Activity timeline
AML.T0054 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-08 with 8 reports, and 17 of the 17 threats were reported in the twelve months to 2026-10.
How adversaries use it
AML.T0054 LLM Jailbreak is catalogued by MITRE ATLAS under the Defense Evasion (ATLAS) tactic in the ATLAS matrix. Threadlinqs maps 17 of 2623 tracked threats (0.6%) to it; by severity that is 5 critical, 9 high, 3 medium.
Threats that use AML.T0054 most often also use T1078 Valid Accounts (8 threats), AML.T0051 LLM Prompt Injection (6 threats), T1190 Exploit Public-Facing Application (6 threats), AML.T0040 ML Model Inference API Access (5 threats), T1027 Obfuscated Files or Information (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
5 tracked threat actors appear in the threats that use AML.T0054; the most frequent are Cleaver (2), Hacktron AI (2), MiniMax (2), Moonshot AI (2), StepFun (2).
Threat actors using it
Tracked threats
17 tracked threats use AML.T0054.
- Desktop AI Supercomputers, Uncensored Models and Agentic Frameworks (HexStrike-AI) Enable Automated…high
- AI-Powered Cyber Attacks: Emerging TTPs Across Phishing, Deepfake BEC, Polymorphic Malware, and Prompt…medium
- AI-Built Exploit Chain Turns Unpatched libheif Flaw and OpenAI Forum Sign-In Bug into Internal Code Accesshigh
- AI-Driven Exploit Chain Against OpenAI Community Forum via libheif Flaw (CVE-2026-32882)high
- China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. Frontier AI Modelscritical
- China-Based AI Companies Conducting Industrial-Scale Knowledge Distillation Campaigns Against U.S. Frontier…high
- Autonomous AI-agent frameworks automating credential theft and cyber espionage (Google Threat Intelligence…high
- OpenAI GPT-6 Astra Reaches 'Critical' Cybersecurity Capability Threshold; Attempted Supply-Chain Attacks and…critical
- Zero-Click Cryptographic Context Injection Attack Exfiltrates Grok Chat Data via Malicious Webpageshigh
- Suspected China-Linked Actor Runs Near-Autonomous Multi-Agent AI Attack on Taiwan Government, Nuclear Safety…critical
- Operation ASTERIX: AI-Assisted Crypto Wallet Phishing/Vishing Fraud Pipeline Abuses Claude Code and Kimihigh
- Suspected China-Linked Actor Runs Near-Autonomous AI Agent Campaign (Hermes/OpenClaw) Against Taiwan…critical
- China-Linked Actor Uses Autonomous AI Agent Frameworks (Hermes, OpenClaw) to Breach Taiwan Government and…critical
- BYU Study: AI-Generated Spear Phishing (GPT-4) Outperforms Human-Written Lures and Evades Human Detectionmedium
- Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accountshigh
- OWASP GenAI LLM Top 10 2026 — Community-Driven Security Guidance for AI Applicationsmedium
- "Patriot Bait": Solo Threat Actor 'bandcampro' Runs 5-Year AI-Automated Telegram Influence-and-Fraud Campaignhigh
Detection coverage
Threadlinqs maintains 22 detection rules mapped to AML.T0054 (SPL 6, KQL 8, Sigma 8). Rule content is available to Blue tier accounts and above; this page shows counts only.