As AI adoption accelerates, we need to rethink how we view attacks against large language models. The conversation is too narrowly focused on “prompt injection” as a single vulnerability. A new paper introduces the concept of “promptware”—a multistage malware model for LLM-based systems—and outlines a seven-step promptware kill chain: initial access, privilege escalation (jailbreaking), reconnaissance, persistence, command & control, lateral movement, and actions on objective.
The key architectural challenge is that LLMs do not distinguish between trusted instructions and untrusted data. Malicious instructions embedded in emails, documents, calendar invites, images, or audio are processed alongside system commands. Once inside, attackers can jailbreak safety guardrails, map connected tools and data, establish persistence in memory, spread across enterprise systems, and ultimately execute real-world harm—from data exfiltration and fraud to arbitrary code execution.
Research has already demonstrated end-to-end attacks, including AI worms spreading through email assistants and malicious calendar invites that triggered unintended tool execution. The takeaway: prompt injection isn’t a bug we can simply patch.
We must assume initial access will occur and design layered defenses that break the kill chain—limiting privilege escalation, constraining tool access, preventing persistence, and restricting high-impact actions.
For security leaders, this reframing is critical. AI systems are not just chat interfaces—they are emerging execution environments. Treat them accordingly.
https://www.schneier.com/blog/archives/2026/02/the-promptware-kill-chain.html