# AML.T0053 AI Agent Tool Invocation > As of 2026-10-05, AML.T0053 (AI Agent Tool Invocation) appears in 11 tracked threats, first reported 2026-03-12 and most recently 2026-10-03, with linked actors including N; it most often appears alongside T1190 (Exploit Public-Facing Application). - **Tracked threats:** 11 (3 critical, 6 high, 2 medium) - **First seen:** 2026-03-12 - **Last seen:** 2026-10-03 - **Threat actors:** 1 - **Detection rules:** 18 (counts only; Blue tier and above) ## Key facts - **ID:** AML.T0053 - **Framework:** MITRE ATLAS - **Tactics:** Execution (ATLAS) - **Matrix:** ATLAS - **Data as of:** 2026-10-05 ## Activity timeline AML.T0053 first appeared in tracked threats on 2026-03-12 and was most recently reported on 2026-10-03. The busiest month was 2026-08 with 4 reports, and 11 of the 11 threats were reported in the twelve months to 2026-10. ## How adversaries use it AML.T0053 AI Agent Tool Invocation is catalogued by MITRE ATLAS under the Execution (ATLAS) tactic in the ATLAS matrix. Threadlinqs maps 11 of 2623 tracked threats (0.4%) to it; by severity that is 3 critical, 6 high, 2 medium. Threats that use AML.T0053 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (6 threats), [T1213 Data from Information Repositories](https://intel.threadlinqs.com/technique/T1213) (5 threats), [AML.T0051.001 LLM Prompt Injection: Indirect](https://intel.threadlinqs.com/technique/AML.T0051.001) (4 threats), [AML.T0054 LLM Jailbreak](https://intel.threadlinqs.com/technique/AML.T0054) (4 threats), [T1552.001 Credentials In Files](https://intel.threadlinqs.com/technique/T1552.001) (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 1 tracked threat actor appear in the threats that use AML.T0053; the most frequent are [N](https://intel.threadlinqs.com/actor/N) (1). ## Threat actors using it - [N](https://intel.threadlinqs.com/actor/N) — 1 ## Tracked threats 11 tracked threats use AML.T0053. - [Desktop AI Supercomputers, Uncensored Models and Agentic Frameworks (HexStrike-AI) Enable Automated…](https://intel.threadlinqs.com/threat/TL-2026-2881) — high — 2026-10-03 - [Phishing Sites Engineered to Deceive AI Agents via Hidden Machine-Readable Instructions (Indirect Prompt…](https://intel.threadlinqs.com/threat/TL-2026-2707) — medium — 2026-09-27 - [Carbonato botnet: AI-agent-driven worm hijacks unauthenticated Docker daemons on port 2375 and installs the…](https://intel.threadlinqs.com/threat/TL-2026-2639) — high — 2026-09-24 - [Google Gemini AI Model Autonomously Breached Three Real Companies During Authorized Security Evaluation](https://intel.threadlinqs.com/threat/TL-2026-2607) — medium — 2026-09-21 - [Zero-Click Cryptographic Context Injection Attack Exfiltrates Grok Chat Data via Malicious Webpages](https://intel.threadlinqs.com/threat/TL-2026-2112) — high — 2026-08-22 - [91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285](https://intel.threadlinqs.com/threat/TL-2026-2105) — critical — 2026-08-21 - [Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accounts](https://intel.threadlinqs.com/threat/TL-2026-1953) — high — 2026-08-09 - [RovoBlast: One-Click Parameter-to-Prompt Injection in Atlassian Rovo AI Exposes Confluence, Jira, and…](https://intel.threadlinqs.com/threat/TL-2026-1942) — critical — 2026-08-08 - [OpenAI Models Chain Eight JFrog Artifactory Zero-Days to Escape Sandbox and Breach Hugging Face](https://intel.threadlinqs.com/threat/TL-2026-1750) — critical — 2026-07-28 - ["Patriot Bait": Solo Threat Actor 'bandcampro' Runs 5-Year AI-Automated Telegram Influence-and-Fraud Campaign](https://intel.threadlinqs.com/threat/TL-2026-1356) — high — 2026-07-15 - [CVE-2026-26133: Cross-Prompt Injection in Microsoft Copilot Email/Teams Summarization Enables AI-Mediated…](https://intel.threadlinqs.com/threat/TL-2026-1538) — high — 2026-03-12 ## Related CVEs CVEs referenced by the tracked threats that use AML.T0053, most frequent first. - [CVE-2025-7775](https://intel.threadlinqs.com/cve/CVE-2025-7775) - [CVE-2026-65617](https://intel.threadlinqs.com/cve/CVE-2026-65617) - [CVE-2026-65921](https://intel.threadlinqs.com/cve/CVE-2026-65921) - [CVE-2026-65923](https://intel.threadlinqs.com/cve/CVE-2026-65923) - [CVE-2026-65924](https://intel.threadlinqs.com/cve/CVE-2026-65924) - [CVE-2026-65925](https://intel.threadlinqs.com/cve/CVE-2026-65925) - [CVE-2026-66014](https://intel.threadlinqs.com/cve/CVE-2026-66014) ## Detection coverage Threadlinqs maintains 18 detection rules mapped to AML.T0053 (SPL 7, KQL 5, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only. 18 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/AML.T0053 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)