AI Governance Institute
← News
Standards2026-10-19

MITRE ATT&CK v20 Names Prompt Injection and AI Agent Abuse as Formal Threat Categories

What happened

MITRE released MITRE ATT&CK v20 on October 19, 2026, formalizing AI-specific attack techniques inside the world's most widely used adversary behavior catalog. New entries document prompt injection, a technique where attackers embed hidden instructions in content that an AI model then follows as if they were legitimate commands. The framework also catalogs how attackers can use AI agents to steal organizational data. It documents how public web content can be deliberately poisoned to manipulate AI-powered search results. ATT&CK v20 separately documents an AI-assisted breach of Mexican government operational technology systems that reached a municipal water utility. The release connects directly to a pattern of documented incidents. These include 51 AI agents that stole 628,000 Ukrainian records and AI agents executing all eight critical infrastructure attacks in Booz Allen lab tests.

Why it matters

  • ·Formalizing these techniques in ATT&CK means regulators, auditors, and insurers will increasingly expect organizations to demonstrate controls mapped against them. Teams relying on generic cybersecurity frameworks without AI-specific threat entries may face gaps during audits or incident investigations.
  • ·The water utility breach entry raises the stakes for operators of critical infrastructure who have deployed AI-assisted monitoring or analysis tools. Organizations in energy, water, and transportation sectors face heightened scrutiny if they cannot show their AI systems are isolated from control networks and protected against prompt injection.
  • ·The inclusion of AI agent abuse as a named attack class closes the argument that agentic AI risk is theoretical. Compliance programs that have not assessed this risk now have a named, documented threat. That threat covers AI agents turned against the organization or used by attackers to move data.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-002Agent Prompt Injection DefenseAGT-001Agent Permission BoundariesAGT-006Agent Action Audit TrailSAF-005Harmful Content FilteringAGT-023Agentic AI Security Assessment, CBRN and Cyber Espionage

What to do now

  • ☐Ask your security team to map your existing AI agent deployments against the new ATT&CK v20 AI technique entries, specifically the prompt injection and agent-as-attacker categories, and identify which controls address each.
  • ☐Review whether any AI tools used in your environment have access to operational technology systems or industrial control networks, and confirm those systems are isolated from AI agent traffic.
  • ☐Check whether your AI vendor contracts require notification if a vendor's model or agent infrastructure is used as an attack vector, and update language where that obligation is absent.
  • ☐Brief your incident response team on the ATT&CK v20 water utility case as a scenario for tabletop exercises, particularly if your organization operates or supplies critical infrastructure.
  • ☐Update your AI risk register to include prompt injection and AI agent abuse as named threat categories, with reference to ATT&CK v20, so auditors and insurers can see the assessment is grounded in a recognized standard.

What to watch next

Security regulators and sector-specific bodies are increasingly referencing ATT&CK as a baseline for control expectations, and the addition of AI-specific entries is likely to accelerate that trend. Organizations in regulated sectors, particularly finance and critical infrastructure, should watch for supervisory guidance that cites ATT&CK v20 AI techniques as a control-mapping requirement. The EU AI Act and sector AI rules are likely reference points for enforcement bodies framing post-incident inquiries around whether known attack techniques were addressed. Pending guidance from bodies such as CISA and the EU AI Office on agentic AI security may incorporate the new taxonomy directly.

Related Coverage

Research2026-11-05

Guardrails Alone Cannot Stop Agent Manipulation, SysArt Guide Warns

SysArt published a practitioner guide on AI agent security threats and recommended controls. The guide argues that relying on AI safety filters is insufficient to prevent agents from being manipulated into harmful actions. It recommends structural controls including unique agent identities, time-limited task-scoped credentials, restricted tool lists, environmental isolation, human approval gates for high-impact actions, and continuous adversarial testing.

Research2026-10-31

CrowdStrike Taxonomy Exposes Agent Planning Layer as an Untested Attack Surface

CrowdStrike published new research classifying prompt injection techniques that target the planning behavior of autonomous AI agents, not just their initial inputs or final outputs. The research shows that attackers can manipulate the intermediate decisions agents make while executing tasks. Enterprises that have tested only input and output layers may have a significant assurance gap in deployed agent systems.

Research2026-11-02

Live Invoice Fraud Campaign Hides Commands That Hijack Email AI Agents

Security vendor Sublime Security documented an active invoice fraud campaign embedding hidden instructions inside emails using invisible Unicode characters. The technique targets AI agents that read and act on email, redirecting them to follow attacker commands instead of legitimate user instructions. Enterprises running AI-connected email workflows face immediate prompt injection and financial fraud risk.