MITRE ATT&CK® v20 and AI agents: Start with the detections, not the techniques

The release, in brief

ATT&CK v20 adds nine new enterprise techniques and sub-techniques, nine ICS techniques and sub-techniques, 15 detection strategies and 38 analytics. The headline is AI: MITRE now tracks how adversaries abuse AI systems inside the enterprise, not only how they use AI to write better phishing.

The release also adds Anti-Automation Evasion (T1696) for CAPTCHA bypass, and substantially updates T1195.001 to cover IDE configurations and coding agent instruction files.

Read the detections, not just the techniques

Most coverage of v20 stops at the technique list. The more revealing part is how MITRE says to detect them.

Take DET0927, Detect AI-Enabled Exfiltration. Its SaaS analytic describes an AI agent accessing a protected data scope, invoking a tool or API with that information, and completing a transfer to a recipient, repository, tenant or domain outside the authorized data flows. The endpoint version looks for an AI-associated process accessing data outside AuthorizedAIDataScope.

Those dollar-sign variables are placeholders. MITRE can describe the pattern; only you can fill in the values. To run this detection, you need to know, for every agent:

• which identity it runs as, and on whose behalf it acts
• what data it is permitted to reach
• what data it actually uses for its job
• where that data is allowed to go

Most organizations can’t answer those questions for their employees, let alone for the copilots, MCP servers and custom agents deployed this quarter.

DET0926, the new detection for application-specific passwords, has the same dependency. It flags an app password created and then used from an unusual client, device or location, or “inconsistent with approved usage.” The detection is only as good as your record of what normal looks like for that identity.

That’s our main takeaway from v20. ATT&CK tells defenders what adversaries do. This release also shows that detecting AI-era attacks depends on an access baseline most teams don’t have.

Where v20 runs through identity

T1698 and T1699: the injection is the trigger, the access is the blast radius. Direct injection comes through the interface an attacker uses. Indirect injection arrives in lower-trust material the agent reads during an authorized task. Either way, everything that follows runs on credentials the agent legitimately holds. You won’t stop every injection. You can decide what the agent can do after one succeeds.

T1700: the exfiltration path already exists. The agent uses tools it was already given. MITRE’s listed mitigations are application isolation and sandboxing (M1048), restricting file and directory permissions (M1022) and user training (M1017). Two of the three are access controls.

T1697: the sign-in path nobody reviews. In 2025, Google’s Threat Intelligence Group documented a Russia-linked group persuading targets to create Gmail app passwords and hand them over, gaining persistent access without ever defeating MFA. Credentials like these often sit outside SSO, outside reviews and outside anyone’s inventory.

T1195.001: agent configuration is now supply chain. Coding agent instruction files can contain natural-language instructions a tool-privileged agent will act on, and they define which tools, servers and secrets that agent can use. Every MCP server they reference is an identity that needs an owner.

Where it doesn’t: CAPTCHA evasion and AI result poisoning are mainly fraud and web-integrity problems, and identity is not the primary defense. Impair Autonomous Defenses is mostly about the resilience of AI security tools, though it raises a question every vendor, including us, should answer.

The Oleria POV

We’ve said before that every agent is an identity and every MCP server is an identity. ATT&CK v20 makes the practical case for governing them that way.

1. Build the baseline MITRE’s detections assume. Oleria’s TrustFusion Identity Context Graph brings human, non-human and AI agent identities into one view, down to the resource level. Adaptive Identity Governance compares what each identity is permitted to do with what it actually does. That difference is what turns AuthorizedAIDataScope from a placeholder into a real value.

2. Shrink what an agent holds, and enforce it at runtime. Oleria Maestro issues agents short-lived tokens bound to the human they act for, instead of standing credentials. The Oleria AI Agent Gateway evaluates each agent action and its arguments over MCP and REST, then allows, denies or requires approval, with every decision in a queryable audit log. That gives T1700 a checkpoint before data ever leaves.

3. Find the side doors. Oleria checks MFA and SSO coverage, including unmanaged local and native accounts, and flags dormant and stale credentials across human and non-human identities.

4. Keep AI in security supervised. T1685.007 is why Oleria AI advises rather than acts. It shows the evidence behind every recommendation, leaves decisions to your governance workflows, and its MCP endpoint is read-only.

What to do this week

1. Build a list of the agents, copilots, MCP servers and coding assistants running today, including ones employees set up themselves, and give each a named owner.
2. For your three most connected agents, compare what they can access with what they actually use. Remove the difference.
3. Find where application-specific passwords and other non-MFA sign-in paths are allowed, and who can create them.
4. Require an owner review for changes to coding agent and IDE configuration files.
5. For each new v20 detection your team plans to adopt, check whether you can fill in the baseline it depends on before you build it.

MITRE has given defenders a shared vocabulary for AI-era attacks. The next question is the one its detections can’t answer for you: do you know what each of your identities, human or agent, should be able to access right now?

Frequently asked questions

What is MITRE ATT&CK v20?
ATT&CK v20 is MITRE’s October 2026 release of its adversary tactics and techniques knowledge base. It adds nine Enterprise techniques and sub-techniques, 15 detection strategies and 38 analytics, with a focus on adversary abuse of AI.

Which AI techniques were added in ATT&CK v20?
Five: Direct Prompt Injection (T1699), Indirect Prompt Injection (T1698), AI-Enabled Exfiltration (T1700), AI Result Poisoning (T1608.007) and Impair Autonomous Defenses (T1685.007).

How does MITRE recommend detecting AI-Enabled Exfiltration?
Detection strategy DET0927 correlates an AI agent’s access to protected data, its tool or API calls, and transfers to destinations outside authorized data flows. Running it requires knowing what each agent is authorized to access.

Why are application-specific passwords an MFA risk?
App passwords are long-lived secrets for clients that can’t handle an MFA challenge, so whoever holds one skips the second factor. T1697 describes adversaries tricking users into creating them or collecting existing ones.

Why is ATT&CK v20 relevant to identity teams?
Several of its new techniques succeed because an identity, human or AI agent, holds more access than its task requires, or holds credentials outside MFA and review. Its new detections also depend on a baseline of approved access that identity teams are best placed to provide.