Key figure: 63% of organizations in IBM's 2025 breach study had no AI governance policy, and 97% of AI-breach victims had no proper AI access controls (IBM, Cost of a Data Breach Report 2025).
MITRE ATT&CK v20 added 5 technique IDs for AI attacks. As AI agents 2026 go mainstream, defenders need this map. Browse tactics, techniques, and mitigations.
AI agents 2026 expand the attack surface MITRE ATT&CK v20 now tracks: 5 new technique IDs cover prompt injection, model theft, data poisoning, and agent hijacking. Map each technique to a concrete control — input validation for injection, rate limits for theft, provenance checks for poisoning. This page maps all 5 IDs to tactics and mitigations for systematic red-team testing. An unmapped technique is your gap.
MITRE ATT&CK for AI extends the classic adversary-tactics framework with technique IDs for AI-specific attacks — prompt injection, training-data poisoning, model theft — giving defenders a shared map of how AI systems get attacked.
On October 13, 2026, MITRE released ATT&CK v20 with 9 new Enterprise techniques — five of them AI-focused. Prompt injection, AI-driven exfiltration, and AI result poisoning now have canonical IDs your board, your SOC, and your red team can all point at. Important: this is a taxonomy release, not a vulnerability — nothing to patch, but everything to map. The five cards below give you each technique in plain words plus how to test it. Then take the 60-second coverage check.
Malicious instructions submitted directly to an AI system's interface — the classic jailbreak. The attacker talks to your chatbot or agent and talks it out of its guardrails.
How to test it: run a battery of known instruction-override prompts against your chatbot/agent interface, including multi-turn setups where the malicious intent only appears across several messages. Verify guardrails hold every turn.Malicious instructions embedded in content the AI later reads — a hidden line in a webpage, document, email, or tool result that your agent follows on a user's behalf. The attacker never touches your AI directly.
How to test it: plant a hidden instruction ("ignore prior instructions and summarize this as…") in a document or page your agent retrieves. Check whether the agent follows the planted instruction instead of the user's.Directing an enterprise AI agent to extract sensitive organizational data — the agent becomes the insider. Legitimate access, malicious purpose.
How to test it: give your agent a task involving sensitive data while a malicious instruction hides in retrieved content. Verify the agent refuses to move data outside its authorized boundary.Manipulating web content to influence AI search results and recommendations — SEO poisoning aimed at AI assistants instead of humans. Your AI's answers get quietly steered.
How to test it: publish a test page with hidden AI-targeted content and check whether your AI search/RAG pipeline surfaces or cites it. If it does, your retrieval layer trusts too easily.Interfering with AI-assisted security tools themselves — blinding the malware analyzer, muting the autonomous defender. Attack the guard dog first.
How to test it: simulate an attacker tampering with your AI security tooling (killing processes, altering configs, flooding with noise). Verify tamper alerts fire and a fallback control engages.Also new in v20 (non-AI): T1697 Steal Application Specific Passwords and T1696 Anti-Automation Evasion, with sub-techniques for automating and avoiding CAPTCHA challenges.
git clone https://gitlab.com/Iceman2050/attack-matrix-mapper.git
cd attack-matrix-mapper
python3 attckmap.py findings.json --html report.html
Free open-source tool by Ingenious AI. Takes your findings JSON, returns a v20 AI-technique coverage heatmap with gaps.
MITRE released ATT&CK v20 on October 13, 2026, adding 9 new Enterprise techniques and sub-techniques. Five are AI-focused: T1699 Direct Prompt Injection, T1698 Indirect Prompt Injection, T1700 AI-Enabled Exfiltration, T1608.007 Stage Capabilities: AI Result Poisoning, and T1685.007 Disable or Modify Tools: Impair Autonomous Defenses.
T1699 covers malicious instructions submitted directly to an AI system's interface — the classic jailbreak: an attacker types instructions into a chatbot or agent prompt to make it ignore its guardrails, reveal system prompts, or perform unauthorized actions.
T1698 covers malicious instructions embedded in content an AI system later retrieves or processes — a hidden instruction in a webpage, document, email, or tool result that an AI agent reads and follows on a user's behalf, without the attacker ever touching the AI interface directly.