MITRE ATT&CK v20 adds prompt injection, AI agent abuse and MFA bypass techniques

MITRE has released version 20 of its ATT&CK knowledge base, adding techniques that describe how attackers abuse AI systems, bypass multi-factor authentication and get past bot checks, as well as new campaigns targeting water utilities. According to MITRE's update page, ATT&CK v20 was released on October 13, 2026. SecurityWeek, which reviewed the changes, said the biggest theme of the release is expanded coverage of recent adversary activity and tradecraft. Because ATT&CK is widely used by security teams to map threats, build detections and assess coverage, the new entries give defenders a shared vocabulary for attacks that until now had no formal place in the framework.

What changed in Enterprise

According to SecurityWeek, the Enterprise domain gains nine techniques and sub-techniques. Prompt injection is now tracked as two separate techniques: one for malicious instructions entered directly into a large language model's interface, and one for instructions hidden in content the model ingests. A new technique covers attackers using an organization's own AI agents to steal data, and a sub-technique describes poisoning web content to manipulate AI search and assistant recommendations. Another sub-technique covers disrupting LLM-assisted malware analysis.

Beyond AI, the release adds a technique for stealing application-specific passwords, which SecurityWeek notes allow sign-ins without triggering an MFA prompt, and a CAPTCHA bypass technique with sub-techniques for automatically solving and for avoiding CAPTCHAs. The existing sub-technique on compromised software dependencies and development tools has been extended to cover IDE and coding agent configuration files. MITRE said the additions help capture how adversaries get around MFA, bot checks and AI systems, the publication reported.

ICS, mobile and threat groups

In the industrial control systems domain, MITRE added a campaign describing attacks on internet-exposed PLCs at more than 30 water and wastewater utilities in Minnesota, which left operators locked out of their systems. SecurityWeek noted that some reports link the wider wave to Iranian-affiliated activity, but MITRE says attribution for the Minnesota intrusions remains unconfirmed. A second campaign documents an AI-assisted breach of Mexican government institutions that spanned IT and OT and reached a municipal water utility. ICS also gets a new Command and Scripting Interpreter technique, replacing deprecated entries, and two sub-techniques for command and control traffic hidden in DNS and in publish/subscribe protocols.

On the threat actor side, SecurityWeek reported that v20 adds Nimbus Manticore, an IRGC-associated espionage group targeting aerospace, defense and telecom organizations, and the ransomware-as-a-service operation The Gentlemen. Entries for Salt Typhoon and APT38 were updated, the latter reflecting a shift from financial theft to software supply chain attacks. In the mobile domain, a technique for delivering malicious apps outside official app stores has been restored, and the NFC relay malware NGate was added.

MITRE's figures put the knowledge base at 227 Enterprise techniques with 479 sub-techniques, 78 mobile techniques and 78 ICS techniques, along with 182 groups, 971 software entries and 61 campaigns.

What to do

Security teams that map detections to ATT&CK should review the new techniques and update their coverage assessments, particularly for AI agents and assistants deployed internally, app-specific passwords that bypass MFA, and coding agent configuration files in development environments. According to SecurityWeek, the release also includes 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics; the new ICS analytics are designed to ignore routine engineering and maintenance work. Water and wastewater operators should use the new campaign entries to check whether their PLCs are exposed to the internet.