Prompt Injection Now Has ATT&CK IDs: T1698, T1699, T1700

What did MITRE add in ATT&CK v20?

ATT&CK is MITRE's catalog of how attackers behave, used by security teams to name what they see. The v20 release notes list the new AI entries below. SecurityWeek reported on October 19 that the release also adds 15 detection strategies (6 Enterprise, 9 ICS) backed by 38 analytics.

Checked on MITRE's pages on October 24, 2026. The first three are version 1.0 and list SaaS and Windows as platforms.

What does each ID mean for an app with an AI feature?

MITRE writes for organizations defending their own AI agents. If you ship an app with a chat or assistant feature, you are the one running that agent, so the same three steps apply to your request path.

T1699: the person using the app is the source

MITRE describes input typed straight into the model's interface to bypass safeguards or force behavior you did not intend. Its mitigation text says to prevent user-supplied prompts from directly authorizing consequential actions, and to tie interactions to authenticated identities. In your app, that means the model should never be the thing that decides whether a user may do something.

T1698: the content the model reads is the source

Here the instructions sit in web pages, documents, emails, tickets or code that the model retrieves later. The user never typed them. MITRE lists independent authorization for requests that come from content, dedicated agent identities with minimal permissions, and limited network access for agents that read untrusted content. The inbox assistant page and the web form to CRM case show what this looks like in practice.

T1700: the way out is the source

T1700 covers an injected agent using its tool connections to move data out. MITRE notes that other exfiltration techniques then apply to the transfer itself. A chat window that renders images from model output is a small example; the advisory for CVE-2026-22551 describes it in an AI chat product, fixed in version 1.71.0. Our page on the content security policy fix covers the setting.

Which of these IDs come with a MITRE detection?

At our check on October 24, 2026, MITRE's detection strategies list has none for T1698 or T1699. It has DET0927 for T1700 and DET0922 for AI Result Poisoning.

The IDs are most useful as shared words. When you write an incident note, a ticket or a message to a client or an agency partner, "a T1698 path reached the support-ticket tool" says where the injected text came from and which step to fix. It also lets you search other people's reports for the same label. Use them for naming, and keep the evidence next to the label: the log line, the tool call and the date.

T1608.007 is different. It happens on the public web, before any of your code runs, and MITRE says a defender cannot reliably tell it from ordinary publishing. If your AI feature browses or searches, the practical control is the same as for T1698: treat what it reads as untrusted and keep its permissions small.

What should you check in your own app this week?

OWASP's LLM01:2026 Prompt Injection covers direct and indirect injection in one entry and lists controls such as holding credentials in application code and requiring human confirmation before privileged or irreversible actions. OpenAI's agent safety guide adds structured outputs between steps, so there is no free-text channel to abuse. CISA's May 2026 agentic AI guide says to avoid broad or unrestricted access to sensitive data. Turned into five checks:

1. List the inputs. Search your server code for every call to the model and write down where its text comes from. Anything that is not the signed-in user's own message is T1698 territory.
2. List the tools. For each one, find which credential it uses. A service key that can read every user's rows lets one injected request reach all of them. Call each tool as a second test account.
3. Find the exits. Any tool that fetches a URL, sends an email or message, writes to a repository or renders a remote image is a T1700 route. Restrict it to hosts you name.
4. Search your env files for EXPO_PUBLIC_. Expo's docs state that these values are visible in plain text in the compiled app. A provider key there lets anyone call the model without your prompt, your limits or your logs, and AI inside a Newly app uses credits.
5. Add the log fields from the table above and read one day of them. Look for tool calls to hosts you did not expect.

The wider list, including a hands-on chat test, is in the 15-minute chatbot self-test, and the pre-launch review puts it next to the other checks. If your tools are MCP servers, use the MCP authorization checklist. The overview is Is my AI-built app secure?

Where do you stand?

Every item starts as unknown. Move one to confirmed only when you hold the evidence listed under it. A scan from outside cannot move any of these for you, because the model's behavior and your server logs are not visible from a public request.

Frequently asked questions

Sources

All sources were opened on October 24, 2026. Back to the security hub.

1. ATT&CK v20 release notes, October 13, 2026, MITRE ATT&CK
2. T1698 Indirect Prompt Injection, MITRE ATT&CK
3. T1699 Direct Prompt Injection, MITRE ATT&CK
4. T1700 AI-Enabled Exfiltration, MITRE ATT&CK
5. T1608.007 Stage Capabilities: AI Result Poisoning, MITRE ATT&CK
6. DET0927 Detect AI-Enabled Exfiltration, MITRE ATT&CK
7. DET0922 Detection of AI Result Poisoning, MITRE ATT&CK
8. ATT&CK detection strategies list, MITRE ATT&CK
9. MITRE ATT&CK v20 catalogs AI abuse, October 19, 2026, SecurityWeek
10. OWASP Top 10 for LLM Applications 2026, OWASP GenAI Security Project
11. LLM01:2026 Prompt Injection, OWASP GenAI Security Project
12. Safety in building agents, OpenAI developer docs
13. Careful Adoption of Agentic AI Services, May 1, 2026, CISA
14. GHSA-qwjm-9c66-w4q4 (CVE-2026-22551), markdown image exfiltration, GitHub Advisory Database
15. Environment variables in Expo, Expo docs