MITRE ATT&CK v20 catalogs AI abuse, MFA bypass and water utility attacks

SecurityWeek reports that MITRE’s ATT&CK v20 now tracks prompt injection, data theft using an organization’s own AI agents, and stolen passwords that can allow sign-ins without an MFA prompt. It also catalogs attacks on internet-exposed controllers at more than 30 Minnesota water and wastewater utilities. SecurityWeek says MITRE considers attribution for those intrusions unconfirmed.