AI systems stopped being just chatbots a while ago. A modern agent is an enterprise-connected, internet-facing application that can reach databases, call tools, and take actions with real consequences. The techniques aimed at those agents have been maturing just as fast, and the defensive community needs to continue tracking them using a common reference.
MITRE ATLAS™ (Adversarial Threat Landscape for Artificial-Intelligence Systems) is that reference: a knowledge base of tactics and techniques against AI-enabled systems, built in the spirit of MITRE ATT&CK®. Zenity Labs has been working with MITRE on a set of ATLAS updates that pull the framework closer to how agents are actually attacked, drawing on techniques we and others have seen in the wild (and presented at DEF CON 34), rather than solely on hypotheticals. Here are some of the main aspects that work covers.
Recon becomes a bigger part of the picture
Recon on agents pays off because finding one usually reveals more than just the agent itself. Find one, and you can often enumerate the tools it can call, the knowledge sources and integrations wired into it, the identity it runs as, and the authentication, or lack of it. These findings can stack up: the naming conventions, environment IDs, and platform choices you pick up mapping one deployment can help uncover more resources and be saved for later abuse. One set of added Active Scanning subtechniques describes how attackers enumerate agents that platforms host behind predictable URL structures, the kind derived from environment, tenant, or resource identifiers. The same set covers querying provider metadata APIs, scanning for exposed AI infrastructure, and probing public trigger channels like webhooks or agent email addresses to see what responds. That refers to and expands upon what was mentioned in Agentic Recon: Discovering and Mapping Public AI Agents.
Before any of that active probing, there’s sometimes a quieter phase. An expanded Search Open Websites/Domains technique now reflects how attackers might lean on techniques such as search-result pages and backlink analysis to locate embedded agentic interfaces, which can be served through iFrames under predictable naming, and then reverse-engineer internal environment IDs and organization-specific conventions from what is indexed, potentially also using retrieved data in later active scanning. Done well, and this could narrow the target space long before anyone touches the system, which is the story told in Mapping the AI Attack Surface Before You Touch It.
Three additional updates were made to complete the picture of the recon coverage: Discover AI Agent Runtime Capabilities covers enumerating an agent's tools and permission scope just by interacting with it; a new Scan Databases subtechnique recognizes third-party internet scans such as Shodan and Censys as a discovery channel in their own right; and a proposed Misconfigured or Publicly Exposed AI Services entry captures how missing authentication and permissive defaults quietly hand unauthenticated attackers a much larger surface to work with, as an Initial Access technique.
More ways to manipulate an agent through what it reads
The update also widens how ATLAS describes input-based manipulation, including more techniques observed across the ecosystem.
Some of the new changes are about hiding intent outside the text channel, where most defenses might not be looking. The new Triggers in Multimodal Inputs technique covers instructions planted in an image, audio, or video channel, or tucked into file metadata, which the model still parses even when a reviewer never sees them. A companion revision to LLM Prompt Obfuscation stretches the same idea past hidden HTML into low-contrast image text, faint or sped-up audio, and a single video frame.
Other additions center on abusing your AI assistants: the Crafted AI Assistant Links technique describes crafted links that open an assistant with an attacker's prompt already filled in through a ?q= or ?prompt= parameter. These links are frequently dressed up as a friendly "Summarize with AI" button, however these are technically unsupervised external prompts that can write a durable memory entry to the assistant's cross-session memory, which could quietly bias later recommendations toward attacker-chosen sources.
We also worked on filling gaps that agentic deployments opened up. AI Targeted Cloaking covers a defense evasion technique, in which adversaries serve malicious content to AI clients and benign content to Non-AI clients in order to hijack agents or inject malicious instructions to persistent memory - all while evading detection.
Lastly, an updated LLM Response Rendering technique now covers exfiltration through images and link previews that clients render on their own; the LLM Jailbreak technique picks up the Data Structure Injection (the trick of using data structure to manipulate models’ responses and actions, which comes straight out of the DSI research.
Something more for the defenders to deploy
This update compliments offensive coverage with practical defensive coverage. The first example is a recon mitigation built around AI honeypots: monitored decoy agents, services, and credentials that legitimate users have no reason to touch. Because of that, any interaction is a strong signal on its own. Decoys surface both broad and targeted recon, absorb real payloads without risking production assets, and feed a threat-intel loop that sharpens detection. This approach can raise insights that cannot be established by lab security research alone: for example, in our recent honeypot research, we discovered that attackers are attempting to hijack exposed AI backends in the wild to power their offensive operations.
The second is guidance that generative-AI guardrails should inspect every input modality, or explicitly block the ones they do not expect, instead of watching only the text channel.
Where this goes
Agents keep surfacing as an initial foothold, often because they are capable applications, built by business users outside secure development cycles and reviews. Keeping up with that is ongoing and its related expanding ecosystem is work: we spend a lot of our time finding how these systems get discovered, manipulated, and abused, then working out how to defend against it. This collaboration with MITRE ATLAS is one of the places that research goes, and we will keep publishing techniques and their defenses as we go.