Topic starter
11/11/2026 6:04 pm
TL;DR: Promptware attacks move through multiple stages beyond prompt injection, with Preamble showing that static scanners mainly test the first two. Practitioners need red teaming that follows tool use, memory persistence, and downstream impact, not just unsafe text outputs.
Editorial analysis by NHI Mgmt Group, based on content published by Preamble: “Exploiting Along the Promptware Kill Chain: AI Red Teaming”.
Key questions
Q: Why does excessive agency in an AI system create such a broad security risk?
A: Excessive agency is risky because it expands what the model can do, not just what it can say.
Q: What is the difference between prompt injection and jailbreaking in AI security?
A: Jailbreaking targets the model’s safety rules and tries to make it produce disallowed content.
Q: How do prompt injections affect agentic workflows?
A: Prompt injection can manipulate an AI agent’s instructions so it follows attacker-supplied text instead of its intended policy, which can lead it to call tools or export outputs with unauthorised data.
Practitioner guidance
- Map agent permissions to actual business impact Inventory every tool, API, data source, and execution path an agent can reach, then classify the business consequence if each one is misused.
- Replace static jailbreak corpora with kill-chain scenarios Build red team cases that cover initial access, escalation, persistence, retrieval-based command and control, and actions on objective.
- Treat retrieval and memory as hostile input surfaces Sanitise documents, web content, and vector-store entries before they can influence downstream decisions or survive across sessions.
Bottom line: Promptware shows that AI red teaming must assess multi-stage attack paths, not just whether a model produces unsafe text.
Glossary terms: Prompt Injection (Agentic), Jailbreak, Excessive agency, Retrieval-augmented Generation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Static prompt testing is the wrong control plane for agentic AI. A scanner that only checks whether an assistant will say something unsafe tells you little about whether it will misuse tools, modify records, or persist malicious state. The deeper issue is that the attack surface now includes execution context, not just model output. Practitioners should treat prompt libraries as a narrow input test, not as a complete red team result.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Look for a legitimate-looking tool call, process spawn, identity use or outbound connection that appears normal in isolation but fits an unusual sequence, scope or rate for that agent. The visible event is the clue that earlier silent stages may already have shaped the task.
👉 Read our full editorial: Promptware exposes why static AI red teaming misses agentic attacks