AML.T0016
Obtain Capabilities

MITRE source definition

Adversaries may search for and obtain software capabilities for use in their operations. Capabilities may be specific to AI-based attacks [Adversarial AI Attack Implementations](/techniques/AML.T0016.000) or generic software tools repurposed for malicious intent ([Software Tools](/techniques/AML.T0016.001)). In both instances, an adversary may modify or customize the capability to aid in targeting a particular AI-enabled system.

Source modified 2026-05-27. Reproduced from the pinned ATLAS release; inline technique links resolve to local reference pages.

Parent, sub-techniques and ATT&CK references

• AML.T0016.000 Adversarial AI Attack Implementations
• AML.T0016.001 Software Tools
• AML.T0016.002 Generative AI
• AML.T0016.003 Exploits
• AML.T0016.004 AI Agent Tools
• T1588 Obtain Capabilities — explicit ATLAS ATT&CK reference

Source-backed defensive context

MITRE mitigations

• AML.M0001 Limit Model Artifact Release

MITRE case studies

• AML.CS0033 Live Deepfake Image Injection to Evade Mobile KYC Verification · Exercise
• AML.CS0072 AI Recommendation Poisoning via Crafted AI Assistant Links · Incident

These are explicit source relationships, not independently reproduced incidents or validated detection coverage.

Simulation and telemetry boundary

This is a technique reference page, not a runnable simulation. No ATLAS-specific telemetry mapping, local attack execution or detector validation is asserted. MITRE maturity describes its source evidence, not a 1200km lab result.

For broader context—not technique-specific control mappings—see AI Security, AI Security Course, and detection-validation methodology.

Provenance and attribution

Immutable MITRE ATLAS source · Import provenance · Attribution and transformation notice · Apache License 2.0

Copyright 2021-2026 MITRE. Source text and explicit relationships are retained; navigation, formatting and local links are provided by 1200km.

No explicit relationship in this pinned source.