# MITRE ATT&CK v20: prompt injection gets its own technique IDs

> MITRE ATT&CK v20 gives prompt injection, AI-enabled exfiltration and AI result poisoning official technique IDs in the Enterprise matrix.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** MITRE
- **Disclosed:** 2026-10-13
- **Affects:** Enterprise AI agents
- **Research by:** MITRE ATT&CK, Caio Silva, Girshel Chokhonelidze
- **Primary source:** https://attack.mitre.org/resources/updates/updates-october-2026/
- **Page:** https://theinjection.dev/items/mitre-attack-v20-ai-techniques/

MITRE ATT&CK v20 adds four AI techniques to the Enterprise matrix, among them Direct Prompt Injection (T1699), Indirect Prompt Injection (T1698) and AI-Enabled Exfiltration (T1700), giving detection teams IDs to map coverage against.

## What happened

MITRE released ATT&CK v20 on October 13, 2026, with nine new Enterprise techniques, four of which name AI or prompt injection directly. The release also documents campaign C0064, in which operators used Claude Code and OpenAI GPT-4.1 against Mexican government institutions between December 2025 and February 2026. Caio Silva and Girshel Chokhonelidze are credited as contributors on the Indirect Prompt Injection entry.

## How it works

Direct Prompt Injection (T1699) covers malicious prompts typed straight into an LLM's interface, and Indirect Prompt Injection (T1698) covers prompts embedded in content the model later reads. MITRE places both under the Execution tactic. AI-Enabled Exfiltration (T1700) sits under Exfiltration and chains either injection technique into data theft, and Stage Capabilities: AI Result Poisoning (T1608.007) covers planting public web content that AI search tools may cite.

## Who is affected

MITRE lists SaaS and Windows as the platforms for T1698, T1699 and T1700, and T1700's description names enterprise AI agents as the target. The entries apply to any deployment where an agent reads untrusted content or holds access to internal data.

## What to do

Map existing agent monitoring to the new IDs, starting with detection strategy DET0927 for T1700, whose three analytics watch for an AI process reading data outside its authorized scope and then moving it out. T1698 lists six mitigations, including keeping instructions from external content from independently authorizing consequential agent actions.

## Quick facts

- **Released:** October 13, 2026
- **New AI techniques:** T1699, T1698, T1700, T1608.007
- **Tactics:** Execution (T1698, T1699), Exfiltration (T1700)
- **Enterprise matrix:** 227 techniques, 479 sub-techniques
- **New AI campaign:** C0064, AI-assisted breach of Mexican government infrastructure
- **T1698 contributors:** Caio Silva, Girshel Chokhonelidze

## Questions

### Which ATT&CK IDs cover prompt injection?

ATT&CK v20 assigns T1699 to Direct Prompt Injection, for malicious prompts entered into an LLM's user interface, and T1698 to Indirect Prompt Injection, for prompts embedded in content the model processes. MITRE places both under the Execution tactic, with SaaS and Windows listed as platforms. Both entries are at version 1.0, created in September 2026.

### Does ATT&CK v20 include detections for AI-enabled exfiltration?

MITRE publishes detection strategy DET0927 for AI-Enabled Exfiltration (T1700), with three analytics. AN2079 and AN2080 look for an AI-associated process reading data outside its authorized scope, then running transfer-capable code and connecting to a destination outside approved AI endpoints. AN2078 looks for an agent that reads protected data, calls a tool with it, and completes a transfer outside authorized flows.

### What mitigations does MITRE list for indirect prompt injection?

Indirect Prompt Injection (T1698) carries six mitigations in ATT&CK v20: execution prevention, network segmentation, privileged account management, restricting file and directory permissions, user account management and user training. MITRE's guidance includes stopping external content from independently authorizing consequential agent actions, giving agents minimal-permission identities that retrieved content cannot alter, and limiting the destinations agents handling untrusted content can reach.

## Sources

1. [ATT&CK v20 Release Notes](https://attack.mitre.org/resources/updates/updates-october-2026/)
2. [T1698 Indirect Injection](https://attack.mitre.org/techniques/T1698/)
3. [T1699 Direct Injection](https://attack.mitre.org/techniques/T1699/)
4. [T1700 AI Exfiltration](https://attack.mitre.org/techniques/T1700/)
5. [C0064 Mexico Campaign](https://attack.mitre.org/campaigns/C0064/)