What MITRE ATT&CK® v20 Means for Identity Teams Securing AI Agents

MITRE released ATT&CK v20 on October 13, 2026, and for the first time the Enterprise matrix includes techniques that target AI agents directly. Five of the nine new Enterprise techniques are AI-related. Almost every one of them succeeds or fails based on one question: what is this identity, human or agent, allowed to access?

What's new in MITRE ATT&CK v20?

ATT&CK v20 adds nine new Enterprise techniques and sub-techniques, nine ICS techniques, 15 new detection strategies and 38 analytics, according to MITRE's release post. The Enterprise additions are where identity and AI meet.

Two other changes matter for identity teams. T1195.001 (supply chain compromise of software dependencies and development tools) now includes IDE and coding agent configuration files. And MITRE added detection strategy DET0926 for suspicious acquisition and use of application-specific passwords.

Why is identity the real attack surface in ATT&CK v20?

Prompt injection gets the headlines, but injection only sets intent. What the attacker can actually do is set by the identity the AI agent runs as. An agent that can read one folder leaks one folder. An agent with a broad OAuth grant to your CRM, your data warehouse and your email leaks all three.

That is why we read v20 as an identity release. Look at how each new technique turns into damage:

• T1698 Indirect Prompt Injection makes the agent a confused deputy. It acts with its own legitimate credentials on an attacker's behalf, so the activity looks authorized.
• T1700 AI-Enabled Exfiltration needs no malware and no stolen password. The agent already holds the access. The exfiltration path is whatever the agent's tools and entitlements allow.
• T1697 Steal Application Specific Passwords is a reminder that MFA only protects the paths it covers. App passwords are standing credentials that often sit outside anyone's inventory.
• T1195.001 coding agent configs means an agent's configuration file, the place where its tools, servers and secrets are defined, is now a supply chain target.

The pattern is the same each time. The attack works because an identity has more access than its job needs, nobody owns it, or nobody is reviewing it. Those are governance failures, and governance is how you close them.

How should you govern AI agents after ATT&CK v20?

Treat every AI agent as an identity, not a feature. ATT&CK now describes agents as both a target and a tool for attackers, so they need the same lifecycle discipline we apply to employees, and then some.

In practice that means four things:

1. Inventory. Discover every agent, MCP server, copilot, service account and API key, including the ones engineers spun up last week. You cannot govern what you cannot see.
2. Ownership. Every agent maps to an accountable human. When that person changes roles or leaves, the agent's access is reviewed or revoked with theirs.
3. Least privilege, enforced at runtime. Scope an agent's tools and data to the task, and enforce it at the point of access, such as an MCP gateway, not only in a policy document. This is the control that shrinks T1700 from a breach to a blocked request.
4. Continuous review. Agent entitlements drift faster than human ones. Quarterly access reviews were built for people. Agents need reviews triggered by change: a new tool, a new data source, a new scope.

At Linx, this is why we govern human, non-human and agentic AI identities on one platform. The same graph that tells you a contractor still has production access should tell you an agent can read your customer database and send email.

Mapping ATT&CK v20 techniques to identity governance controls

Each new technique has an identity control that limits what it can achieve. Use this table as a starting checklist for your detection and identity governance teams.

What should CISOs do in the next 30 days?

Start with visibility, then shrink the blast radius. Five steps most teams can finish this quarter:

• Inventory every AI agent, copilot, MCP server and coding agent in use, sanctioned or not.
• Assign a named human owner to each agent and each non-human identity.
• Map each agent's entitlements against its actual task, and remove what it does not use.
• Find and expire application-specific passwords and other credentials that bypass MFA.
• Add ATT&CK v20 technique IDs (T1696 to T1700, T1608.007, T1685.007) to your detection backlog and your next tabletop exercise.

MITRE moved AI agents into the core enterprise matrix. The teams that treat agents as identities, with owners, scopes and reviews, will be the ones who can adopt AI quickly and safely. That is the work we do with our customers every day at Linx Security.

Frequently asked questions

What is MITRE ATT&CK v20?

MITRE ATT&CK v20 is the October 2026 release of MITRE's adversary tactics and techniques knowledge base, and it is the first version to add Enterprise techniques that target AI systems and AI agents directly. The release adds nine new Enterprise techniques and sub-techniques, 15 new detection strategies and 38 analytics.

What AI techniques were added in MITRE ATT&CK v20?

MITRE ATT&CK v20 added five AI-related Enterprise techniques: Direct Prompt Injection (T1699), Indirect Prompt Injection (T1698), AI-Enabled Exfiltration (T1700), Stage Capabilities: AI Result Poisoning (T1608.007) and Disable or Modify Tools: Impair Autonomous Defenses (T1685.007). Together they cover attacks that manipulate AI systems, abuse enterprise AI agents and degrade AI-assisted security tools.

Why does ATT&CK v20 make AI agents an identity problem?

ATT&CK v20 makes AI agents an identity problem because the damage from each new AI technique depends on what the agent's identity is allowed to access. Prompt injection sets the attacker's intent, but the agent's tokens, API keys, OAuth grants and tool permissions set the identity blast radius.

What is AI-Enabled Exfiltration (T1700)?

AI-Enabled Exfiltration (T1700) is an ATT&CK technique in which an attacker directs an organization's own AI agent to send sensitive data outside the organization. Because the agent uses access it already holds, the attack needs no malware or stolen password, which makes limiting the agent's entitlements the primary defense.

What is the difference between direct and indirect prompt injection?

Direct prompt injection (T1699) is when an attacker enters malicious instructions straight into an AI system's interface, while indirect prompt injection (T1698) is when those instructions are hidden in content the AI system reads, such as web pages, emails or documents. Indirect injection is harder to catch because the agent acts on the attacker's behalf with its own legitimate credentials, so the activity looks authorized.

How do application-specific passwords bypass MFA?

Application-specific passwords bypass MFA because they let older apps that cannot complete an MFA prompt sign in with a single static credential. ATT&CK v20 technique T1697 covers attackers phishing, generating or harvesting these passwords, and MITRE paired it with a new detection strategy, DET0926.