On June 11, 2025, Aim Security disclosed EchoLeak, the first publicly documented zero-click prompt injection that exfiltrated data from Microsoft 365 Copilot via a single inbound email no user ever opened. The attack chained four primitives: indirect prompt injection (OWASP LLM01), excessive agency on tool calls (LLM06), agent goal hijack (ASI01 in the OWASP Agentic Top 10 published Dec 9, 2025), and a MITRE ATLAS Memory Manipulation technique (newly added in the Feb 2026 ATLAS v5.4.0 partnership with Zenity Labs). One incident, four published attack-class names, three frameworks. Any red-team report or FRIA Section 4 risk register that names the incident with only one of those vocabularies fails the audit-defensibility test. This lesson walks the entire attack class map a 2026 governance program must speak: OWASP LLM Top 10 (2025 release), OWASP Agentic Top 10 ASI01-ASI10 (Dec 9, 2025), and MITRE ATLAS v5.4.0 (Feb 2026) with the agentic additions, and ships the L1 artifact every notified body and external auditor asks for: the attack-class coverage map.

Why Three Vocabularies, Not One - And Why You Speak All Three

Early AI governance programs typically pick one framework, usually OWASP LLM Top 10, and treat it as canonical. That works for a quarter, then fails the first time a red-team report, customer-assurance questionnaire, Article 15 inquiry, or incident-disclosure write-up needs technique-level precision. By 2026, the three vocabularies have specialized:

• OWASP LLM Top 10 (2025 release) names the attack class at the LLM-application layer. AppSec, procurement, and customer-assurance teams use it because it maps onto the OWASP Web Top 10 muscle memory. LLM01-LLM10 are categories of vulnerability, not specific techniques.
• OWASP Top 10 for Agentic Applications (ASI01-ASI10, published Dec 9, 2025) names the agentic-specific attack class the LLM Top 10 does not cover: goal hijack, tool abuse, identity confusion, memory poisoning, inter-agent spoofing, rogue agents. Mandatory for any organization deploying Copilot, agent orchestration, or RAG workflows.
• MITRE ATLAS v5.4.0 (Feb 2026) names the specific technique using AML.TXXXX IDs (AML.M0XXX for mitigations). The IR/threat-intel/SOC vocabulary, mapping onto MITRE ATT&CK and integrating with SIEM rules. v5.4.0 has 16 tactics, 84 techniques, 56 sub-techniques, plus seven 2026 agentic techniques (Zenity Labs partnership).

The rule of thumb: OWASP names the attack class; MITRE ATLAS names the technique; together they are the red-team report vocabulary. An EchoLeak-class incident reported only as "LLM01 prompt injection" reads thin. Reported as "LLM01 (indirect prompt injection via inbound email) → ASI01 (agent goal hijack) → AML.T0051.001 (LLM Prompt Injection: Indirect) → AI Agent Context Poisoning (ATLAS v5.4.0 agentic) → AML.T0024 (Exfiltration via ML Inference API)" it reads regulator-grade.

Regulatory anchors making this fluency mandatory: EU AI Act Article 15 requires high-risk systems designed with cybersecurity-robustness commensurate with risk, with Recital 76 explicitly naming data poisoning, adversarial examples, model evasion, and confidentiality attacks. EU AI Act Article 55(1)(a) requires GPAI-with-systemic-risk providers to perform adversarial testing including red-teaming. NIST AI 600-1 (July 2024, updates 2025-2026) Risks 6 (Data Privacy), 9 (Human-AI Configuration), 10 (Information Integrity), 11 (Information Security) reference attack-class vocabulary in suggested actions. ISO 42001:2023 Annex A.6.2.6 requires verification and validation including against adversarial inputs.

OWASP LLM Top 10 (2025 Release) - Walk Each Entry With a 2024-2026 Example

The OWASP LLM Top 10 was first published as a 2023 release-candidate (v1.0) and revised substantially for the 2025 release. Key 2025 changes: LLM07 System Prompt Leakage is NEW (replacing the deprecated "Insecure Plugin Design," folded into LLM06); LLM08 Vector and Embedding Weaknesses is NEW (RAG became dominant); LLM06 Excessive Agency was decomposed into three sub-classes (excessive functionality, permissions, autonomy). Each entry below gets a definition plus a 2024-2026 example.

LLM01 - Prompt Injection (Direct and Indirect)

Definition: Manipulating an LLM via crafted inputs that cause the model to ignore prior instructions, follow attacker-supplied instructions, or leak information the system prompt was designed to protect. Direct prompt injection comes from the user input field; indirect prompt injection arrives via content the LLM ingests (documents, web pages, emails, retrieved RAG context) where the attacker controls some portion of the input but not the user interface.

Example (2024-2026): EchoLeak (Aim Security, June 11, 2025; CVE-2025-32711). Zero-click indirect prompt injection in Microsoft 365 Copilot. Attacker emails the target; user never opens it. When the target later asks Copilot any unrelated question, RAG retrieval surfaces the email as context. Hidden instructions hijack Copilot's reasoning to read Outlook/SharePoint/OneDrive content and exfiltrate via an image URL Copilot is induced to render. Patched June 2025. ATLAS: AML.T0051.001 (LLM Prompt Injection: Indirect). Cross-walks to ASI01.

LLM02 - Sensitive Information Disclosure

Definition: The LLM reveals sensitive data the system was designed to protect: PII, credentials, proprietary algorithms, confidential business information, system prompts, training-data fragments. Mechanisms include training-data memorization-and-emission, retrieval-augmented exposure of restricted documents, system-prompt leakage (overlaps LLM07), and inference attacks.

Example (2024-2026): Carlini et al. 2023 "Scalable Extraction of Training Data" methodology continued to find verbatim copyrighted emission in 2024-2025 releases. For RAG, the recurring 2025 pattern of mis-scoped retrieval indexes returning HR docs, M&A drafts, or PII to users lacking file-system permission, the RAG layer bypassed the ACL. ATLAS: AML.T0057 (LLM Data Leakage), AML.T0024 (Exfiltration via ML Inference API).

LLM03 - Supply Chain

Definition: Compromise of any component in the LLM supply chain: base models from Hugging Face or other registries, fine-tuning datasets, third-party plug-ins, agent tools, embedding models, vector databases, infrastructure providers. The supply chain is broader than traditional software supply chain because models, datasets, and weights all carry vulnerability surface.

Example (2024-2026): JFrog and ReversingLabs throughout 2024-2025 reported malicious model files on Hugging Face: pickle-deserialization payloads, backdoored weights, typosquat repos. The Dec 2025 poisoned MCP server packages on npm became the "Publish Poisoned AI Agent Tool" ATLAS v5.4.0 agentic technique. ATLAS: AML.T0010 (ML Supply Chain Compromise) with Model/Data/Hardware sub-techniques.

LLM04 - Data and Model Poisoning

Definition: Adversarial manipulation of training data, fine-tuning data, RAG corpora, or model weights to introduce backdoors, biases, or specific malicious behaviors triggered by attacker-chosen inputs. Includes pre-training-data poisoning (rare but high-impact), fine-tuning-data poisoning (more accessible), instruction-tuning poisoning, RLHF poisoning, and embedding-time poisoning of RAG corpora.

Example (2024-2026): Anthropic's "Sleeper Agents" (Hubinger et al. 2024) showed backdoors surviving safety training. Anthropic's October 2025 "Small Number of Samples Can Poison LLMs of Any Size" showed as few as 250 poisoned docs in a multi-billion-document pre-training corpus could implant a DoS backdoor, challenging the assumption that scale protects. PoisonedRAG (2024-2025) demonstrated small crafted-document sets manipulating RAG answers. ATLAS: AML.T0018 (Manipulate ML Model), AML.T0020 (Poison Training Data).

LLM05 - Improper Output Handling

Definition: Downstream systems treat LLM output as trusted data without sanitization, validation, or output-side controls. LLM-produced HTML rendered in a browser (XSS); LLM-produced SQL executed against a database (SQL injection); LLM-produced shell commands executed in a terminal (RCE); LLM-produced markdown with auto-rendered images triggering remote URL fetches (the EchoLeak exfiltration mechanism).

Example (2024-2026): EchoLeak's exfiltration via image rendering with attacker-controlled URLs is canonical. 2024-2025 saw "LLM-to-XSS" via chat interfaces rendering LLM HTML; "LLM-to-SQLi" via NL2SQL tools not validating generated SQL; "LLM-to-RCE" via under-constrained code-execution sandboxes. Pattern: treating LLM output as plain text, forgetting it can produce active content.

LLM06 - Excessive Agency (Decomposed in 2025)

Definition: The LLM is granted excessive functionality, excessive permissions, or excessive autonomy beyond what the use case strictly requires. The 2025 OWASP release split this into three named sub-classes:

• Excessive Functionality: Tools, plug-ins, or extensions exposed to the LLM include capabilities not required for the use case (e.g., a customer-service bot with a tool that can send arbitrary emails).
• Excessive Permissions, Tools or extensions execute with permissions higher than required (e.g., the LLM's database connector has write access when only read access is needed for the use case).
• Excessive Autonomy, High-impact actions execute without human-in-the-loop confirmation (e.g., the agent can transfer funds, send external emails, or modify production data without a human approval gate).

Example (2024-2026): 2024-2025 "agent runs amok" incidents in Copilot and agent deployments where over-permissioned tools allowed unintended data access. Early Microsoft Copilot Studio deployments where poorly-scoped action sets let agents modify CRM records the user never intended, excessive permissions plus autonomy combined.

LLM07 - System Prompt Leakage (NEW in 2025)

Definition: The system prompt, the instructions the deployer wrote to constrain the model's behavior, is exposed to users, attackers, or downstream parties. The risk is twofold: (a) the system prompt may contain sensitive operational information (API keys, internal endpoint names, business logic, decision thresholds) that should not be public; (b) once an attacker knows the system prompt, jailbreak and prompt-injection attacks become substantially easier to craft.

Example (2024-2026): Bing Chat ("Sydney") prompt extraction in early 2023 set the pattern; 2024-2025 saw similar extractions across enterprise deployments via "ignore previous instructions" variants or steganographic techniques. Anthropic in 2024 published its Claude.ai system prompt as a transparency move that reduced the LLM07 surface by removing the secrecy assumption.

LLM08 - Vector and Embedding Weaknesses (NEW in 2025)

Definition: Vulnerabilities specific to the vector-database and embedding-based retrieval layer underlying RAG deployments. Includes: cross-tenant retrieval leakage (a user from tenant A retrieves context from tenant B's documents because the vector index is shared without per-tenant filtering); embedding-inversion attacks (recovering source text from embedding vectors); embedding-poisoning (the LLM04 cross-walk where adversarial documents change retrieval behavior); access-control bypass (the RAG layer retrieves documents the requesting user lacks file-system permission to read).

Example (2024-2026): 2024-2025 enterprise-RAG disclosures of cross-tenant retrieval where multi-tenant SaaS RAG products did not properly scope per-tenant indexes. The "ghost data" pattern in 2025, documents indexed before permission tightening continuing to appear in retrieval after the underlying file ACL was changed.

LLM09 - Misinformation

Definition: The LLM produces false, misleading, or hallucinated output that downstream users or systems treat as authoritative. Includes hallucination (the model confabulates facts), over-reliance (humans treat LLM output as ground truth without verification), and adversarially-induced misinformation (an attacker prompts the LLM to produce specific false claims).

Example (2024-2026): Mata v. Avianca (2023, precedent through 2024-2026), attorneys cited LLM-hallucinated case law in court filings, the bright-line LLM09 example. 2024-2025 saw legal-tech, medical-information, and financial-research deployments produce hallucinated citations, dosages, and analyses real users acted on. NIST AI 600-1 Risk 4 (Confabulation) is the regulatory anchor.

LLM10 - Unbounded Consumption

Definition: The LLM is allowed to consume unbounded computational, financial, or contextual resources: denial-of-service via expensive queries, denial-of-wallet via uncapped per-call API costs, context-window exhaustion attacks, and unbounded tool-call chains. The 2025 OWASP framing expanded the older "Model Denial of Service" entry to cover the financial-cost dimension that became dominant once production LLM costs scaled.

Example (2024-2026): 2024-2025 "denial of wallet" incidents in early agentic deployments where prompt injection or runaway agentic loops drove thousands of dollars of API costs per minute. The pattern intensified in 2025 with 1M+ token contexts. The mitigation set, per-call rate limits, per-tenant cost caps, loop iteration limits, cost-rate circuit breakers, became 2025-2026 standard practice.

OWASP Top 10 for Agentic Applications (ASI01-ASI10), Published Dec 9, 2025

The OWASP LLM Top 10 covers the LLM-application layer. As 2024-2025 deployments moved from single-turn chat to multi-step agents with tool use, memory, and inter-agent communication, the LLM Top 10 alone proved insufficient: the agentic loop, tool ecosystem, memory layer, and inter-agent channel introduced attack classes the LLM Top 10 did not name. OWASP published the Top 10 for Agentic Applications (ASI01-ASI10) on December 9, 2025. ASIxx = Agentic Systems Issues.

ASI01 - Agent Goal Hijack

The agent's goal stack is manipulated so the agent pursues attacker-chosen objectives instead of (or alongside) the user's. EchoLeak is canonical: indirect prompt injection redirects reasoning to exfiltrate data while still appearing to answer the user's question. ASI01 is the agentic-specific framing of LLM01: the technique is the same; the impact differs because an agent with tool access translates the hijacked goal into real-world actions (file reads, API calls, external communications).

ASI02 - Tool / Function Abuse

The agent calls tools in ways that produce harm, legitimate tools with malicious parameters (e.g., email-send with attacker-chosen recipients), chaining tool calls in unanticipated ways (read-internal-doc → send-email-external), or invoking tools the agent should not have access to (overlaps LLM06 Excessive Functionality). 2024-2025 Microsoft Copilot Studio incidents with unanticipated tool chains are canonical.

ASI03 - Identity and Privilege Abuse

The agent operates under an identity (service account, OAuth token, on-behalf-of token) with more privilege than required, and exercises that privilege beyond the use case. The 2025 pattern: Copilot agents granted broad Graph API permissions in Azure AD app registration, where per-action authorization-check assumptions failed across multi-step flows. Mitigation (least-privilege OAuth scopes, per-action authorization checks, on-behalf-of token narrowing) became 2025-2026 standard practice.

ASI04 - Resource Manipulation

The agent's resource budget, compute, tokens, API calls, financial budget, time budget, is manipulated by an attacker to cause denial-of-service, denial-of-wallet, or task-completion failure. Overlaps LLM10 Unbounded Consumption but adds the agentic-loop dimension where an attacker can induce the agent into an infinite or near-infinite reasoning loop that drains budget without producing useful output.

ASI05 - Supply Chain Compromise (Agentic Context)

Compromise of agent-specific supply-chain components: agent frameworks (LangChain, LlamaIndex, Microsoft Copilot Studio extensions), MCP (Model Context Protocol) server packages, tool definitions registered to agents, third-party agent marketplaces. The Dec 2025 disclosure of poisoned MCP packages on npm illustrated this surface and became the basis for the "Publish Poisoned AI Agent Tool" ATLAS v5.4.0 agentic technique addition in Feb 2026. Overlaps LLM03 Supply Chain but adds the agent-specific component types.

ASI06 - Memory Poisoning

Long-term memory the agent maintains across sessions, conversation memory, learned-fact memory, user-preference memory, RAG-corpus memory, is poisoned with attacker-controlled content that persists and influences future behavior. Pattern: attacker interacts in session 1, induces the agent to store an attacker-controlled "fact," and in session N the legitimate user's interaction is influenced without either party seeing the original poisoning. Cross-walks to ATLAS v5.4.0's "Memory Manipulation" technique.

ASI07 - Inter-Agent Spoofing

In multi-agent systems, one agent impersonates another to gain authorization, extract information, or trigger actions the impersonated agent would have triggered. The pattern intensifies with agent-to-agent communication protocols (A2A, agent marketplaces) where authentication-between-agents is not well-specified. The 2025-2026 wave of multi-agent enterprise deployments raised the salience of this class.

ASI08 - Repudiation and Untraceability

The agent performs actions that cannot be attributed back to a specific user, session, or instruction: undermining audit, IR, and compliance. Pattern: agent calls a tool, downstream system logs the agent's service identity (not the originating user), the audit trail loses the chain. Mitigation (per-user identity propagation, per-action audit logs with full chain, immutable agentic-action ledgers) became 2025-2026 standard practice and is load-bearing for Article 12 logging obligations on agentic systems.

ASI09 - Human-Agent Trust Exploitation

The agent's output is treated by humans as more authoritative or more trustworthy than it should be, phishing-style manipulation where the agent's natural-language fluency creates false confidence; social engineering where an attacker uses the agent's apparent authority to manipulate humans; over-reliance on agent recommendations in high-stakes decisions. Overlaps LLM09 Misinformation but adds the trust-relationship dimension specific to agentic interfaces where the agent appears to act with judgment.

ASI10 - Rogue Agents

Agents that operate outside the deployer's intended authority, control, or sanctioning: either because they were never sanctioned (shadow agents created by individual employees), because they were sanctioned but escaped their original constraints (drift from approved tool set), or because they were compromised and now operate under attacker control. The 2025-2026 "shadow AI" intersection: an agent created in a self-service tool by an employee, granted broad credentials, and never registered in the AI intake form becomes a Rogue Agent the governance program has no visibility into. The L1 intake-form artifact (lesson 019) is the foundational mitigation.

MITRE ATLAS v5.4.0 (Feb 2026): 16 Tactics, 84 Techniques, 56 Sub-Techniques

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is the AI-specific peer of MITRE ATT&CK. Where OWASP names the attack class, ATLAS names the specific technique using the AML.TXXXX ID format. ATLAS v5.4.0 (released Feb 2026, in partnership with Zenity Labs for the agentic additions) has 16 tactics, 84 techniques, and 56 sub-techniques. The tactic chain mirrors ATT&CK's left-to-right kill-chain framing:

• Reconnaissance, Resource Development, Initial Access: Information gathering, capability development, first foothold (model-architecture discovery, ML supply-chain compromise, public-API access).
• ML Model Access, Execution, Persistence: Gaining access to the model (white-box, black-box, query-only); running adversary-controlled code (LLM Plugin Compromise); maintaining foothold (backdoor ML model, poisoned training data that persists across retraining).
• Privilege Escalation, Defense Evasion, Credential Access, Higher permissions (newly emphasized in v5.x for agentic context); evading detection (adversarial perturbation bypassing content classifiers); obtaining credentials (newly emphasized with agentic credential-harvesting).
• Discovery, Collection, ML Attack Staging: Learning the environment; gathering data of interest (data from local system via agent, retrieved-context exfiltration); preparing the attack (craft adversarial data, develop prompt-injection payloads).
• Exfiltration, Impact: Removing data (via ML inference API, agent tool, downstream rendering); disrupting, denying, manipulating (denial of ML service, erode model integrity, cost harvesting / denial of wallet).
• Two further v5.x agentic tactics added in 2026 covering agentic-specific phases.

The technique IDs that recur in 2026 governance work and that every L1-and-above governance program should be able to name without looking up:

• AML.T0010 - ML Supply Chain Compromise (with sub-techniques for ML Software, Data, Model).
• AML.T0018 - Manipulate ML Model.
• AML.T0020 - Poison Training Data.
• AML.T0024 - Exfiltration via ML Inference API.
• AML.T0040 - ML Model Inference API Access.
• AML.T0043 - Craft Adversarial Data.
• AML.T0048 - External Harms.
• AML.T0051 - LLM Prompt Injection (with sub-techniques .000 Direct and .001 Indirect).
• AML.T0053 - LLM Plugin Compromise.
• AML.T0054 - LLM Jailbreak.
• AML.T0057 - LLM Data Leakage.

The 2026 ATLAS v5.4.0 Agentic Additions (Zenity Labs Partnership)

The Feb 2026 ATLAS v5.4.0 release added seven agentic-specific techniques in partnership with Zenity Labs, reflecting the explosion of enterprise agentic deployments through 2025 and the corresponding attack-surface expansion. The seven additions map cleanly onto ASI01-ASI10 categories but provide technique-level precision:

• AI Agent Context Poisoning: Poisoning the context window the agent uses for reasoning (the RAG-retrieved context, the system-prompt-plus-history, the tool-output context). Cross-walks to ASI01 Agent Goal Hijack and ASI06 Memory Poisoning.
• Memory Manipulation: Direct manipulation of the agent's long-term memory store (vector database entries, conversation-summary records, learned-fact records). Cross-walks to ASI06 Memory Poisoning.
• Thread Injection: Injection of attacker-controlled content into a conversation thread the agent participates in, where the injection point is not the primary user message but a downstream channel (a comment, a referenced document, an inter-agent message). Cross-walks to ASI01 and ASI07.
• Modify AI Agent Configuration: Altering the agent's configuration (system prompt, tool list, permissions, model selection) in ways that change the agent's behavior outside the change-control process. Cross-walks to ASI03 and ASI10.
• RAG Credential Harvesting: Using the RAG layer to discover credentials, API keys, or secrets that were inadvertently indexed in the corpus (in source code, configuration files, internal documentation). Cross-walks to LLM02 and LLM08.
• Publish Poisoned AI Agent Tool: Publishing a malicious agent tool, MCP server, plug-in, or extension to a registry the deployer's agents will consume. The Dec 2025 npm MCP-package poisoning is the canonical example. Cross-walks to ASI05 and LLM03.
• Escape to Host: Using the agent's tool-execution sandbox (code-execution sandbox, browser sandbox, container) to gain access to the host system. Cross-walks to broader infrastructure-security concerns and to MITRE ATT&CK proper for the post-escape lateral movement.

The cross-walk insight that every L1 governance program should internalize: EchoLeak is not one attack class. It is a chain. LLM01 (indirect prompt injection, the input vector) + ASI01 (agent goal hijack, the agentic-specific impact framing) + AI Agent Context Poisoning (the ATLAS technique describing how the context window was hijacked) + AML.T0024 (Exfiltration via ML Inference API, the exfiltration technique) + LLM05 (Improper Output Handling, the image-rendering exfiltration channel). A red-team report that names only "LLM01" reads thin; a report that walks the chain reads as audit-grade.

Cross-Walks, EU AI Act Anchors, and the 2026 Jailbreak Benchmark Landscape

EU AI Act Article 15 (Accuracy, Robustness, Cybersecurity): High-risk systems shall be designed with appropriate accuracy, robustness, and cybersecurity throughout the lifecycle. Recital 76 names AI-specific vulnerabilities, data poisoning (LLM04, AML.T0020), model poisoning (LLM04, AML.T0018), adversarial examples (AML.T0043), model evasion, confidentiality attacks (LLM02, AML.T0024, AML.T0057). The Article 15 claim in the Annex IV technical file must reference attack-class coverage with technique-level precision; "we follow OWASP and MITRE ATLAS" without coverage-map evidence is insufficient.

EU AI Act Article 55(1)(a) (GPAI, Systemic Risk): Providers shall perform model evaluation in accordance with standardized protocols reflecting state of the art, including documented adversarial testing for systemic-risk mitigation. The 2026 codes-of-practice work under Article 56 is operationalizing this with reference to OWASP LLM Top 10, ATLAS, and published jailbreak benchmarks.

NIST AI 600-1 (July 2024, updates 2025-2026) Risks 6, 9, 10, 11 reference attack-class vocabulary in suggested actions, with MS-2.6 (test AI system functionality) and MS-3.2 (representative test sets) operationalizing the testing obligation. ISO/IEC 42001:2023 Annex A.6.2.6: verification and validation shall consider adversarial inputs; the A.6.2.6 control evidence in a Stage 2 ISO 42001 audit must reference attack-class coverage.

2026 Jailbreak Benchmark Landscape (cite with care):

• Crescendo (Russinovich et al., USENIX Security '25), Multi-turn jailbreak that escalates conversational intensity. Cite with care: the paper's two headline metrics report substantially different attack success rates. Under the standard AdvBench-subset evaluation with strict judge: 56.2% ASR on GPT-4 and 82.6% ASR on Gemini-Pro. Under the binary-success-rate (BSR) variant: ~98% on GPT-4 and ~100% on Gemini-Pro. Programs citing only the higher number without naming the BSR variant invite calibration criticism in technical review. Both numbers are real and both are in the paper; the audit-defensible practice is to cite both with the methodology distinction.
• JBFuzz (arXiv:2503.08990), Fuzzing-based jailbreak generator. Reports ~97% ASR on Gemini 2.0 and ~95% ASR on Gemini 1.5 under its evaluation protocol. The methodology is distinct from Crescendo; results should be cited as JBFuzz-specific rather than directly compared to Crescendo numbers.
• AdvBench, HarmBench, JailbreakBench, The standardized harm-category benchmarks the 2025-2026 jailbreak research uses. The governance program's L3 red-team coverage should name which benchmarks were run and at what coverage.

AI-VSS (AI Vulnerability Scoring System): Emerging 2025-2026 as the AI-specific peer of CVSS. Scores on attack vector, complexity, privileges required, user interaction, scope, plus AI-specific dimensions of model-access required (white-box, black-box, query-only) and attack persistence (training-time, deployment-time, query-time). Still in flux as of 2026 but the leading severity-scoring candidate; until it stabilizes, use CVSS plus a documented AI-specific overlay.

The L1 Artifact - The Attack-Class Coverage Map

The L1 artifact for this lesson is the attack-class coverage map: a matrix with rows for each OWASP LLM Top 10 entry, each ASI01-ASI10 entry, and each MITRE ATLAS technique relevant to the deployer's AI portfolio; columns for each AI system in the portfolio (or system class for large portfolios); cells containing the coverage status (Not Applicable, Untested, Tested-Passed, Tested-Failed-Remediated, Tested-Failed-Open, Mitigated-by-Design). A representative coverage-map structure for a mid-size deployer's portfolio:

• Rows (Attack Classes): LLM01 through LLM10 (with LLM06 decomposed into the three sub-classes); ASI01 through ASI10; the relevant ATLAS techniques (typically 20-40 of the 84 techniques are relevant to a given portfolio, including the seven 2026 agentic additions where the portfolio includes agents).
• Columns (Systems): Each high-risk Annex III system; each GPAI deployment; each agent / Copilot deployment; each RAG deployment; each customer-facing chatbot. For very large portfolios, group by system class with sampling within class.
• Cells (Coverage Status): Not Applicable (with rationale); Untested (with planned-test-date); Tested-Passed (with evaluation methodology + date + reviewer); Tested-Failed-Remediated (with remediation reference + retest date); Tested-Failed-Open (with severity, planned remediation, accepted-risk decision); Mitigated-by-Design (with reference to the design control that makes the attack class infeasible).
• Per-cell evidence pointers: Red-team report ID; ATLAS technique ID; jailbreak-benchmark coverage; AI-VSS / CVSS severity; remediation ticket; FRIA Section 4 cross-reference; ISO 42001 A.6.2.6 evidence reference.
• Per-system summary metrics: % of relevant rows in Tested-Passed; count of Tested-Failed-Open with severity breakdown; count of Mitigated-by-Design; refresh-cadence compliance.
• Portfolio-level rollup: Cross-system coverage trend; emerging-threat tracking (new ATLAS techniques, new OWASP-revision entries); benchmark vs. peer-published coverage where available.
• Governance integration: Quarterly refresh to the AI Governance Committee; standing item in the L4 governance operating plan; reference in the Article 27 FRIA Section 4 (specific risks) for each high-risk system; reference in the Annex IV §2(e) cybersecurity claim; reference in the ISO 42001 management-review evidence.

The coverage map is the artifact the AI Governance Committee approves, the External Auditor reads against ISO 42001 A.6.2.6, the regulator references in any Article 15 inquiry, and the Chief AI Risk Officer cites in the L5 board AI-threat-posture briefing. It turns "we follow OWASP and ATLAS" from a slogan into evidence.

Six Common Attack-Class-Map Mistakes

Mistake 1 - Confusing LLM01 With ASI01

LLM01 names the attack technique (prompt injection, direct or indirect). ASI01 names the agentic-specific impact framing (the agent's goal stack is hijacked into pursuing attacker objectives). An EchoLeak-class incident is BOTH, the LLM01 technique produces the ASI01 impact. A red-team report that names only one reads thin to a notified body. The audit-defensible practice: name both with the cross-walk explicit, plus the ATLAS technique IDs.

Mistake 2 - Treating ATLAS as Decoration Without Technique IDs

"We use MITRE ATLAS" in a procurement deck without specific AML.TXXXX technique IDs in the coverage map and red-team reports is decoration, not evidence. The ATLAS value is the technique-level precision, an incident reported as "AML.T0051.001 (LLM Prompt Injection: Indirect)" is searchable, cross-referenceable to the MITRE knowledge base, and integrable into SIEM detection rules. The audit-defensible practice: every red-team finding gets a specific ATLAS technique ID where one exists.

Mistake 3 - Skipping the 2025 New Entries (LLM07, LLM08)

Coverage maps built against the 2023 OWASP LLM Top 10 v1.0 and not refreshed for the 2025 release are missing LLM07 System Prompt Leakage and LLM08 Vector and Embedding Weaknesses. For any RAG deployment, LLM08 is foundational; skipping it means the cross-tenant retrieval, embedding-inversion, and access-control-bypass surfaces are uncovered. The audit-defensible practice: refresh the coverage map against the 2025 OWASP release; add LLM07 and LLM08 rows; assess each system against them.

Mistake 4 - Skipping the 2026 ATLAS Agentic Additions

Coverage maps built against ATLAS v5.0 or earlier and not refreshed for v5.4.0 (Feb 2026) are missing the seven agentic-specific techniques (AI Agent Context Poisoning, Memory Manipulation, Thread Injection, Modify AI Agent Configuration, RAG Credential Harvesting, Publish Poisoned AI Agent Tool, Escape to Host). For any organization with Copilot, agent orchestration, or MCP-tool deployments, these techniques are the dominant 2026 attack surface. The audit-defensible practice: add the seven agentic technique rows; assess each agentic system against them; integrate with ASI01-ASI10 cross-walks.

Mistake 5 - Under-Investing in OWASP LLM06 Sub-Classes

The 2025 OWASP release decomposed LLM06 Excessive Agency into three sub-classes (excessive functionality, excessive permissions, excessive autonomy). Coverage maps that treat LLM06 as a single row miss the sub-class precision the 2025 release introduced. The three sub-classes have different mitigations: excessive functionality is mitigated by tool-scope minimization, excessive permissions by least-privilege OAuth scope design, excessive autonomy by human-in-the-loop confirmation on high-impact actions. The audit-defensible practice: split LLM06 into three rows; assess each system against each sub-class; document the sub-class-specific mitigations.

Mistake 6 - Treating the Coverage Map as Static

The OWASP releases new versions (2023 v1.0 → 2025); the OWASP Agentic Top 10 was published Dec 9, 2025; ATLAS releases new versions (v5.4.0 Feb 2026 with agentic additions); new jailbreak benchmarks appear (Crescendo, JBFuzz, more in 2026); new threat-intelligence disclosures (EchoLeak June 2025, npm MCP poisoning Dec 2025) reshape the threat model. A static coverage map updated annually misses the months-scale evolution. The audit-defensible practice: quarterly refresh; triggered updates on OWASP / ATLAS new releases; triggered updates on major incident disclosures; living document maintained by the AI Governance Committee with the External Auditor's reviewer comment.

Key Takeaways

• Three vocabularies, not one. OWASP LLM Top 10 (2025 release) names the attack class at the LLM-application layer. OWASP Agentic Top 10 (ASI01-ASI10, Dec 9, 2025) names the agentic-specific attack class. MITRE ATLAS v5.4.0 (Feb 2026) names the specific technique using AML.TXXXX IDs. Together they are the audit-defensible red-team report vocabulary.
• EchoLeak is the canonical 2025 reference. Zero-click indirect prompt injection in Microsoft 365 Copilot, disclosed June 11, 2025 (CVE-2025-32711). Chains LLM01 + ASI01 + AI Agent Context Poisoning + AML.T0024 + LLM05. Every governance program should be able to walk the chain.
• The 2025 OWASP LLM Top 10 added LLM07 and LLM08. System Prompt Leakage and Vector and Embedding Weaknesses are new, coverage maps not refreshed for the 2025 release miss these. LLM08 is foundational for any RAG deployment.
• LLM06 was decomposed in 2025 into three sub-classes. Excessive Functionality, Excessive Permissions, Excessive Autonomy. Each has distinct mitigations. Coverage maps that treat LLM06 as one row miss the sub-class precision.
• The OWASP Agentic Top 10 was published Dec 9, 2025. ASI01-ASI10 covers agent goal hijack, tool / function abuse, identity and privilege abuse, resource manipulation, supply-chain compromise (agentic context), memory poisoning, inter-agent spoofing, repudiation and untraceability, human-agent trust exploitation, rogue agents. Mandatory for any organization with Copilot, agents, or RAG deployments.
• MITRE ATLAS v5.4.0 (Feb 2026) added seven agentic techniques. AI Agent Context Poisoning, Memory Manipulation, Thread Injection, Modify AI Agent Configuration, RAG Credential Harvesting, Publish Poisoned AI Agent Tool, Escape to Host. Published in partnership with Zenity Labs. Every agentic-system coverage map should include these.
• The EU AI Act anchors are Article 15 and Article 55(1)(a). Article 15 robustness-and-cybersecurity claim in the Annex IV technical file must reference attack-class coverage with technique-level precision. Article 55(1)(a) adversarial-testing obligation for GPAI-with-systemic-risk providers. NIST AI 600-1 Risks 6/9/10/11, ISO 42001 A.6.2.6, and the 2026 GPAI codes-of-practice all assume technique-level fluency.
• 2026 jailbreak benchmarks must be cited with calibration. Crescendo (Russinovich et al., USENIX Security '25): 56.2% ASR on GPT-4 / 82.6% on Gemini-Pro under strict-judge AdvBench-subset; ~98% / ~100% under binary-success-rate variant. Both real, both in the paper, cite both with methodology distinction. JBFuzz (arXiv:2503.08990): ~97% on Gemini 2.0, ~95% on Gemini 1.5. AI-VSS emerging as severity-scoring standard.
• The L1 artifact is the attack-class coverage map. Rows for each OWASP LLM entry + each ASI entry + each relevant ATLAS technique; columns for each system; cells with coverage status (Not Applicable, Untested, Tested-Passed, Tested-Failed-Remediated, Tested-Failed-Open, Mitigated-by-Design); per-cell evidence pointers; quarterly refresh; governance integration with FRIA Section 4 + Annex IV §2(e) + ISO 42001 A.6.2.6.
• The coverage map is living, not static. Quarterly refresh; triggered updates on OWASP / ATLAS new releases; triggered updates on major incident disclosures; reviewed by External Auditor; standing item in L4 governance operating plan and L5 board AI threat-posture briefing.