Reconnaissance	Resource Development	Initial Access	AI Model Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	AI Attack Staging	Command And Control	Exfiltration	Impact
Search Application Repositories	Publish Poisoned Datasets	Drive-By Compromise	AI-Enabled Product or Service	Command and Scripting Interpreter	AI Agent Context Poisoning	AI Agent Tool Invocation	Evade AI Model	Credentials from AI Agent Configuration	Discover AI Agent Configuration	Message Poisoning	Data from AI Services	Verify Attack	Public Web C2	Web Request Triggering	Evade AI Model
Active Scanning	Publish Hallucinated Entities	Evade AI Model	AI Model Inference API Access	AI Click Bait	RAG Poisoning	LLM Jailbreak	Corrupt AI Model	Unsecured Credentials	Discover AI Model Ontology	Shared Resource Poisoning	Data from Information Repositories	Manipulate AI Model	AI Service API	Exfiltration via AI Inference API	Spamming AI System with Chaff Data
Search Open Technical Databases	Develop Capabilities	RAG Poisoning	Full AI Model Access	User Execution	Manipulate AI Model	System Instruction Keywords	False RAG Entry Injection	AI Agent Tool Credential Harvesting	Discover LLM System Information		Thread History Harvesting	Craft Adversarial Data	Search Index C2	Image Rendering	Erode AI Model Integrity
Search for Victim's Publicly Available Code Repositories	Commercial License Abuse	User Manipulation	Physical Environment Access	AI Agent Tool Invocation	Modify AI Agent Configuration	Crescendo	Blank Image	RAG Credential Harvesting	Failure Mode Mapping		Memory Data Hording	Create Proxy AI Model	Reverse Shell	Exfiltration via Cyber Means	Data Destruction via AI Agent Tool Invocation
Search Open AI Vulnerability Analysis	Obtain Capabilities	Exploit Public-Facing Application		LLM Prompt Injection	LLM Prompt Self-Replication	Off-Target Language	LLM Prompt Obfuscation		Discover LLM Hallucinations		User Message Harvesting	Embed Malware		Extract LLM System Prompt	Erode Dataset Integrity
Search Victim-Owned Websites	Stage Capabilities	AI Agent Tool Data Poisoning		Hidden Triggers in Multimodal Inputs	AI Agent Tool Poisoning		Masquerading		Discover AI Artifacts		AI Artifact Collection	Modify AI Model Architecture		LLM Data Leakage	Cost Harvesting
Gather RAG-Indexed Targets	Establish Accounts	Valid Accounts		System Instruction Keywords	Poison Training Data		Distraction		Discover AI Model Family		Data from Local System	Poison AI Model		Clickable Link Rendering	Denial of AI Service
	Acquire Public AI Artifacts	AI Agent Tool Poisoning		Triggered Prompt Injection	Thread Poisoning		Instructions Silencing		Whoami		RAG Data Harvesting			Abuse Trusted Sites	External Harms
	Retrieval Content Crafting	Compromised User		Indirect Prompt Injection	Embed Malware		Impersonation		Cloud Service Discovery		AI Agent Tool Data Harvesting			Exfiltration via AI Agent Tool Invocation	AI-Targeted Cloaking
	Publish Poisoned Models	Web Poisoning		Direct Prompt Injection	Modify AI Model Architecture		Hidden Triggers in Multimodal Inputs		Discover AI Model Outputs
	Acquire Infrastructure	Phishing		Off-Target Language	Memory Poisoning		URL Familiarizing		Discover Embedded Knowledge
	LLM Prompt Crafting	AI Supply Chain Compromise			Poison AI Model		Indirect Data Access		Discover System Prompt
	Poison Training Data	Guest User Abuse					Abuse Trusted Sites		Discover Tool Definitions
	Obtain Generative AI Capabilities						LLM Trusted Output Components Manipulation		Discover Activation Triggers
							Conditional Execution		Discover Special Character Sets
							Delay Execution of LLM Instructions		Discover System Instruction Keywords
							ASCII Smuggling
							LLM Jailbreak
							Citation Silencing
							Citation Manipulation
							System Instruction Keywords
							Crescendo
							Off-Target Language