Published: November 3, 2026
Week 10 was about AI risk management: identifying what can go wrong with an AI system, scoring how likely and how damaging it is, and choosing controls. For my Week 10 assignment, I built a risk register of 10 AI cyber risks. In the NLP After Dark lab on October 26, my team (Josue, Tommy Mao, and I) assessed a proposed AI help-desk assistant and wrote a five-risk register ending in a conditional launch decision. Prompt injection showed up in both, so I wanted a source that describes it from the attacker’s side.
The Source
I chose MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems), specifically technique AML.T0051, LLM Prompt Injection. ATLAS is a knowledge base of attacker tactics and techniques against AI systems, organized like MITRE ATT&CK. ATLAS describes prompt injection as crafting malicious inputs that make a large language model act in unintended ways, ignore parts of its instructions, and follow the attacker’s instead. It lists three subtechniques: direct, indirect (instructions hidden in data the model reads from another source), and triggered by user actions or system events. It also notes that prompt injection can serve as an initial access vector.
Analysis
ATLAS changed how I read our lab results. In our test, the model treated an injected instruction in sample incident text as data instead of following it. One passed test does not lower the risk much, because ATLAS documents indirect injection as a known technique an attacker can keep retrying in new forms. Likelihood should come from the threat landscape, not from a single test.
ATLAS also explains why our highest-concern risk was excessive agency. If injection is an initial access vector, then the real question is what the assistant can do after it is compromised. We scored that risk at a likelihood of 3 and an impact of 5 and chose to avoid it: the assistant may only draft notifications, a named staff member approves each one, and its service account has no send, close, or delete rights. That control works even if the injection succeeds.
My Takeaway
Threat frameworks and risk registers answer different questions. ATLAS tells me how an AI system gets attacked, and the register tells me which attacks matter most and what to do first. Using both made my scores feel less like guesses.
Conclusion
AI risk management starts with knowing the adversary. Mapping each register entry to an ATLAS technique gives the score a documented reason.
References
MITRE. (n.d.). LLM prompt injection (AML.T0051). MITRE ATLAS. Retrieved November 3, 2026, from https://atlas.mitre.org/techniques/AML.T0051
AI use disclosure
Claude (Anthropic) was used at Level 3, AI Collaboration, to assist with source discovery, organization, drafting, and revision. The assignment and lab details are based on my own Week 10 work. I reviewed the sources, verified the factual information, and approved the final entry.
Leave a Reply