MITRE ATT&CK v20 Adds Nine Techniques for AI Exploits and MFA Bypass
The new framework version covers prompt injection, autonomous defense impairment, and CAPTCHA evasion methods for enterprise security teams.
Key points
- MITRE released ATT&CK v20 on October 13, introducing nine new Enterprise techniques.
- Five additions address AI risks, including prompt injection and data exfiltration via agents.
- Updates also cover stealing application passwords to bypass MFA and evading CAPTCHA checks.
MITRE released version 20 of its ATT&CK framework on October 13, adding nine new techniques for the Enterprise matrix. This update expands the knowledge base to include specific methods attackers might use to exploit artificial intelligence systems, bypass multi-factor authentication, and circumvent automated bot detection measures.
The release introduces five distinct techniques focused on AI vulnerabilities, alongside methods for stealing application-specific passwords to bypass MFA and evading CAPTCHA protections. According to Cyber Security News, the update also broadens coverage for industrial control systems and mobile devices while providing detection guidance for these new behaviors to help security teams map observed activities.
New Attack Patterns
The framework adds Direct Prompt Injection, covering malicious instructions entered directly into a large language model interface. Indirect Prompt Injection describes hostile commands hidden in content an AI system processes, such as emails, web pages, or code files. These entries help defenders distinguish between user-submitted prompts and malicious content encountered by the system during automated processing.
AI-Enabled Exfiltration addresses attempts to trick enterprise AI agents into sending data outside the organization. AI Result Poisoning covers manipulating public web content so that AI search tools or assistants return attacker-controlled information. The fifth AI entry, Impair Autonomous Defenses, details efforts to disrupt AI-assisted security analysis by causing automated tools to ignore evidence or stop reviewing files.
Impact on Security Operations
These additions reflect the growing integration of AI systems that read
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe
- Sudden role changes in output signal a successful override of system instructions.
- Hidden metadata in images or documents often carries invisible injection payloads.
- Immediate isolation of the affected session prevents lateral movement within the AI workflow.
Prompt injections exploit the model’s ability to follow instructions by hiding malicious commands in input data. Isolate affected sessions immediately and implement external guardrails to filter inputs before they reach the model.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
