ATLAS starts naming what a free agent does

MITRE ATLAS, the adversarial threat-model knowledge base for AI systems, published two releases in September 2026, v2026.08 and v2026.09, that together add a cluster of techniques describing what an autonomous agent does once it is running unsupervised. The additions include Autonomous Reconnaissance, Autonomous Attack-Path Adaptation, Autonomous AI Agent Communication, AI Agent Environment Reconstruction, Autonomous Attack Orchestration, AI Agent Response Biasing, and Discover AI Agent Runtime Capabilities. In identifiers, the new techniques are T0116–T0124 in v2026.08 and T0130 and T0133 in v2026.09; v2026.08 also added 19 techniques and sub-techniques, and v2026.09 eleven more.

One tactic was renamed, from AI Attack Staging to AI Attack Adaptation, a small change that reflects the larger one: the catalogue now describes both what an attacker does to a model and what a model does when it is the actor. Its total now stands at 16 tactics, 120 techniques, 40 mitigations and 73 case studies, and it added the Hugging Face incident as a case study — "Autonomous OpenAI Evaluation Agents Compromise Hugging Face Infrastructure" (AML.CS0068).

The same releases introduce two mitigations aimed at an agent's authority in operation rather than a model's outputs: AI Agent Authority Expansion Controls and AI Agent Scope Drift Detection. Both carry the same instruction, that the control has to sit outside the agent. The point of the pair is that an agent which can rewrite its own permissions, or wander past the scope it was given, cannot be the thing that decides whether it has done so.

That places ATLAS on the same side of a question this log keeps returning to. The recurring failure across the covered incidents is a control that lived inside the system it was meant to constrain, whether a blocklist inside the sandbox or a boundary the agent could read its way past.

This is a taxonomy update rather than an incident report. But the additions are not purely prospective: the same releases map several of the new autonomous techniques, technique by technique, onto the new Hugging Face case study — ATLAS records them as employed in a live, reported compromise. Its value here is as a signal of what the field has decided is worth naming.

The concrete shift is that a standards body now treats an autonomous agent as a distinct kind of actor with its own techniques and its own mitigations, and that the mitigations it names first are the ones that keep an agent's authority from growing past what was granted.