MITRE released ATT&CK v20 on October 13, 2026. It adds the first Enterprise techniques for direct and indirect prompt injection, AI-enabled exfiltration and AI result poisoning.
MITRE ATT&CK v20 Adds New AI Attack Techniques
According to updates published by MITRE, the release updates Techniques, Groups, Campaigns and Software across the Enterprise, Mobile and ICS domains. MITRE calls the biggest change “expanded coverage of recent adversary activity and tradecraft.”
That includes new Campaigns on attacks against U.S. water utilities and an AI-assisted breach of Mexican government infrastructure.
The matrix now holds 971 Software entries, 182 Groups and 61 Campaigns. Enterprise has 227 Techniques and 479 Sub-Techniques.
Nine new Enterprise Techniques arrive at v1.0. Five are AI-focused or AI-related, and the rest cover anti-automation evasion and credential theft.
MITRE also revised Obtain Capabilities: Artificial Intelligence to v1.2.
Defenders get new Detection Strategies for AI-Enabled Exfiltration and AI Result Poisoning. Others cover Anti-Automation Evasion, Automated CAPTCHA, Avoid CAPTCHA and suspicious use of application-specific passwords.
Twelve new Enterprise analytics, numbered 2068 to 2106, sit behind them.
The new Campaign “AI-Assisted Breach of Mexico’s Government Infrastructure” appears in both Enterprise and ICS. The “2026 U.S. Water Utilities Attacks” Campaign appears in ICS.attack.mitre
New Enterprise Groups are NIMBUS MANTICORE and The Gentlemen. Salt Typhoon and APT38 received major version updates, and APT42 and Gamaredon Group received minor ones. New ICS software includes IOControl and BACKUPOSINT v9.0 APEX PREDATOR.attack.mitre
ICS gains Command and Scripting Interpreter, with sub-techniques for JavaScript, PowerShell, Python, Unix Shell, Visual Basic and Windows Command Shell.
It also gains Standard Application Layer Protocol sub-techniques for DNS and Publish/Subscribe protocols. The older ICS Command-Line Interface and Scripting techniques are deprecated.attack.mitre
ICS adds nine behavioral Detection Strategies, and its Detection Strategies now include platform and Asset context.attack.mitre
Mobile un-deprecates Deliver Malicious Application via Other Means, last seen in v11. It is now at v2.0. Mobile Detection Strategies also account for the visibility limits of Android and iOS.attack.mitre
Enterprise Supply Chain Compromise: Compromise Software Dependencies and Development Tools moves to v2.0.attack.mitre
Security teams can now map prompt-injection and AI-driven exfiltration incidents to standard ATT&CK IDs. That makes it easier to build detections, run threat-hunting exercises and write consistent incident reports.
Teams that use the MITRE ATT&CK framework for coverage mapping should review the detailed changelog and update their detection rules and playbooks. MITRE will discuss the release at ATT&CKcon 7.0 on October 27–28, 2026, in McLean, Virginia.
