MITRE ATT&CK v20 Added 9 New Attack Techniques Covering AI Exploits, MFA Bypass, and CAPTCHA Evasion

MITRE released ATT&CK v20 on October 13, adding nine Enterprise techniques that describe how attackers may target AI systems, steal application-specific passwords to bypass multi-factor authentication (MFA), and get around CAPTCHA checks. The update also expands coverage for industrial control systems (ICS) and mobile devices, and adds detection guidance for several of the new behaviors.

For security teams, the changes offer a clearer way to map activity they already see across business networks, AI tools, phones, and industrial systems. MITRE’s release notes list the additions, and its detailed changelog records what changed from v19.2.

ATT&CK is a knowledge base that helps defenders describe and compare attacker behavior. A technique is a way an attacker may try to achieve a goal, while a detection strategy connects that behavior to data defenders can collect and review.

The framework does not confirm that a specific organization has been breached. Instead, it gives teams a shared language for threat reports, security testing, and detection planning.

MITRE ATT&CK v20 – Nine New Enterprise Techniques

Five of the new Enterprise techniques address the risks around AI systems. Direct Prompt Injection covers malicious instructions entered straight into a large language model’s interface. Indirect Prompt Injection describes instructions hidden in content an AI system reads, such as a web page, email, document, or code file.

If an AI agent can use tools or access business data, hostile content could try to steer its actions beyond what the user intended. The techniques help teams distinguish between a user submitting a malicious prompt and an AI system encountering one in outside content.

AI-Enabled Exfiltration describes attempts to get an enterprise AI agent to send data out of an organization. AI Result Poisoning covers a different route: manipulating public web content so AI search tools or assistants may return, cite, or recommend attacker-controlled information.

The fifth AI-related entry, Impair Autonomous Defenses, covers efforts to disrupt AI-assisted security analysis. For example, hostile content could try to make an automated tool ignore evidence or stop reviewing a file.

ATT&CK ID	Technique / Sub-Technique	Type	Description
T1697	Steal Application Specific Passwords	Technique	Attackers phish, generate, or steal application-specific passwords to access accounts without completing the usual MFA checks.
T1696	Anti-Automation Evasion	Technique	Attackers bypass checks designed to block bots, allowing automated activity to continue.
T1696.001	Automate CAPTCHA Completion	Sub-technique	Attackers use automated tools or CAPTCHA-solving services to complete challenges intended to verify human users.
T1696.002	Avoid CAPTCHA	Sub-technique	Attackers avoid triggering CAPTCHA challenges rather than solving them after they appear.
T1699	Direct Prompt Injection	Technique	Attackers submit malicious instructions directly to an AI system’s interface to influence its behavior.
T1698	Indirect Prompt Injection	Technique	Attackers place malicious instructions in outside content that an AI system processes, such as documents or web pages.
T1700	AI-Enabled Exfiltration	Technique	Attackers direct enterprise AI agents to send sensitive information outside the organization.
T1608.007	Stage Capabilities: AI Result Poisoning	Sub-technique	Attackers manipulate web content to influence the information, links, or recommendations returned by AI search tools and assistants.
T1685.007	Disable or Modify Tools: Impair Autonomous Defenses	Sub-technique	Attackers interfere with AI-assisted security tools to disrupt their analysis of malware or suspicious activity.

These entries reflect the growing use of AI systems that read outside content and can take actions through connected tools. That creates a link between prompt security and familiar security controls: the data and actions an AI agent can reach matter as much as the model itself.

Cyber Security News has covered prompt injection risks for AI agents and a reported case where a prompt could expose AWS AI agent data. Those reports describe separate incidents and research, but they illustrate why teams should limit agent permissions and monitor tool use.

Three more techniques address CAPTCHA and other anti-automation checks. ATT&CK now has a parent technique, Anti-Automation Evasion, with two sub-techniques: Automate CAPTCHA Completion and Avoid CAPTCHA.

The first covers tools or services that solve challenges. The second covers attempts to make automated activity look more like normal human browsing. CAPTCHA may slow down bots, but it is not a complete barrier when attackers can automate or outsource the challenge.

The ninth new Enterprise technique, Steal Application-Specific Passwords, concerns passwords created for older apps or devices that cannot use standard MFA. An attacker who obtains one may access an account without completing the usual second-factor check.

This is not the same as breaking MFA itself. Rather, it uses a separate credential path that may not prompt for the normal MFA step. Cyber Security News previously reported on Google app passwords being used to bypass MFA, showing why organizations should review where these passwords are allowed and who can create them.

The v20 changes extend beyond Enterprise. In ICS, MITRE added a Command and Scripting Interpreter technique and sub-techniques for PowerShell, Windows Command Shell, Unix Shell, Visual Basic, Python, and JavaScript.

These replace two older entries, making it possible to record the specific interpreter used. New sub-techniques also cover DNS and publish/subscribe protocols used for command and control. This matters in industrial environments, where defenders need to separate unusual activity from normal control and engineering work.

MITRE also added ICS detection strategies with platform and asset context, so teams can see whether a detection applies to a Windows workstation, network device, or embedded system.

The release notes say the update includes 15 new detection strategies and 38 analytics across the release. In ICS, analytics are designed to filter routine engineering and maintenance activity, helping reduce alerts that do not point to suspicious behavior.

No.	Domain	Detection Strategy	Detection Focus
1	Enterprise	Detect AI-Enabled Exfiltration	Identifying attempts to use enterprise AI agents to send sensitive data outside the organization.
2	Enterprise	Detection of AI Result Poisoning	Identifying manipulation of web content intended to influence AI-generated answers, citations, or recommendations.
3	Enterprise	Detection of Anti-Automation Evasion	Detecting attempts to bypass checks designed to distinguish human users from bots.
4	Enterprise	Detection of Automated CAPTCHA	Detecting automated completion of CAPTCHA challenges.
5	Enterprise	Detection of Avoid CAPTCHA	Detecting activity designed to avoid triggering CAPTCHA challenges.
6	Enterprise	Suspicious Acquisition and Use of Application-Specific Passwords	Identifying suspicious creation, acquisition, or use of application-specific passwords that can bypass normal MFA checks.
7	ICS	Behavioral Detection of Command and Scripting Abuse in ICS	Detecting suspicious use of command interpreters and scripting tools in industrial environments.
8	ICS	Behavioral Detection of DNS Protocol Misuse for Command and Control	Identifying misuse of DNS communications for attacker command and control.
9	ICS	Behavioral Detection of JavaScript Execution in ICS	Detecting suspicious JavaScript execution on industrial systems.
10	ICS	Behavioral Detection of PowerShell Execution in ICS	Detecting suspicious PowerShell execution on industrial systems.
11	ICS	Behavioral Detection of Publish/Subscribe Protocol Misuse for Command and Control	Identifying misuse of publish/subscribe messaging protocols for attacker communications.
12	ICS	Behavioral Detection of Python Execution in ICS	Detecting suspicious Python execution within industrial environments.
13	ICS	Behavioral Detection of Unix Shell Execution in ICS	Detecting suspicious Unix shell commands or scripts on industrial systems.
14	ICS	Behavioral Detection of Visual Basic Execution in ICS	Detecting suspicious Visual Basic execution within industrial environments.
15	ICS	Behavioral Detection of Windows Command Shell Execution in ICS	Detecting suspicious Windows command shell execution on industrial systems.

For mobile, v20 restores the technique Deliver Malicious Application via Other Means, which was last present in ATT&CK v11. The updated entry covers ways malicious apps can reach devices outside official stores, including direct downloads, text messages, messaging apps, QR codes, and third-party stores.

MITRE also added NGate, malware described as relaying payment card data through a phone’s tap-to-pay chip, and revised 28 existing mobile software entries.

The main value of v20 is not simply the number of new entries. It connects emerging AI risks and familiar access methods to the same framework defenders use to track malware, credentials, and activity in industrial networks. Teams can review whether their monitoring covers AI prompts and agent actions, check if application-specific passwords are still needed, and test how their services respond to automated CAPTCHA attempts.

The update also gives defenders a more detailed starting point for detection, but a framework entry is not a ready-made alert rule. Teams still need to check which logs and telemetry they have, tune detections to their own systems, and confirm that the activity being flagged is unusual for their environment.

Used that way, MITRE ATT&CK v20 can help security teams turn new threat patterns into practical questions for monitoring, access control, and incident response.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.