MITRE ATT&CK v20 adds 9 enterprise techniques for AI exploits, credential theft and CAPTCHA evasion

MITRE published version 20 of the ATT&CK framework on 13 October. The release introduces nine new enterprise techniques that describe methods for exploiting AI systems, bypassing multi-factor authentication, and evading CAPTCHA checks.

What happened

The update adds five techniques specifically targeting artificial intelligence systems. Direct Prompt Injection covers malicious instructions entered directly into a large language model interface. Indirect Prompt Injection describes hostile instructions hidden within content an AI system processes, such as emails or documents.

AI-Enabled Exfiltration details attempts to force enterprise AI agents to transmit data externally. AI Result Poisoning involves manipulating public web content so AI search tools return attacker-controlled information. Impair Autonomous Defenses covers efforts to disrupt AI-assisted security analysis tools.

The framework also includes techniques for stealing application-specific passwords to bypass multi-factor authentication. These entries help defenders distinguish between user-submitted malicious prompts and AI systems encountering hostile content in external sources.

Why it matters

This update provides a shared language for describing attacker behaviour in AI-enabled environments. It clarifies how hostile content can steer AI agent actions beyond user intent. The changes help security teams map observed activity across business networks, mobile devices, and industrial control systems.

The framework does not confirm specific breaches. Instead, it offers detection guidance for these new behaviours. This allows organisations to align their threat reports and security testing with current attack methods.

Next steps

• Review current AI agent permissions and data access controls.
• Audit logging for application-specific password usage.
• Update detection rules to identify prompt injection patterns.
• Assess industrial control system coverage against the new techniques.

Detection notes

Security teams should monitor logs for unusual data exfiltration attempts by AI agents. Check whether automated security tools are ignoring evidence or stopping file reviews unexpectedly. Look for anomalies in how AI systems process external content like emails or web pages. Verify that application-specific passwords are not being harvested or reused inappropriately. Teams usually correlate these signals with baseline behaviour to identify potential compromise. Containment moves typically involve isolating affected AI tools and revoking suspicious credentials immediately.

Background: CAPTCHA

CAPTCHAs distinguish humans from bots by presenting challenges that are easy for people but difficult for automated scripts. While image selection remains common, modern systems increasingly use invisible behavioural analysis to verify user intent without interrupting the workflow.

Read the full guide: CAPTCHA Mechanics: How Challenge-Response Systems Actually Work

What to do and how to stay safe: MITRE

• Audit all AI agents for unnecessary access to sensitive enterprise data.
• Monitor logs for indirect prompt injection attempts in processed documents.
• Review authentication logs for unusual application-specific password usage.
• Ensure detection rules cover the new MITRE ATT&CK enterprise techniques.

Step-by-step guide: How to Prevent Account Takeover: The Technical Controls That Actually Work

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When was MITRE ATT&CK v20 released?

MITRE released ATT&CK v20 on 13 October.

How many new enterprise techniques were added?

The update adds nine new enterprise techniques.

What AI-specific risks do the new techniques cover?

They cover direct and indirect prompt injection, AI-enabled exfiltration, result poisoning, and impairing autonomous defenses.