MITRE ATT&CK v20 adds first AI-focused Enterprise techniques (direct/indirect prompt injection, AI-enabled exfiltration, AI result poisoning, impair autonomous defenses)

On 13 October 2026 MITRE released ATT&CK v20 (current version), the first major release after v19.2. It adds five new Enterprise techniques/ sub-techniques specifically for AI systems: T1699 Direct Prompt Injection, T1698 Indirect Prompt Injection, T1700 AI-Enabled Exfiltration, T1608.007 Stage Capabilities: AI Result Poisoning, and T1685.007 Disable or Modify Tools: Impair Autonomous Defenses. It also adds the new Campaign C0064 'AI-Assisted Breach of Mexico's Government Infrastructure' (an IT/OT cross-domain breach reaching a municipal water utility) and Software S9045 BACKUPOSINT v9.0 APEX PREDATOR (an AI-generated 49-module Python toolkit), alongside two new campaigns including C0066 (2026 U.S. water utilities), new ICS techniques and updated CTI groups. Enterprise domain now totals 15 tactics, 227 techniques, 479 sub-techniques. Verified against the MITRE ATT&CK Updates page (release table shows v20 starting 13 October 2026) and the human-readable changelog.

ATT&CK is the globally adopted adversary-behavior knowledge base used by SOCs, threat-intel teams, and detection-engineering stacks. This is the first time AI-specific attack tradecraft (prompt injection, AI-assisted exfiltration, poisoning of AI search/agents, and degrading AI-assisted defensive tools) has been formalized inside the mainstream Enterprise matrix rather than only in the AI-specific ATLAS framework. It gives defenders a shared language to map, detect, and report AI-driven attacks in existing ATT&CK-based tooling, and signals that AI threat modeling is moving into general security practice.

Update detection engineering rules, MITRE ATT&CK mappings, and threat reports to reference the new AI technique IDs; incorporate prompt-injection, AI-enabled exfiltration, and AI-poisoning detections into SOC workflows; align agent/LLM security controls with these techniques.