AML.T0011.000
Unsafe AI Artifacts

MITRE source definition

Adversaries may develop new AI artifacts or manipulate existing AI artifacts that have a deleterious effect when loaded, executed, interpreted, or used for inference by a victim. The unsafe artifacts may continue to work as expected from the victim's perspective.

Unsafe AI artifacts may include serialized models, model packages, and bundled components such as prompt or chat templates, tokenizer metadata, configuration, pre-processing logic, post-processing logic, or other executable or behavior-shaping metadata.

An unsafe artifact may exploit deserialization or another software vulnerability to execute code on the host. However, exploitation of a software vulnerability is not required. An artifact may instead use functionality intentionally supported by an AI runtime to alter model context, model outputs, safety behavior, or agent actions.

Adversaries may introduce unsafe artifacts through an [AI Supply Chain Compromise](/techniques/AML.T0010). Execution may occur when a user loads the artifact, starts an inference runtime, submits an inference request, or otherwise causes the artifact's bundled logic to be processed.

Source modified 2026-07-31. Reproduced from the pinned ATLAS release; inline technique links resolve to local reference pages.

Parent, sub-techniques and ATT&CK references

• AML.T0011 User Execution — parent

Source-backed defensive context

MITRE mitigations

• AML.M0011 Restrict Library Loading
• AML.M0013 Code Signing
• AML.M0014 Verify AI Artifacts
• AML.M0016 Vulnerability Scanning
• AML.M0018 User Training
• AML.M0023 AI Bill of Materials

MITRE case studies

• AML.CS0027 Organization Confusion on Hugging Face · Exercise
• AML.CS0031 Malicious Models on Hugging Face · Incident
• AML.CS0064 Poisoned GGUF Templates: Inference-Time Supply Chain Attack · Exercise
• AML.CS0065 Model Namespace Reuse Supply Chain Attack · Exercise

These are explicit source relationships, not independently reproduced incidents or validated detection coverage.

Simulation and telemetry boundary

This is a technique reference page, not a runnable simulation. No ATLAS-specific telemetry mapping, local attack execution or detector validation is asserted. MITRE maturity describes its source evidence, not a 1200km lab result.

For broader context—not technique-specific control mappings—see AI Security, AI Security Course, and detection-validation methodology.

Provenance and attribution

Immutable MITRE ATLAS source · Import provenance · Attribution and transformation notice · Apache License 2.0

Copyright 2021-2026 MITRE. Source text and explicit relationships are retained; navigation, formatting and local links are provided by 1200km.

No explicit relationship in this pinned source.