AML.T0016.002
Generative AI

MITRE source definition

Adversaries may search for and obtain generative AI models or tools, such as large language models (LLMs), to assist them in various steps of their operation. Generative AI can be used in a variety of malicious ways, such as to generate malware, to [Generate Deepfakes](/techniques/AML.T0088), to [Generate Malicious Commands](/techniques/AML.T0102), for [Retrieval Content Crafting](/techniques/AML.T0066), or to generate [Phishing](/techniques/AML.T0052) content.

Adversaries may obtain open source models and serve them locally using frameworks such as Ollama or [vLLM]( https://docs.vllm.ai/en/latest/). They may host them using cloud infrastructure. Or, they may leverage AI service providers such as HuggingFace.

They may need to jailbreak the model (see [LLM Jailbreak](/techniques/AML.T0054)) to bypass any restrictions put in place to limit the types of responses it can generate. They may also need to break the terms of service of the model's developer.

Generative AI models may also be "uncensored" meaning they are designed to generate content without any restrictions such as guardrails or content filters. Uncensored GenAI is ripe for abuse by cybercriminals [[blog]] [[gbhackers]]. Models may be fine-tuned to remove alignment and guardrails [[erichartford]] or be subjected to targeted manipulations to bypass refusal [[arxiv]] resulting in uncensored variants of the model. Uncensored models may be built for offensive and defensive cybersecurity [[taico]], which can be abused by an adversary. There are also models that are expressly designed and advertised for malicious use [[gbhackers-1]].

Source modified 2026-05-27. Reproduced from the pinned ATLAS release; inline technique links resolve to local reference pages.

Parent, sub-techniques and ATT&CK references

• AML.T0016 Obtain Capabilities — parent

Source-backed defensive context

MITRE mitigations

• AML.M0001 Limit Model Artifact Release
• AML.M0020 Generative AI Guardrails
• AML.M0022 Generative AI Model Alignment

MITRE case studies

• AML.CS0033 Live Deepfake Image Injection to Evade Mobile KYC Verification · Exercise
• AML.CS0034 ProKYC: Deepfake Tool for Account Fraud Attacks · Incident
• AML.CS0055 AI ClickFix: Hijacking Computer-Use Agents Using ClickFix · Exercise
• AML.CS0070 Threat Actor Uses a DeepSeek-Powered Hermes Agent in Langflow and n8n Exploitation Attempts · Incident

These are explicit source relationships, not independently reproduced incidents or validated detection coverage.

Simulation and telemetry boundary

This is a technique reference page, not a runnable simulation. No ATLAS-specific telemetry mapping, local attack execution or detector validation is asserted. MITRE maturity describes its source evidence, not a 1200km lab result.

For broader context—not technique-specific control mappings—see AI Security, AI Security Course, and detection-validation methodology.

Provenance and attribution

Immutable MITRE ATLAS source · Import provenance · Attribution and transformation notice · Apache License 2.0

Copyright 2021-2026 MITRE. Source text and explicit relationships are retained; navigation, formatting and local links are provided by 1200km.

• [2406.11717] Refusal in Language Models Is Mediated by a Single Direction
• Cybercriminal abuse of large language models
• erichartford
• Cybercriminals Exploit LLM Models to Enhance Hacking Activities
• BlackHat AI Tool WormGPT Enhanced with Grok and Mixtral
• TAICO | WhiteRabbitNeo: An Uncensored, Open Source AI Model for Red & Blue Team Cybersecurity