MITRE ATT&CK Enterprise to add AI-enabled systems as a new platform (announced at ATT&CKcon 7.0)

On 27 October 2026, at ATT&CKcon 7.0, MITRE announced that ATT&CK Enterprise will add AI-enabled systems as a new platform, to be released early next year. The platform will recognize the unique techniques adversaries use when targeting AI-enabled systems such as results poisoning and prompt injection, and this content will be developed in part from the MITRE ATLAS framework plus dedicated ATT&CK AI Platform staff. MITRE also announced the upcoming release of 'Protection Strategies,' an upgraded, machine-readable version of ATT&CK Mitigations. Only documented, real-world techniques from ATLAS will be ported (ATLAS also includes red-team-only techniques that will not be included).

ATT&CK is foundational to threat intelligence, detection engineering, adversary emulation, security operations and security product evaluation in more than 190 countries. Moving AI attack behaviour into the Enterprise matrix (rather than only in the ATLAS knowledge base) makes AI-specific threats a first-class detection target inside the dominant industry framework, and will drive vendor detection/content and SOC playbooks. The ATT&CK AI Platform scope questions (models/weights/training data vs. connected systems) are still open and being solicited from the community.

Detection-engineering and threat-intelligence teams should prepare to map AI-specific ATT&CK techniques into the Enterprise matrix once released; monitor the ATT&CK Advisory Council and the AI Platform scope discussion to plan detection coverage and tooling.