MITRE ATT&CK v20 adds 9 Enterprise techniques; in v20 neither prompt injection one has a detection strategy

Every Enterprise entry had a detection strategy until the three new AI ones

Before version 20, every active Enterprise technique and sub-technique in MITRE ATT&CK had at least one detection strategy linked to it: 697 of 697 in version 19.2 (derived from MITRE's own STIX data). In version 20, released on 13 October 2026, the figure is 703 of 706 (derived). The three without one are the new entries Direct Prompt Injection (T1699), Indirect Prompt Injection (T1698) and Impair Autonomous Defenses (T1685.007). They are three of the five new entries that MITRE's release blog describes as AI-focused or AI-enabled.

That is the fact. Here is what it does not establish. It does not say prompt injection cannot be detected: no MITRE page read says so. It does not say the strategies that do exist work: the only analytic under the strategy for AI Result Poisoning opens, in MITRE's words, "No target-side behavioral analytic." It does not say these behaviours are common, new or attributable: seven of the nine new Enterprise entries link to no group, software or campaign in the data (derived). And it describes a snapshot, read between 14:47 and 15:05 BST on Monday 19 October 2026. MITRE can publish more.

How the count was made. The Enterprise STIX bundles for versions 19.2 and 20.0, which MITRE publishes in its attack-stix-data repository, were compared object by object in calc.py. An object counts as active if it is neither revoked nor deprecated. Version 19.2, of August 2026, is the last version 19 release and the baseline MITRE's own changelog uses. The method reproduced all 31 per-domain figures that MITRE prints on its release notes page and its three all-domain totals, and it agreed with MITRE's JSON changelog in every cell but one: a Mobile technique that MITRE counts as a major version change and this diff counts as returned from deprecated. SecurityWeek's report of 19 October says the Enterprise domain gets nine additions, counting techniques and sub-techniques. That holds: five techniques and four sub-techniques, none revoked or deprecated on arrival. SecurityWeek is a secondary source and is used here only as a pointer.

What changed by domain, drawn to scale

Version 20 is a small release in size and a large one in subject. The nine new Enterprise entries add 1.3 per cent to the 697 already there (derived). ICS goes from 97 to 104 (derived), with nine new entries and two deprecated. Mobile gains none and brings one back. The version 20 totals that MITRE prints, such as 227 Enterprise techniques and 479 sub-techniques, were reproduced exactly.

What changed between version 19.2 and version 20.0, counted from MITRE's STIX bundles (derived). Active objects only; 'detection strategies' counts MITRE's own object type.

Domain	Techniques and sub-techniques	Detection strategies	Campaigns, groups, software
Enterprise	697 to 706: 5 new techniques, 4 new sub-techniques, none removed	697 to 703: 6 new	1 new campaign, 2 new groups, 17 new software
Mobile	124 to 125: none new, 1 returned from deprecated	124 to 124: none new	No new campaign or group, 2 new software, 28 software entries revised
ICS	97 to 104: 9 new, 2 deprecated	97 to 106: 9 new	2 new campaigns, no new group, 2 new software

Three details sit behind the table. First, the two ICS deprecations, Command-Line Interface (T0807) and Scripting (T0853), are marked deprecated, not revoked. MITRE's blog says the new Command and Scripting Interpreter technique (T1701) replaces them, but the data carries no replacement link, so a mapping that used the old identifiers will have to be moved by hand (inference). Second, in Mobile the technique brought back from deprecation, Deliver Malicious Application via Other Means (T1476), is the one Mobile entry with no detection strategy, 124 of 125 (derived). Third, ICS analytics rose from 97 to 302 (derived), because MITRE reworked its ICS detections to name platforms and assets; that is 205 new analytic objects, only 22 of them under the nine new ICS strategies.

The nine new Enterprise entries, and what the data attaches to each

The table lists each new entry with the three things MITRE's data can attach to it: a detection strategy, an example of use by a group, a piece of software or a campaign (what ATT&CK calls a procedure example), and mitigations. The order puts MITRE's five AI-focused or AI-enabled entries first.

The nine new Enterprise techniques and sub-techniques in ATT&CK v20 and what the v20 Enterprise bundle links to each (derived, calc.py). Names and identifiers are MITRE's.

Entry and MITRE tactic	Detection strategy in v20	Linked example of use	Mitigations
Direct Prompt Injection (T1699), Execution	None linked	Two campaigns: C0062 and C0064	4
Indirect Prompt Injection (T1698), Execution	None linked	None	6
Impair Autonomous Defenses (T1685.007), Defense Impairment	None linked (the parent, T1685, has one)	None	5
AI-Enabled Exfiltration (T1700), Exfiltration	DET0927, 3 analytics	None	3
AI Result Poisoning (T1608.007), Resource Development	DET0922, 1 analytic that opens "No target-side behavioral analytic."	None	1
Anti-Automation Evasion (T1696), Stealth	DET0939	None	2
Automate CAPTCHA Completion (T1696.001), Stealth	DET0937	None	2
Avoid CAPTCHA (T1696.002), Stealth	DET0938	None	2
Steal Application Specific Passwords (T1697), Credential Access	DET0926, 3 analytics	One group: APT42	4

What MITRE does attach to the three entries without a strategy is prevention. Every one of the nine has at least one mitigation, and the three without a strategy have 4, 6 and 5. Version 20 adds no Enterprise mitigation object (44 before and after, derived); MITRE reuses existing categories, with technique-specific text for most. AI Result Poisoning carries the standard Pre-compromise wording, that the technique "cannot be easily mitigated with preventive controls". For Direct Prompt Injection, the Execution Prevention entry says to "Enforce tool, API, command, and resource authorization outside the model." That matches the UK National Cyber Security Centre's advice, discussed below, to rely on deterministic safeguards around the model. The data gives these three entries a prevention story and no detection story.

The strategies that do exist deserve the same care. For AI Result Poisoning, MITRE's own technique text says "traditional prompt injection and malware-focused detections may not identify the activity", and the one analytic under DET0922 is an explicit statement that the target's telemetry cannot separate the behaviour from ordinary publishing. A tool that reports T1608.007 as covered on the strength of DET0922 would be reporting a strategy whose own analytic says there is nothing to detect on the target side. That is honest on MITRE's part. It is also not coverage.

Two further analytics show how much is unsettled. AN2070 and AN2074 are new Enterprise analytics in the bundle that no detection strategy references. Each carries a page address pointing at a strategy page, DET0923 and DET0925, and those pages, like DET0924, answered 404 when read on 19 October 2026. Their wording concerns an authenticated AI interaction using a tool or API outside an authorised workflow or capability scope, and an autonomous defensive-analysis workflow that fails or ends abnormally. They read like detection logic for the entries that have no strategy (inference). The data does not link them to those entries, and MITRE has not said why.

Seven of the nine link to no group, software or campaign. MITRE's FAQ says "Publicly available threat intelligence and incident reporting is the main source of data in ATT&CK", and the references for the nine include vendor research, news articles and a NIST glossary entry, so a missing link means MITRE had not linked an example by 13 October. It does not mean none exists. Direct Prompt Injection links to two campaigns. MITRE's pages describe both as using Claude Code, a product of Anthropic. Anthropic sells that product and wrote the report behind one of them, C0062; the other, C0064, rests on reports from two security vendors. Steal Application Specific Passwords links to one group, APT42.

SecurityWeek's claims, one by one, against the data

Each checkable statement in SecurityWeek's report was compared with the bundles. Most hold. Two need qualifying: the analytics figure and the IT and OT label.

SecurityWeek (19 October 2026, secondary) against MITRE's v20 STIX data (derived, calc.py section H).

SecurityWeek says	The MITRE data shows	Result
Nine Enterprise additions, counting techniques and sub-techniques	9 = 5 techniques + 4 sub-techniques; none revoked or deprecated on arrival	Holds
Prompt injection is two techniques	T1699 (direct) and T1698 (indirect), both new techniques	Holds
15 new detection strategies, six for Enterprise and nine for ICS	6 + 9 = 15, none in Mobile; none of the 15 is for T1699, T1698 or T1685.007	Holds, with the gap above
Backed by 38 analytics	10 Enterprise and 22 ICS analytics sit under the 15 strategies, 32 in all; 12 Enterprise analytics are new, 2 of them under no strategy	38 not reproduced
Six ICS interpreter sub-techniques replace two deprecated techniques	T1701.001 to T1701.006 are new; T0807 and T0853 are deprecated with no replacement link in the data	Holds
A campaign on more than 30 Minnesota utilities, attribution unconfirmed	C0066 has nine ICS technique links and no attributed-to link; its text says attribution "remains unconfirmed"	Holds
An AI-assisted breach that spanned IT and OT	C0064 sits in the ICS bundle but links to no ICS technique; the cited Dragos brief found no evidence of OT access	MITRE's label; not shown by the data

On the 38: the figure is MITRE's, repeated by SecurityWeek, and the bundles do not reproduce it by the method used here. Ten Enterprise and 22 ICS analytics belong to the 15 new strategies, which is 32 (derived). Counting every new Enterprise analytic instead of only the attached ones gives 34 (derived). The gap is small beside the issue of the missing strategies, and MITRE may be counting something the bundles do not show. The larger number is in ICS, where 183 of the 205 new analytic objects sit under strategies that already existed (derived).

The two campaigns: what MITRE's pages state and what the cited sources say

Version 20 adds C0066, 2026 U.S. Water Utilities Attacks and C0064, AI-Assisted Breach of Mexico's Government Infrastructure. MITRE's pages cite a handful of sources for each. The table sets MITRE's statements beside what those sources say, using only pages read in full for this briefing. The FBI's own page answered curl with a bot check and was not read; the same notice, alert I-073026-PSA, was read as a PDF from the FBI's internet crime site.

MITRE's campaign pages for C0066 and C0064 against the sources they cite, read 19 October 2026. Vendors named are security companies selling their own services.

Question	MITRE's page	The cited sources as read
C0066: who was behind it?	"The campaign has not been formally attributed"; attribution for the Minnesota intrusions "remains unconfirmed". The data has no attributed-to link.	The FBI and EPA notice names no actor. Dragos's post sets the Minnesota attacks beside a wider Iranian-affiliated wave documented by CISA and calls the targeting consistent with Iranian operations; Forescout says there is "no confirmed link between the two". CISA's advisory AA26-097A attributes a separate wave, since March 2026 and against other controller families, to Iranian-affiliated actors.
C0066: how were the controllers reached?	Maps Default Credentials, citing Tenable.	The FBI and EPA notice says actors accessed internet-facing devices remotely and "changed the IP addresses and passwords". Tenable's page as read does not say default credentials for these devices. Dragos's post names an authentication flaw; Forescout says there is no confirmation of any CVE exploited. The method is not settled by these pages.
C0066: how large was it?	More than 30 Minnesota utilities from 27 July 2026.	The 30 appears in the Dragos, Tenable and Forescout pages, and Forescout attributes it to Minnesota IT Services, a state agency whose own notice was not read. The FBI and EPA notice says utilities in "at least seven states" reported incidents since 27 July 2026 and gives no Minnesota count. It names Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series controllers.
C0064: did it reach OT?	"a cross-domain Campaign, spanning IT and OT", reaching a municipal water utility.	Dragos, in a brief updated May 2026: it "did not identify evidence that the adversary established validated access to the OT environment"; two rounds of password guessing against an OT-adjacent management interface "All attempts were unsuccessful". Gambit Security's April 2026 report lists the utility's scope of breach as procurement and vendor records. The ICS bundle links C0064 to one software entry and no ICS technique.
C0064: how autonomous was it?	"human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI".	Gambit calls it "a hybrid, human-directed operation" in which about 75 per cent of remote command execution was generated and executed by Claude Code. Dragos assesses with high confidence that Claude primarily enabled it. Both firms sell security products.

Two labels in this story go further than the cited record. The first is "spanning IT and OT". The data and both cited reports describe an intrusion into a utility's IT network, with a failed attempt to reach an OT-adjacent interface. That attempt is worth knowing about, because the Dragos brief says an AI model identified the interface as significant and recommended it; it is not the same as an OT intrusion. The second is the water campaign's access method. A defender deciding whether to patch, change credentials or remove exposure needs the method, and the pages MITRE cites give three different answers. The common defensive advice in the FBI and EPA notice does not depend on the answer: remove controllers from direct internet exposure, set unique passwords, restrict access, and put key switches in the run position.

Anthropic and OpenAI sell the AI services the second campaign page names, and compete with each other. Neither company's own account of that incident was read for this briefing. This site's earlier briefing on a vendor's operational technology lab test found a headline about AI and industrial systems whose conditions the source left unstated.

What ATT&CK is, and what a new version cannot tell you

MITRE's FAQ says "ATT&CK is a knowledge base of cyber adversary behavior and taxonomy for adversarial actions across their lifecycle." Its Design and Philosophy paper says "in general, coverage of every ATT&CK technique is unrealistic" and that ATT&CK "is not intended to provide a checklist of things that need to all be addressed". It also advises that "it is not recommended to attribute activity solely based on the ATT&CK techniques used." None of this is a ranking of risk, a compliance standard or a measure of how well anyone is defended. MITRE's version 19 blog gives the test for new AI entries: "the key distinction is the behavior, not the tool", and the question is whether a behaviour creates "meaningfully different detection, defensive response or analytic requirements". The test is the likely reason prompt injection earned entries (inference). It does not require that detection exist when an entry is added.

What the objects and labels in the v20 data establish, and what they do not. MITRE's own statements are quoted; the rest is derived from calc.py.

Object or label	What it establishes	What it does not establish
A detection strategy	MITRE wrote a behavioural description and analytics for one technique.	That it detects anything. DET0922's only analytic says there is no target-side behavioural analytic.
A mitigation link	MITRE relates a control category, with technique-specific text, to the entry.	That the control stops the behaviour. The NCSC says prompt injection "may never be totally mitigated".
A campaign in a domain	MITRE mapped reported activity into that domain.	Attribution (C0066 has none) or reach (C0064 links to no ICS technique).
An "AI-focused" entry	MITRE judged the behaviour meaningfully different from what ATT&CK already held.	That it is common or new. Seven of nine new Enterprise entries link to no example of use.
A vendor saying it covers v20	Nothing. ATT&CK sets no coverage standard.	That any detection runs in your environment. MITRE's paper calls full coverage "unrealistic".

One practical point follows from version numbers. CISA's advisory AA26-097A, updated on 22 July 2026, states that it uses the ATT&CK Matrix for Enterprise "framework, version 19". Anything mapped to that version cannot contain Direct Prompt Injection or Steal Application Specific Passwords, which MITRE created in September 2026 and released on 13 October. A mapping is only as current as the version it names.

The UK: how NCSC pages use ATT&CK, and what they say about the AI entries

No UK statute or regulator page read for this briefing requires ATT&CK mapping. The NCSC's pages use it as a method and, in one scheme standard, as a requirement on incident responders. The table gives each page as read on 19 October 2026 and where it stops.

UK pages read on ncsc.gov.uk, 19 October 2026, with short quotations and where each stops.

NCSC page	What it says	Where it stops
Blog, "What exactly should we be logging?"	Structures logging advice around ATT&CK's tactics, which it says divide into "14 discreet sections (at the time of writing)".	Enterprise now has 15 tactics. MITRE retired Defense Evasion in version 19, and four of the nine new entries sit in the two tactics that replaced it, Stealth and Defense Impairment (derived).
10 Steps to Cyber Security, logging and monitoring	Says that blog "introduces the MITRE ATT&CK framework and how it can be used to help define monitoring strategies".	Names no version and no technique.
Building and operating a secure online service	Says threat modelling is more useful with "knowledge bases of known threat tactics, techniques and processes (TTPs)", giving ATT&CK as an example.	Guidance, not a requirement.
Cyber Incident Response Technical Standard (Standard Level), version 1.5.1, April 2023	Requirement 16: providers "must understand and make use of the MITRE ATT&CK framework and YARA rules".	Binds assured incident response providers, not ordinary organisations. Silent on versions.
Cyber Assessment Framework 4.0, principles C1 and C2	Lists MITRE publications on security operations centres and TTP-based hunting as further reading.	The text read does not name ATT&CK. No mapping is required.
Blog, "Prompt injection is not SQL injection", 8 December 2025	Says it is "very possible that prompt injection attacks may never be totally mitigated", warns against deny-listing known bad phrases, and urges logging "full input and output of the LLM, as well as tool use, API calls".	Advice on design, not an ATT&CK mapping.
Blog, "Managing the cyber risk of agentic AI", 20 August 2026	Has a section titled "Observability: log, audit and monitor agentic AI activity as part of security operations".	Interim advice that it says will be superseded by formal guidance.
Cyber Essentials requirements for IT infrastructure, version 3.3, April 2026	Says to implement MFA where available and that "authentication to cloud services must always use MFA".	The text does not use the words application-specific password, legacy authentication, artificial intelligence or ATT&CK.

Two readings follow, both inference. First, the NCSC's own advice on prompt injection has two parts: deterministic limits on which tools and APIs an agent can use, which is where MITRE's mitigation text points, and logging of tool and API use, which is where MITRE's data has no strategy. A UK organisation that waits for a MITRE strategy before logging agent tool calls is waiting for something the NCSC's own advice does not wait for. Second, Cyber Essentials requires multi-factor authentication for cloud services, but an application-specific password is a credential built to be used without that step. Whether a certificate-holder's cloud accounts allow them is a question the scheme text, as read, does not ask.

For operational technology, the FBI and EPA notice points to the joint NCSC secure connectivity principles for OT. Principle 2 says to "Remove inbound port exposure" so that an OT system "is never directly exposed to the internet or external networks". That is the control the Minnesota pages agree on, whatever the method of access was.

What to do, in the order worth doing

Each item below follows from a specific gap in the record above. Defender level only: none needs an indicator, a payload or a test against anyone else's system.

On prompt injection specifically, this site has covered a vendor report on self-replicating prompt injection, which gave four transcripts and no rate. The pattern is similar: vivid examples and no rate.

What could not be verified, and how each source was read

• MITRE's blog on Medium. The page answered curl with a Cloudflare challenge and was not bypassed. Its full text was read from MITRE's own Medium RSS feed, which carries the post, and every claim from it is cross-checked against the release notes page and the STIX data.
• The FBI's page. Same: a bot check. The identical notice was read as a PDF from the FBI's internet crime site.
• The 38 analytics. Not reproduced. The arithmetic the data supports is shown above.
• The two unlinked analytics. That they belong to the entries without a strategy is inference from their wording and page addresses. MITRE has not said.
• The Tenable page was read as it stood on 19 October, with an update log to 10 August. MITRE retrieved it on 26 September, so a later edit cannot be ruled out. The statement that it does not say default credentials is about the copy read.
• The Gambit Security and Dragos reports were read in full as PDFs (text extracted; the figures in them were not read). Both firms sell security services. Neither Anthropic's nor OpenAI's own account of the Mexican incident was read.
• Not read: MITRE's 5.8 MB detailed changelog page (saved, not read line by line; the JSON changelog was used for the cross-check), CISA's 30 July sector alert, Rockwell's advisories, EPA pages, and the other NCSC pages not listed in the UK table.
• Timing. MITRE says version 21 is planned for April, and that agile releases between versions publish groups, software and campaigns, not techniques. Whether detection strategies can be added between releases was not stated, so the absence of a linked strategy is true of the data read on 19 October 2026 only.
• Time-stamped. Sources were read between 14:47 and 15:05 BST on 19 October 2026. No form was filled in or submitted, and no individual is named.

The question that exposes the gap

If MITRE has linked no detection strategy to prompt injection, which log in your own organisation would show an AI agent being told by a document to use one of its tools, and who reads that log today?

Key facts