabricated citations. Hallucination-discovery ATLAS id approximate — verify. |
| Improper output handling | LLM10:2026 | AML.T0048 (External Harms), AML.T0051 (LLM Prompt Injection) | AITG-APP-05 (Unsafe Outputs) | Downstream sinks trust raw model output (XSS/SSRF/SQLi/command injection). ATLAS models this as the External-Harm impact of injection — no dedicated output-handling technique. |
| Authorization & business logic | LLM03:2026 | AML.T0012 (Valid Accounts), AML.T0053 (LLM Plugin Compromise) | AITG-APP-06 (Agentic Behavior Limits), AITG-INF-04 (Capability Misuse) | Confused-deputy / excessive agency — missing authz on tool actions, privilege escalation via the agent. Confused-deputy is not cleanly modeled in ATLAS; ids approximate — verify. |
| Memory poisoning | LLM01:2026LLM05:2026 | AML.T0051.001 (LLM Prompt Injection: Indirect), AML.T0020 (Poison Training Data) | AITG-MOD-02 (Runtime Model Poisoning), AITG-APP-02 (Indirect Prompt Injection) | Persistent memory poisoning — injected content survives across sessions. Persistence of injected instructions (LLM01) plus data-poisoning framing (LLM05). |
| Denial-of-wallet | LLM06:2026 | AML.T0034 (Cost Harvesting), AML.T0029 (Denial of ML Service) | AITG-INF-02 (Resource Exhaustion) | Unbounded consumption / denial-of-wallet — token flooding, recursive agent loops, amplified retrieval. |
| Logging & privacy | LLM02:2026 | AML.T0057 (LLM Data Leakage) | AITG-APP-03 (Sensitive Data Leak), AITG-DAT-05 (Data Minimization & Consent), AITG-DAT-01 (Training Data Exposure) | Governance/review topic — PII in prompts and logs, retention, telemetry exposure. Program controls rather than an exploit family. |
| Supply chain & model security | LLM04:2026 | AML.T0010 (ML Supply Chain Compromise), AML.T0011.000 (User Execution: Unsafe ML Artifacts) | AITG-INF-01 (Supply Chain Tampering), AITG-INF-05 (Fine-tuning Poisoning), AITG-INF-06 (Dev-Time Model Theft), AITG-MOD-03 (Poisoned Training Sets) | Third-party models, datasets, adapters/LoRAs, and plugins — provenance and integrity. Sub-technique id AML.T0011.000 approximate — verify. |
Legend
| Prefix | Meaning |
|---|---|
LLM01–LLM10 | OWASP LLM Top-10 (2026) risk category |
AML.T* | MITRE ATLAS adversarial ML technique |
AITG-APP-* | OWASP AI Testing Guide — application-layer test |
AITG-MOD-* | OWASP AI Testing Guide — model-layer test |
AITG-INF-* | OWASP AI Testing Guide — infrastructure-layer test |
AITG-DAT-* | OWASP AI Testing Guide — data-layer test |