October 20, 2026
When AI Becomes the Attack Surface
AI Security, Chapter 1 of 3: Understanding direct and indirect prompt injection through MITRE ATT&CK.
By Marcos Alcantara
3 min read
What happens when an AI assistant reads a document and starts following instructions hidden inside it?
For security teams deploying AI agents, that question deserves a place alongside the familiar ones about identities, vulnerabilities, and data access.
On October 13, MITRE released ATT&CK v20, expanding Enterprise coverage of AI-related adversary behavior. Two techniques worth understanding are Direct Prompt Injection (T1699) and Indirect Prompt Injection (T1698).
If you work with threat hunting, incident response, or detection engineering, the distinction matters.
Direct Prompt Injection: the attacker supplies the instruction
An attacker interacts directly with an AI application, attempting to override its instructions or make it perform an unauthorized action.
The potential impact depends heavily on what sits behind the application. A chatbot answering general questions has a different risk profile from an agent that can query internal systems, access files, or invoke enterprise APIs.
Once tools and permissions enter the picture, manipulating the model can have consequences beyond its response.
Indirect Prompt Injection: the instruction arrives inside the content
This is the scenario I find particularly interesting from a defender's perspective.
Imagine an employee asking an assistant to summarize a vendor proposal. The assistant retrieves the document, which contains attacker-controlled instructions attempting to redirect its next action.
The employee's request is legitimate. The document is relevant to the task. But part of its content is trying to become an instruction.
If the system follows that instruction, an attacker may influence an agent without ever interacting with it directly.
The same principle can apply to emails, web pages, repository files, and other material an assistant processes.
Caption: Illustrative simulation of indirect prompt injection. An agent reads a vendor proposal and treats embedded attacker-controlled text as an instruction to attempt an action outside the user's request. Successful execution or data transfer is not assumed.
Two entry points, one trust boundary
With direct injection, the attacker supplies the prompt to the application. With indirect injection, the attacker places instructions in content the application retrieves.
The delivery path changes what defenders need to observe. In both cases, the central concern is whether untrusted input can influence actions that require separate authorization.
Caption: Direct Prompt Injection (T1699) and Indirect Prompt Injection (T1698). Original explanatory comparison based on MITRE ATT&CK. The paths illustrate attempted misuse, not guaranteed compromise.
Valid credentials can still serve an attacker's objective
For those of us coming from SOC operations, there is a familiar concern here: an action can use valid credentials and still serve an attacker's objective.
An agent might authenticate successfully, access a resource within its permissions, and call an approved API. Those individual events may look routine. The reason behind the sequence may be anything but routine.
That is why I would look beyond authentication logs:
- What content did the agent consume?
- Which tool did it invoke afterward?
- Was the action consistent with the user's request?
- Did a separate authorization control permit the action, or was the model's interpretation enough?
These questions connect AI security directly to identity, application security, and detection engineering.
From technique definitions to operational questions
ATT&CK gives us a shared vocabulary for these behaviors. MITRE ATLAS complements that perspective with its focus on threats to AI-enabled systems.
Neither replaces the work of understanding our own environment and testing its trust boundaries.
The official entries below provide the definitions and metadata behind this chapter.
Caption: Direct Prompt Injection, T1699, technique version 1.0 in MITRE ATT&CK v20. Official page captured October 20, 2026. Source: MITRE ATT&CK. © The MITRE Corporation.
Caption: Indirect Prompt Injection, T1698, technique version 1.0 in MITRE ATT&CK v20. Official page captured October 20, 2026. Source: MITRE ATT&CK. © The MITRE Corporation.
My starting point is simple:
Content retrieved by an agent should not gain the authority to approve its next action.
If your organization is connecting agents to internal systems, can your team trace a sensitive action back to both the user's request and the content that influenced it?
In Chapter 2, I'll connect these mechanisms to threat intelligence on adversaries targeting AI coding assistants and developer workflows.
References
MITRE ATT&CK: Direct Prompt Injection, T1699
MITRE ATT&CK: Indirect Prompt Injection, T1698
Marcos Alcântara | Cybersecurity, Threat Intelligence & Detection Engineering