MITRE ATT&CK v20 released October 13, 2026; detection analysis October 23 to 26, 2026
MITRE ATT&CK v20 Names the AI Attack: Prompt Injection and AI-Enabled Exfiltration Are Now Enterprise Techniques
MITRE ATT&CK version 20, released October 13, is the first release to track how adversaries abuse AI systems inside the enterprise as Enterprise techniques in their own right. Across the Enterprise and ICS matrices it adds 18 new techniques and sub-techniques, nine in each, plus 15 detection strategies and 38 analytics. Five of the new Enterprise entries concern AI: Direct Prompt Injection (T1699), instructions submitted through an AI system interface; Indirect Prompt Injection (T1698), instructions planted in content an agent later reads; AI-Enabled Exfiltration (T1700), directing an enterprise agent to send sensitive data outside the organization through its own sanctioned tools; AI Result Poisoning (T1608.007), manipulating web content to influence what AI search and assistants return; and Impair Autonomous Defenses (T1685.007), embedding instructions in evidence that AI-assisted security analysis consumes. The release also adds Steal Application Specific Passwords (T1697) and Anti-Automation Evasion (T1696), and substantially updates Supply Chain Compromise for software dependencies and development tools (T1195.001) to cover IDE configurations and coding agent instruction files. The detection guidance carries the harder message, as an Oleria analysis of the release spells out: the detection for AI-Enabled Exfiltration, DET0927, correlates an agent access to protected data, its tool calls and a transfer outside authorized data flows, but the authorized values are placeholders only the organization can fill. Running the new detections requires knowing, for every agent, which identity it runs as, what data it may reach and where that data may go, a baseline most organizations do not yet hold.
Executives
AI attacks now have official names and numbers in the framework your security team already reports against, which moves them from conference talk to board reporting. The finding to fund is not a new tool; it is the inventory underneath the detections: a named owner, an identity and a permitted data scope for every copilot, agent and coding assistant in production. Without that baseline, the new detections cannot run, and an injected instruction inherits whatever access the agent was given.
CIO / CISO
Map your current coverage to the five AI techniques and be explicit about partial coverage: agent memory poisoning and sub-agent delegation have no ATT&CK v20 technique yet, so keep ATLAS mappings alongside. For T1700, build the authorized data flow list for your three most connected agents first and remove access they hold but do not use, since MITRE listed mitigations lean on limiting what the agent can reach. Add application-specific passwords to the identity review: T1697 exists because those long-lived secrets bypass the MFA prompt and often sit outside single sign-on and access reviews.
Engineers
Treat coding agent and IDE configuration files as supply chain artifacts under the updated T1195.001: owner review on changes, pinned sources for referenced MCP servers, and secrets scoped per server. When you adopt a v20 detection, test whether you can fill its variables with real values before building it; a DET0927 analytic with placeholder scopes is a dashboard, not a detection. Log agent tool calls with the acting identity and the data scope touched, so the correlation the detection needs exists in your telemetry.
Everyone (non-IT)
Prompt injection means an AI assistant can be tricked by instructions hidden in a page, document or email it reads while doing a job for you. You cannot proofread everything an agent reads, but you can limit the blast radius: do not connect AI tools to mailboxes, drives or payment tools you would not hand to a new contractor on day one, and report it when an assistant tries to send or share something you did not ask for.