MITRE ATLAS Agentic Security Framework: 14 New Techniques and the OpenClaw Investigation in 2026
The rapid operationalization of autonomous AI agents in 2026 has prompted national security and defense-oriented organizations to expand threat-modeling frameworks beyond traditional IT infrastructure. To address the unique architectural risks of autonomous systems, the MITRE Corporation has significantly expanded its Adversarial Threat Landscape for Artificial-Intelligence Systems (ATLAS) framework, introducing 14 new techniques specifically targeting agentic workflows, and publishing its first major real-world agentic vulnerability investigation.
MITRE ATLAS Matrix Expansion
The MITRE ATLAS framework has grown to encompass 15 Tactics and 66 Techniques, reflecting a comprehensive focus on the entire AI lifecycle. In late 2025 and early 2026, MITRE incorporated 14 new attack techniques specifically designed to model how adversaries exploit, manipulate, and hijack autonomous agents:
- AI Agent Context Poisoning: Injecting malicious data or instructions into an agent’s active session context or retrieval-augmented generation (RAG) pipeline to steer its behavior.
- Memory Manipulation: Exploiting read/write capabilities within an agent’s long-term or short-term memory stores to overwrite instructions or store malicious payloads.
- Thread Injection: Intercepting and inserting rogue messages or instructions into active multi-agent execution threads.
- Publish Poisoned AI Agent Tool: Sourcing malicious plugins, Model Context Protocol (MCP) servers, or skill descriptors into public repositories to achieve execution when loaded by an agent at runtime.
- AI Agent Tool Credential Harvesting: Tricking an agent into executing a tool that harvests and exfiltrates cached credentials or API keys.
- AI Agent Clickbait: Manipulating the web browsing or document extraction tools of an agent using hidden, visually obscured, or semantic clickbait instructions.
The OpenClaw AI Agent Investigation (PR-26-00176-1)
In February 2026, MITRE published its landmark OpenClaw AI Agent Investigation (PR-26-00176-1), documenting a real-world case study of adversarial execution on the OpenClaw AI Agent platform and the ClawHub skill marketplace.
The investigation focused on CVE-2026-24763, a critical One-Click Remote Code Execution (RCE) vulnerability. Security researchers demonstrated how an adversary could exploit an unauthenticated agentic control plane to inject terminal commands. By exploiting direct and indirect LLM prompt injection and manipulating AI agent tool invocations, attackers bypassed the agent's reasoning layer and executed arbitrary code on the host machine.
This investigation highlights that agentic security has moved from a theoretical "jailbreak" problem to a classic software security vulnerability where autonomous tools are leveraged as vectors for lateral movement, credential harvesting, and system compromise.