What ATT&CK v20 means for AI agents (and where MoorAI maps)

MITRE released ATT&CK v20 on 13 October 2026. For teams that run AI coding agents, copilots and agent services, the agent is the subject of Enterprise techniques, not only a tool the adversary uses on its own side. This post covers what v20 changed for agents, how MoorAI’s rules map to it, and where that mapping stops.

What v20 changed for agents

Of the seven new Enterprise techniques and sub-techniques in the v20 release notes, five concern AI systems:

T1699 Direct Prompt Injection (Execution). Malicious prompts entered straight into an LLM’s interface to bypass safeguards, override instructions or misuse the system’s capabilities. See direct prompt injection.
T1698 Indirect Prompt Injection (Execution). Prompts embedded in web pages, documents, emails, tickets or code that an agent, copilot or other AI system later retrieves and processes. See indirect prompt injection.
T1700 AI-Enabled Exfiltration (Exfiltration). An injected prompt, direct or indirect, makes an enterprise agent use its own sanctioned tool connections to move data out.
T1685.007 Impair Autonomous Defenses (Defense Impairment). Content planted in malware or artefacts to make an LLM-assisted analysis pipeline abort, truncate or ignore what it is looking at.
T1608.007 AI Result Poisoning (Resource Development). Public web content staged so that AI search and retrieval systems cite or recommend attacker-controlled sites, downloads or claims.

The other two are T1696 Anti-Automation Evasion (CAPTCHA completion and avoidance, with AI solvers named as one method) and T1697 Steal Application Specific Passwords.

The one Enterprise technique with a major version change is T1195.001 Compromise Software Dependencies and Development Tools (v1.3 to v2.0). Its description covers the configuration and instruction files that IDEs and AI coding agents consume: project task files that run commands when a project opens, and agent skill files (SKILL.md) that an agent loads on demand and runs with its own permissions. Because these artefacts are natural language or configuration, MITRE notes, they can pass signature-based scanning (T1195.001).

v20 builds on AI-related entries added earlier in 2026, including Query Public AI Services (T1682), Generate Content (T1683) and Invisible Unicode (T1027.018). It also carries v19’s split of Defense Evasion into the Stealth and Defense Impairment tactics, so a mapping that cites Impair Defenses (T1562) points at a revoked technique: Disable or Modify Tools (T1562.001) is T1685, and Disable or Modify System Firewall (T1562.004) is T1686.

Technique ids and names here come from MITRE’s v20 STIX bundle.

The mapping, in numbers

Each of MoorAI’s 80 threat rules (data/threats.json) carries OWASP LLM Top 10, MITRE ATLAS, OWASP Agentic, OWASP MCP and ATT&CK v20 fields. The attack field lists zero or more v20 technique ids, each with a coverage level and a one-line reason:

Full: a shipped mechanism addresses the technique as an AI agent MoorAI watches performs it.
Partial: a shipped mechanism addresses part of it, and the reason states the bound.
None: the technique corresponds to the threat, but MoorAI ships no runtime mechanism for it.

Coverage is a mechanism claim, not a detection rate.

MoorAI rules against ATT&CK v20

47 / 80rules with an ATT&CK credit33 state why they have none

75credits3 full, 57 partial, 15 none

49distinct v20 techniques creditedfrom the v20 STIX bundle

2 / 71in-scope techniques covered37 partial, 32 uncovered

The 33 unmapped rules are mostly data classes, governance and model-error risks: a person pasting customer data into an AI tool, a hallucinated citation, a biased output. ATT&CK describes adversary behaviour, and those are not. Agent memory poisoning and sub-agent delegation are also unmapped: ATT&CK v20 has no technique for either, while ATLAS does (AML.T0080 and AML.T0118). The ATLAS side is in Every AI agent boundary, mapped to MITRE ATLAS.

Coverage, lane by lane

To measure coverage, we listed the 71 v20 techniques that an AI agent on an endpoint, server or AI runtime can perform or be aimed at, and sorted them by who can see them. 58 are in the agent lane: actions an agent takes that a MoorAI hook, model proxy or gateway sees. The other 13 are identity, email, endpoint or adversary-infrastructure techniques. The per-technique table is in docs/BENCHMARK.md.

Lane	Techniques	Covered	Partial	Uncovered
Agent	58	2	36	20
Outside the agent lane	13	0	1	12
All in scope	71	2	37	32

Covered

T1699 and T1698. MoorAI’s injection detectors run on what is typed to the model and on what comes back into the agent: fetched pages, files, command output, MCP results and sub-agent reports.

Partial, and why

T1700 AI-Enabled Exfiltration

Four mechanisms, each bounded. Send-message tools, SMTP, SendGrid, Twilio and chat-webhook calls are held for human approval. A local secret value appearing verbatim in an outbound command, MCP argument or prompt is caught; other data is not fingerprinted. Data carried in the URL of a rendered markdown image or link preview is caught. A session check raises an alert when an outbound action follows an injection finding on ingested content within 30 minutes, and reports only by default.

T1195.001 Compromise Software Dependencies and Development Tools

Auto-loaded agent config and skill files (SKILL.md, rules, .mcp.json, hooks) are scanned for directives and drift, MCP servers are bounded by an allow-list and a first-launch reputation check, and package names are checked at install time. IDE auto-run task files such as .vscode/tasks.json are not on the skill surface, and a novel malicious package with a clean name passes.

T1608.007 AI Result Poisoning

Only the cloaking form is detected: blocks addressed to AI readers that contradict the visible page, when an agent MoorAI watches fetches it. Plain fabricated content and AI search engines are out of reach.

T1685.007 Impair Autonomous Defenses

Ingested content telling the agent to stop analysing or to mark a sample safe is flagged, only when the analysing agent runs under MoorAI.

T1490 Inhibit System Recovery

The destructive-command rule matches deletion of shadow copies, boot recovery, Windows Server Backup, Time Machine, APFS, ZFS, ESXi and cloud snapshots or recovery points through the agent’s shell. Stopping a backup service is not matched.

T1027.018 Invisible Unicode

Zero-width, bidi, Unicode tag-block and variation-selector runs are found in text an agent reads, receives or writes. Files the agent never touches are not scanned.

Uncovered, in the agent lane

20 techniques, each an action that passes a MoorAI hook, proxy or gateway:

clearing or disabling shell history (T1070.003, T1690);
SSH authorized-key persistence and sudo abuse (T1098.004, T1548.003);
cron, launch agent and shell rc persistence (T1053.003, T1543.001, T1546.004);
command obfuscation (T1027.010);
credentials from browsers, shell history and the cloud instance metadata API, and stolen application access tokens (T1555.003, T1552.003, T1552.005, T1528);
uploads to code repositories, cloud storage and paste sites (T1567.001, T1567.002, T1567.003);
commands through a container CLI or API (T1059.013), poisoned CI pipelines (T1677) and IDE extension installs (T1176.002);
proxy-and-CA transit interception (T1557, T1553.004).

18 of them have no rule. The last two do: transit interception is decided by a function that is built and unit-tested but not called by a shipped hook, so it is credited as none.

Outside the agent lane

Account takeover at an AI provider (T1078.004), application-specific passwords (T1697), LLMjacking from stolen keys (T1496.004), phishing and voice lures (T1566, T1566.004), impersonation (T1684.001), third-party browser extensions (T1176.001), CAPTCHA evasion (T1696) and the adversary’s own use of AI (T1682, T1683, T1588.007) belong to identity, email and endpoint tooling, or happen on the adversary’s own infrastructure. The one partial is Financial Theft (T1657): MoorAI coaches when payment or bank-detail change wording reaches an AI tool, with no sender or identity check.

How a SOC can use the mapping

Every MoorAI finding names the rule that fired by its threat id: the #39 in a coaching message, threatId in MoorAI’s alerts. Findings stay content-free: a category, a risk level and a keyed hash, never the prompt or the matched text. That makes the threat id the join key.

1. Build a lookup table from data/threats.json: each rule’s id to its attack credits (id, coverage, reason). Rules with no credit carry an attackNote instead.
2. Enrich alerts at ingest by joining on the threat id. In MoorAI alerts the rule is threatId; in the console’s SIEM export (schema 6) the same value is the CEF header Signature ID and the ECS field rule.id; OpenTelemetry carries it as moorai.threat_id. The SIEM event carries owasp, atlas (CEF cs2, the rule’s primary ATLAS technique) and atlasAll (CEF cs6, every ATLAS id the rule credits), but not ATT&CK, so the join to attack happens on your side. A rule with several credits names several techniques; treat them as candidates, not one verdict.
3. Weight by coverage. A partial credit means the alert fired on the bounded part of the technique that the reason describes. A none credit never fires, so it marks a gap to cover elsewhere.
4. Put the gaps on the detection backlog of the tools that can see them: EDR for the uncovered endpoint actions in the agent lane, identity and mail tooling for the techniques outside it.

The lane split matters more than the totals. ATT&CK v20 names what agents do. Whether you can see it depends on whether something sits where the agent acts.

Free tools and resources

data/threats.json. All 80 rules with their ATT&CK v20 credits and reasons, under the MIT licence, ready to load as a lookup table.
Threat catalog. The same rules with their OWASP LLM Top 10, MITRE ATLAS and STRIDE mappings.
ATLAS agentic-technique coverage. Which products document which ATLAS agentic technique, with each stated limit.
Agentic Security Benchmark. An open corpus for testing agent security.
Glossary. Including prompt injection, data exfiltration and action layer.

Sources

ATT&CK v20. ATT&CK updates, MITRE; attack-stix-data v20.0, MITRE, October 13, 2026.
T1195.001. Compromise Software Dependencies and Development Tools, MITRE ATT&CK.
MoorAI. data/threats.json, docs/BENCHMARK.md and the README section “MITRE ATT&CK v20” in MoorAI on GitHub.