MITRE ATLAS 2026.09 / technique reference

AML.T0126
Automated Collection

← Back to the ATLAS matrix · Official MITRE definition

Enterprise CollectionSource maturity: Realized

MITRE source definition

Adversaries may use automated techniques to collect data from AI systems and supporting enterprise environments. Automation may use scripts, command interpreters, command-line tools, or AI agent tools to identify, retrieve, copy, or aggregate data without a human selecting each individual item.

Collection criteria may be fixed, such as file name, type, location, owner, date. Automation may also collect repeatedly, monitor for new material, traverse related resources, or combine data from local systems, cloud services, repositories, databases, object stores, and application APIs.

In AI environments, targeted material may include models, datasets, configurations, conversation histories, retrieval databases, deployment information, logs, and other operational data.

Source modified 2026-08-31. Reproduced from the pinned ATLAS release; inline technique links resolve to local reference pages.

T1119 Automated Collection — explicit ATLAS ATT&CK reference

Source-backed defensive context

MITRE mitigations

No explicit relationship in this pinned source.

MITRE case studies

These are explicit source relationships, not independently reproduced incidents or validated detection coverage.

Simulation and telemetry boundary

This is a technique reference page, not a runnable simulation. No ATLAS-specific telemetry mapping, local attack execution or detector validation is asserted. MITRE maturity describes its source evidence, not a 1200km lab result.

For broader context—not technique-specific control mappings—see AI Security, AI Security Course, and detection-validation methodology.

Provenance and attribution

Immutable MITRE ATLAS source · Import provenance · Attribution and transformation notice · Apache License 2.0