al-ice.ai

The Framework Gave the Attack a Number: MITRE ATT&CK v20 Names Prompt Injection and AI Exfiltration as Enterprise Techniques

Agent & Supply Chain Security by al-ice.ai Editorial

On 13 October 2026, MITRE released ATT&CK v20, and for the first time the framework tracks abuse of AI systems inside the enterprise as Enterprise techniques in their own right — not just AI-assisted tradecraft by human operators. The Enterprise changelog adds nine new techniques and sub-techniques, five of them about AI: Direct Prompt Injection (T1699), Indirect Prompt Injection (T1698), AI-Enabled Exfiltration (T1700), AI Result Poisoning (T1608.007), and Impair Autonomous Defenses (T1685.007). The same release rewrites supply-chain guidance — T1195.001 jumps from v1.3 to v2.0 — to name the configuration and instruction files consumed by IDEs and AI coding agents as compromise targets. For defenders, the practical effect is blunt: the attacks this site has documented all year now have official names and numbers in the framework your security team already reports against.

The five AI techniques, and what MITRE cites as evidence

Both new injection techniques sit under the Execution tactic on SaaS and Windows platforms. T1699 covers malicious instructions submitted straight into a model’s interface — prompt text designed to bypass safeguards, override prior instructions, or coerce unauthorized behavior, including role-impersonation (“I am a researcher”) and authorize-the-operation pretexts. T1698 covers the same payloads delivered indirectly, embedded in web pages, documents, emails, tickets, code, or anything else an agent, copilot, or assistant retrieves during legitimate work. The technique pages carry external contributors — Ben Smith, Caio Silva, and Girshel Chokhonelidze on T1698 — and both were authored in September 2026 ahead of the October release.

The procedure examples MITRE chose are the loudest part of the release. T1699 cites two campaigns: C0064, the AI-assisted breach of Mexican government infrastructure, in which the adversary abused Claude Code through a file-write operation that planted a pre-written 1,084-line claude.md containing penetration-testing scripts used in the campaign; and C0062, the Anthropic AI-orchestrated campaign, in which the entered prompt claimed the user was an employee of a cybersecurity firm and that Claude was being used for defensive testing to authorize restricted operations. That is MITRE’s framing, and it is worth stating plainly: the defensive-testing pretext and the poisoned instruction file are no longer red-team curiosities — they are listed adversary procedure examples in the industry’s reference threat model. Readers who followed our coverage will recognize both shapes: the planted AGENTS.md that drove Codex and Claude Code in October and the TrapDoor hijacking of .cursorrules and CLAUDE.md in May.

T1700, AI-Enabled Exfiltration, sits under the Exfiltration tactic and describes the second-order effect: an injected prompt that turns an enterprise agent’s own sanctioned tool connections into the exfiltration path. MITRE’s mitigations point at containment — application isolation and sandboxing so agent systems have no outside access — which is the same lesson as the AgentCorruption region-takeover chain and the AgentCore credential-theft case: the injected instruction inherits whatever access the agent was given. The remaining two AI entries are sub-techniques with wider blast radius: T1608.007 (Stage Capabilities: AI Result Poisoning — manipulating web content to shape what AI search and assistants return) and T1685.007 (Disable or Modify Tools: Impair Autonomous Defenses — embedding instructions in evidence that AI-assisted security analysis consumes, i.e. poisoning the investigator’s own tools). The release’s non-AI neighbors matter too: T1697, Steal Application Specific Passwords (the long-lived secrets that bypass MFA prompts and often sit outside SSO and access reviews), and T1696 Anti-Automation Evasion with two CAPTCHA sub-techniques.

The supply-chain rewrite names your agent’s instruction files

The T1195.001 major-version bump is the quieter change with the sharper teeth. The sub-technique page now states that adversaries may target “the configuration and instruction files consumed by integrated development environments and AI coding agents,” calling out project files like tasks.json that execute commands when a developer opens or builds a project, and “agent skill files (SKILL.md)” that supply an agent with instructions and resources it loads on demand and runs with the agent process’s permissions. That single paragraph retroactively covers most of this year’s agent supply-chain beat — TrapDoor, the poisoned-skills work, the Downloads-folder AGENTS.md hijack — and it lands alongside the new Campaigns in the same release, which include attacks on U.S. water utilities and the AI-assisted breach of Mexican government infrastructure cited above.

The detections exist. The inventory to run them mostly doesn’t.

The release ships detection content with the techniques — per the TrebSec and Oleria summaries, 15 detection strategies and 38 analytics across Enterprise and ICS — and the detection for AI-Enabled Exfiltration (DET0927) is the one to read carefully. As Oleria’s analysis spells out, DET0927 flags an agent sending protected data outside “authorized data flows,” but the authorized values are placeholders only each organization can fill: the detection correlates an agent’s access to protected data, its tool calls, and a transfer — which means you need to know, for every agent, which identity it runs as, what data it may reach, and where that data may go. Their verdict, quoted here because it matches what our own coverage keeps finding: these are the AI detections most teams can’t run yet. MITRE’s mitigations lean the same way — M1038 Execution Prevention (never let model output independently authorize consequential actions), M1026 Privileged Account Management, M1030 Network Segmentation, M1022 file and directory restrictions.

The honest gap, stated in MITRE’s own structure: agent memory poisoning and sub-agent delegation still have no ATT&CK v20 technique, so keep ATLAS mappings alongside. And the operational move this release rewards is unglamorous — the same one GitHub’s AI-application code scanning preview pushes at PR time: enumerate every copilot, agent, and coding assistant in production, pin a named owner and an identity to each, and strip access it holds but never uses. T1700’s mitigations say to build the authorized-data-flow list for your most connected agents first. Without that baseline, the new detections cannot fire — and the framework now says so in writing.

Our verification was read-only. We read MITRE’s October 2026 (v20) release-notes page first-hand (13 October 2026 release date, v20.0/v20.1, 971 software / 182 groups / 61 campaigns, the nine-item Enterprise new-technique list, the T1195.001 v1.3-to-v2.0 bump, and the water-utilities and Mexico-infrastructure campaign descriptions), the full T1699, T1698, and T1700 technique pages (tactic, platforms, version 1.0, September 2026 authorship, C0064/C0062 procedure examples, M1038/M1026/M1030/M1022/M1048 mitigations), the T1195.001 page section naming IDE and AI coding-agent instruction files including SKILL.md, and the T1685.007 and T1608.007 pages confirming both IDs. The TrebSec brief (2 November 2026) and the Oleria analysis (23 October 2026) were used as discovery pointers and for DET0927 and the 15-strategy/38-analytic counts, which agree across both. The AgentCorruption, TrapDoor, AGENTS.md-hijack, code-scanning, and AgentCore parallels are our prior coverage linked above. We ran no agent, submitted no prompt, and contacted no one. Brave Search was used for discovery only.

Sources: