Which ATT&CK IDs cover prompt injection?

ATT&CK v20 assigns T1699 to Direct Prompt Injection, for malicious prompts entered into an LLM's user interface, and T1698 to Indirect Prompt Injection, for prompts embedded in content the model processes. MITRE places both under the Execution tactic, with SaaS and Windows listed as platforms. Both entries are at version 1.0, created in September 2026.

Does ATT&CK v20 include detections for AI-enabled exfiltration?

MITRE publishes detection strategy DET0927 for AI-Enabled Exfiltration (T1700), with three analytics. AN2079 and AN2080 look for an AI-associated process reading data outside its authorized scope, then running transfer-capable code and connecting to a destination outside approved AI endpoints. AN2078 looks for an agent that reads protected data, calls a tool with it, and completes a transfer outside authorized flows.

What mitigations does MITRE list for indirect prompt injection?

Indirect Prompt Injection (T1698) carries six mitigations in ATT&CK v20: execution prevention, network segmentation, privileged account management, restricting file and directory permissions, user account management and user training. MITRE's guidance includes stopping external content from independently authorizing consequential agent actions, giving agents minimal-permission identities that retrieved content cannot alter, and limiting the destinations agents handling untrusted content can reach.

INFOResearch

MITRE ATT&CK v20: prompt injection gets its own technique IDs

MITRE ATT&CK v20 gives prompt injection, AI-enabled exfiltration and AI result poisoning official technique IDs in the Enterprise matrix.

October 13, 2026 · MITRE · Research by MITRE ATT&CK, Caio Silva, Girshel Chokhonelidze

MITRE

INFOResearch

MITRE ATT&CK v20 adds four AI techniques to the Enterprise matrix, among them Direct Prompt Injection (T1699), Indirect Prompt Injection (T1698) and AI-Enabled Exfiltration (T1700), giving detection teams IDs to map coverage against.

01What happened

MITRE released ATT&CK v20 on October 13, 2026, with nine new Enterprise techniques, four of which name AI or prompt injection directly. The release also documents campaign C0064, in which operators used Claude Code and OpenAI GPT-4.1 against Mexican government institutions between December 2025 and February 2026. Caio Silva and Girshel Chokhonelidze are credited as contributors on the Indirect Prompt Injection entry.

02How it works

Direct Prompt Injection (T1699) covers malicious prompts typed straight into an LLM's interface, and Indirect Prompt Injection (T1698) covers prompts embedded in content the model later reads. MITRE places both under the Execution tactic. AI-Enabled Exfiltration (T1700) sits under Exfiltration and chains either injection technique into data theft, and Stage Capabilities: AI Result Poisoning (T1608.007) covers planting public web content that AI search tools may cite.

03Who is affected

MITRE lists SaaS and Windows as the platforms for T1698, T1699 and T1700, and T1700's description names enterprise AI agents as the target. The entries apply to any deployment where an agent reads untrusted content or holds access to internal data.

04What to do

Map existing agent monitoring to the new IDs, starting with detection strategy DET0927 for T1700, whose three analytics watch for an AI process reading data outside its authorized scope and then moving it out. T1698 lists six mitigations, including keeping instructions from external content from independently authorizing consequential agent actions.

Questions people ask

Which ATT&CK IDs cover prompt injection?: ATT&CK v20 assigns T1699 to Direct Prompt Injection, for malicious prompts entered into an LLM's user interface, and T1698 to Indirect Prompt Injection, for prompts embedded in content the model processes. MITRE places both under the Execution tactic, with SaaS and Windows listed as platforms. Both entries are at version 1.0, created in September 2026.
Does ATT&CK v20 include detections for AI-enabled exfiltration?: MITRE publishes detection strategy DET0927 for AI-Enabled Exfiltration (T1700), with three analytics. AN2079 and AN2080 look for an AI-associated process reading data outside its authorized scope, then running transfer-capable code and connecting to a destination outside approved AI endpoints. AN2078 looks for an agent that reads protected data, calls a tool with it, and completes a transfer outside authorized flows.
What mitigations does MITRE list for indirect prompt injection?: Indirect Prompt Injection (T1698) carries six mitigations in ATT&CK v20: execution prevention, network segmentation, privileged account management, restricting file and directory permissions, user account management and user training. MITRE's guidance includes stopping external content from independently authorizing consequential agent actions, giving agents minimal-permission identities that retrieved content cannot alter, and limiting the destinations agents handling untrusted content can reach.

Sources 5 links, all fetched

1attack.mitre.orgATT&CK v20 Release Notes
2attack.mitre.orgT1698 Indirect Injection
3attack.mitre.orgT1699 Direct Injection
4attack.mitre.orgT1700 AI Exfiltration
5attack.mitre.orgC0064 Mexico Campaign