Did you know: MITRE ATT&CK now has technique IDs for prompt injection and AI-assisted exfiltration

Prompt injection has a number now. MITRE ATT&CK v20, released on 13 October, adds techniques to the main Enterprise matrix written for attacks on and through AI systems. MITRE says the biggest change in v20 is wider coverage of recent tradecraft, “along with AI-focused and AI-enabled Techniques in Enterprise”.

ATT&CK is the shared catalogue that security teams use to label attacker behaviour. Detection rules, threat reports and red-team findings all point at its IDs. Before v20, an agent tricked by a poisoned web page had no Enterprise technique of its own. MITRE’s separate ATLAS project has covered attacks on AI systems, but most security tools and teams work from ATT&CK.

The new AI techniques

According to the v19.2 to v20.0 changelog and the technique pages:

ID	Name	Tactic	What it covers
T1699	Direct Prompt Injection	Execution	Typing malicious prompts into an LLM’s interface to bypass safeguards or misuse its capabilities
T1698	Indirect Prompt Injection	Execution	Hiding prompts in web pages, documents, code or other content an agent or copilot will read
T1700	AI-Enabled Exfiltration	Exfiltration	Using prompt injection to make an agent send data out through the tools it is allowed to use
T1685.007	Impair Autonomous Defenses	Defense Impairment	Prompts inside malware that make an LLM-based analyser abort, ignore data or fail to alert
T1608.007	AI Result Poisoning	Resource Development	Planting web content so AI search and assistants cite or recommend attacker sites
T1696	Anti-Automation Evasion	Stealth	Getting past CAPTCHAs, including with AI solvers, through two sub-techniques

Both prompt injection pages were created on 18 September 2026 and list SaaS and Windows as platforms. The Impair Autonomous Defenses example will be familiar to anyone who runs AI malware triage: fake system messages in an implant that convince the model it has hit an error, so it stops analysing.

Real campaigns, too

v20 also adds campaign C0064, AI-Assisted Breach of Mexico’s Government Infrastructure, in which MITRE says human operators used Claude Code and GPT-4.1 for reconnaissance, exploitation, privilege escalation, credential harvesting and exfiltration against several Mexican government bodies, including the federal tax authority. It sits next to C0062, the Anthropic AI-orchestrated Campaign, so AI-assisted intrusions are now tracked like any other campaign.

What you can do with it

• Tag findings. When a red team gets your agent to follow instructions from a README or a ticket, file it as T1698. Data leaving through an agent’s own tools is T1700.
• Check the mitigations. The T1698 page maps existing ATT&CK mitigations to agents. For example, content an agent retrieves should never be able to authorise a consequential action by itself (M1038), and agents should run with dedicated, least-privilege identities (M1018).
• Update your coverage maps. If you track detection coverage against ATT&CK, add the new techniques and be honest about which ones you can detect today.

The Enterprise matrix now has 227 techniques and 479 sub-techniques. Only a handful are about AI, but they give defenders a common way to name agent attacks.