ATT&CK v20 Names the AI Attacks

MITRE shipped ATT&CK v20 on October 13, 2026. Its detailed changelog from v19.2 lists the additions below. The headline is that attacks on and through language models now have technique ids of their own.

Enterprise: five techniques, four sub-techniques

Three of the five new techniques are about AI. T1698 Indirect Prompt Injection covers adversaries planting instructions in content an LLM is expected to process, such as web pages, documents, email, tickets or code. T1699 is its direct counterpart, and T1700 AI-Enabled Exfiltration names data theft carried out through an AI system. The other two techniques are T1696 Anti-Automation Evasion, with sub-techniques for automating CAPTCHA completion and for avoiding CAPTCHA, and T1697 Steal Application Specific Passwords. Two more sub-techniques sit under existing techniques: T1685.007 Impair Autonomous Defenses and T1608.007 AI Result Poisoning.

ICS: an interpreter technique and two protocol sub-techniques

ICS gets T1701 Command and Scripting Interpreter, with sub-techniques for PowerShell, Windows Command Shell, Unix Shell, Visual Basic, Python and JavaScript. Two new sub-techniques also appear under T0869 Standard Application Layer Protocol: DNS, and Publish/Subscribe Protocols. The changelog also deprecates the ICS techniques T0807 Command-Line Interface and T0853 Scripting, so coverage mapped to those two needs a new home.

Detection strategies: 15 new, with ICS context

The release adds 6 Enterprise and 9 ICS detection strategies, with 12 new Enterprise analytics. The Enterprise strategies cover AI-enabled exfiltration (DET0927), AI result poisoning (DET0922), anti-automation evasion (DET0939), automated and avoided CAPTCHA (DET0937, DET0938) and suspicious use of application-specific passwords (DET0926). The nine ICS strategies are behavioral detections for command and scripting abuse (DET0928), PowerShell, Windows Command Shell, Unix Shell, Visual Basic, Python and JavaScript execution (DET0929 to DET0933 and DET0936), DNS misuse for command and control (DET0934) and Publish/Subscribe misuse for command and control (DET0935). MITRE's ICS strategies now carry platform and asset context, which is the part that makes them usable in a plant rather than only on paper.

What this means for detection

Two things change in practice. First, AI-agent abuse stops being filed under a generic execution or exfiltration id. A rule that catches a poisoned document steering a coding agent is now an Indirect Prompt Injection rule, and a report can say so. Second, interpreter abuse in a plant has a home: scripts launched on an engineering workstation or historian can be tagged T1701 and its sub-techniques instead of the deprecated Command-Line Interface and Scripting entries.

What Caver does with it

Caver maps its rules to ATT&CK and scores its coverage against the ICS matrix. Caver is carrying the v20 detection strategies and analytics on its rules, its ICS navigator view and its notable events; that change is merged into Caver and ships in the next release. The RedEye detection feeds follow the same mapping: on this site the Indirect Prompt Injection coverage badge on our agentjacking post now cites T1698.

Sources: MITRE ATT&CK updates, v20; detailed changelog, v19.2 to v20.0; T1698 Indirect Prompt Injection. Detection-strategy and analytic counts are tallied from the changelog listings, which do not state totals.