Software Tools
Sub-technique of AML.T0016 Obtain Capabilities
Description
Adversaries may search for and obtain software tools to support their operations.
Software designed for legitimate use may be repurposed by an adversary for malicious intent.
An adversary may modify or customize software tools to achieve their purpose.
Software tools used to support attacks on AI systems are not necessarily AI-based themselves.
- ATLAS ID
- AML.T0016.001
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Enterprise
Mitigations
ATLAS 2026.09 lists no mitigation for this technique; see the parent technique.
Case studies that use it
- AML.CS0004Camera Hijack Attack on Facial Recognition System
- AML.CS0030LLM Jacking
- AML.CS0033Live Deepfake Image Injection to Evade Mobile KYC Verification
- AML.CS0069GTG-1002 Claude Code Espionage Campaign
- AML.CS0070Threat Actor Uses a DeepSeek-Powered Hermes Agent in Langflow and n8n Exploitation Attempts
Related ATT&CK technique
ATLAS adapts this technique from MITRE ATT&CK Enterprise.