Analysis
Direct Prompt Injection, Technique T1699 - Enterprise | MITRE ATT&CK®
Publication date unknown · Discovered mitre.org
Page published
Publication date unknown · First observed: 15 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
MITRE ATT&CK's codification of Direct Prompt Injection as technique T1699 gives defenders a standardized reference, detection signals, and mitigations for an attack class now documented in real state-sponsored AI-orchestrated campaigns.
MITRE ATT&CK technique T1699 (Direct Prompt Injection) is a reference-catalog entry describing how adversaries input malicious prompts directly into an LLM's user interface to bypass safeguards, override instructions, or coerce unauthorized behavior. The entry cites real campaigns including the Anthropic AI-orchestrated cyber-espionage operation attributed to Chinese state-sponsored group GTG-1002 and an AI-assisted breach of Mexican government infrastructure abusing Claude Code, and lists mitigations such as execution prevention and privileged account management.