MITRE ATT&CK v20: What's New, and What It Means for Your Exam

MITRE released ATT&CK v20.0 on October 13, 2026, and for the first time the Enterprise matrix has a cluster of techniques that only exist because companies now run AI assistants and agents. Five of the nine new Enterprise entries are about AI: prompt injection typed in directly and hidden in content, AI agents turned into an exfiltration channel, attacks on AI-assisted security tools, and poisoned AI search results. The other four cover MFA-bypassing app passwords and CAPTCHA evasion. This post walks through every addition, where it lands in the matrix, which defenses actually matter, and what it changes for your exam. Our interactive ATT&CK matrix is already on v20, with the new entries badged so you can click straight through.

How MITRE versions the framework

ATT&CK ships two major releases a year, one in the spring and one in the autumn, with small point releases in between. v19.2 ran from April 28 to October 12, 2026; v20.0 replaced it on October 13. A release can add techniques, revise them, deprecate them, or restructure the matrix itself. v19 was the restructuring release: it split the old Defense Evasion tactic into Stealth and Defense Impairment, which is why the matrix now has 15 tactics. v20 is the opposite kind of release. Nothing was removed, renamed or moved between tactics. It only adds.

Every technique also carries its own version number, and that is where the "2.0" you may have seen comes from. A major version bump on a single technique means MITRE substantially rewrote it. In v20 that happened to Supply Chain Compromise: Compromise Software Dependencies and Development Tools (T1195.001), which went from v1.3 to v2.0, a sign of how much package-registry and build-tool abuse has grown. About 25 other techniques, including Phishing and PowerShell, got smaller revisions.

The nine new Enterprise entries

The AI cluster: one idea, five techniques

The five AI techniques are easiest to understand as one idea seen from five angles. A language model treats its operator's instructions and any text it reads as the same kind of input. If an attacker can get text in front of the model, by typing it or by placing it somewhere the model will read, they can influence what the model does with whatever access it has been given. The MITRE ATLAS matrix has catalogued this for AI systems for years. What v20 does is bring it into Enterprise ATT&CK, the matrix most SOCs actually map their detections to, because AI assistants and agents are now ordinary enterprise systems with email, file and API access.

Direct Prompt Injection (T1699) is the version most people have seen: someone types into a chatbot and tries to talk it out of its rules, often by claiming a privileged role or asking it to set aside earlier instructions. It sits under Execution because the goal is to get the system to run capabilities it should refuse.

Indirect Prompt Injection (T1698) is the more dangerous one for enterprises, because the attacker never talks to the AI at all. They put instructions in content they expect it to process later: a web page an agent will browse, a document someone will ask it to summarize, an email or support ticket it will triage. MITRE's own description notes that it can be used to reach both Impair Autonomous Defenses and anything else the model is able to do.

AI-Enabled Exfiltration (T1700) is what happens when injection meets an agent with real tools. The data does not leave through attacker malware. It leaves through a connector the company approved, which is why MITRE notes that existing exfiltration techniques such as Exfiltration Over Web Service often apply on top.

Impair Autonomous Defenses (T1685.007) turns the same trick against the defender. More security teams now let a model triage alerts, summarize malware samples or score suspicious activity. Text planted in the artifact being analyzed can push that model toward "benign", so nothing is escalated. It is a sub-technique of Disable or Modify Tools, under the Defense Impairment tactic that v19 created.

AI Result Poisoning (T1608.007) sits in Resource Development, before any victim is touched. The attacker seeds public content so that AI search engines and assistants retrieve, cite or recommend it, which can serve a fake download, a malicious fix or planted instructions to whoever asks later.