Prompt injection is no longer a single trick: against agents with memory, tools and network access it now behaves like multi-stage malware, with persistence, command and control and lateral movement. In early 2026 Oleg Brodt, Elad Feldman, Bruce Schneier and Ben Nassi named this class "promptware" and proposed a seven-stage kill chain for it, and in March 2026 Johann Rehberger showed a proof-of-concept command and control server that enrolled hijacked agents from three platforms. This guide explains each stage, what an attacker gains there and the control that breaks the chain at that point, then covers detection, metrics and response. It is for security architects, detection engineers and teams who run AI agents with tools, and it assumes the basics in our Prompt Injection Guide.
Key takeaways
- Assume initial access will succeed. The researchers argue injection is architectural, because the model cannot reliably separate instructions from data, so defence must also sit at the later stages.
- Persistence turns an incident into an infection. Poisoned memory, retrieval stores, heartbeat files and scheduled tasks let one payload run again and again without the attacker returning.
- Agentic C2 uses the agent's own tools. No binary is dropped: the agent fetches and follows natural-language tasks over its normal web access, which the Cloud Security Alliance calls living off agents.
- The lethal trifecta decides impact. An agent that reads untrusted input, can reach sensitive data and can communicate externally is an info-stealer waiting for a payload; remove one leg wherever you can.
- Controls belong outside the model. Egress allow-lists, integrity monitoring of agent configuration and memory, and human confirmation enforced by the system are the breaks that do not depend on the model saying no.
What promptware is
The paper defines promptware as any input, in any modality, provided to an application built on a large language model (LLM) to trigger malicious activity by exploiting the application's permissions. The term deliberately moves the discussion from "a bad prompt" to "malware whose code is natural language". Like conventional malware it has a delivery path, an execution environment (the agent's context window and tools), privileges (the agent's identity and integrations) and objectives.
The authors reviewed 36 studies and real-world incidents published between February 2023 and January 2026. Their abstract reports at least 21 attacks that pass through four or more stages; the counts inside the paper differ slightly between sections, and no attack in the set covered all seven stages, the highest being five. The point stands either way: multi-stage promptware has been demonstrated repeatedly, mostly by researchers, against mainstream assistants and agent platforms.
| Property | Conventional malware | Promptware |
|---|---|---|
| Code | Binary or script | Natural language, in text, images or audio |
| Execution | Operating system process | Model inference plus the agent's tool calls |
| Privileges | User or system account it runs as | The agent's identity, tokens and integrations |
| Persistence | Registry keys, services, scheduled tasks | Memory, retrieval stores, agent configuration and schedules |
| Reliability | Deterministic once delivered | Probabilistic: varies by model, context and run |
| Main detection layer | Endpoint and network tooling | Agent-layer logs of prompts, retrieval and tool calls |
The model adapts the Lockheed Martin Cyber Kill Chain idea that defenders win by breaking any link. See the Cyber Kill Chain and Diamond Model Guide for the original.
The seven stages
The version 2 paper (arXiv 2601.09625, dated 10 February 2026) lists the stages below. Reconnaissance is optional, and command and control requires persistence plus access to untrusted internet data.
| Stage | What happens | Typical vehicle | MITRE ATLAS |
|---|---|---|---|
| 1. Initial Access | Attacker instructions enter the context window, directly or through poisoned content, including images and audio | Email, calendar invite, web page, document, support ticket, tool output | AML.T0051.001, AML.T0093 |
| 2. Privilege Escalation | Jailbreaking bypasses safety training so the model performs actions it would refuse | Role play, obfuscation, delayed tool invocation | AML.T0054, AML.T0068 |
| 3. Reconnaissance | The payload asks the model about its files, agents, persistence channels and triggerable actions | Questions embedded in the payload | AML.T0084, AML.T0056 |
| 4. Persistence | The payload survives the session: retrieval-dependent (resurfaces when retrieved) or retrieval-independent (long-term memory, runs every time) | RAG stores, agent memory, heartbeat and configuration files, scheduled tasks | AML.T0080.000, AML.T0070, AML.T0081 |
| 5. Command and Control | The agent repeatedly fetches new instructions from an attacker-controlled source | A web page, repository or file the agent is told to check | AML.T0108, AML.T0096 |
| 6. Lateral Movement | Spread across agents, applications, users or devices: self-replicating, permission-based or pipeline-based | Outbound email, shared documents, synced tickets, connected apps | AML.T0061 |
| 7. Actions on Objective | Data theft, phishing, financial loss, physical effects or remote code execution | The agent's own tools | AML.T0053, AML.T0086, AML.T0101 |
The paper's examples show how stages combine. Morris II (2024) spread through LLM email assistants using retrieval-dependent persistence and self-replication. "Invitation Is All You Need" (Nassi and colleagues, 2025) used a poisoned Google Calendar invite against the Gemini-powered assistant, with delayed tool invocation and movement into other apps and smart-home devices. Rehberger's SpAIware (2024) implanted a ChatGPT memory that pulled instructions from a GitHub repository, an early C2 channel. AgentFlayer moved a poisoned support ticket through a Jira sync into an AI coding tool that harvested credentials.
Agentic command and control
C2 is where promptware stops being a one-off. In Rehberger's Agent Commander research (Embrace The Red, 16 March 2026) compromised agents checked in with an attacker server for tasks written in natural language. He reported compromising Kimi Claw through a document it was asked to analyse, OpenClaw through an email with no human action when proactive email notifications were configured, and NanoClaw through a visited website. Persistence came from features the agents trust: a periodic heartbeat file in one, a recurring scheduled task in another, and writable memory, identity or configuration files. He did not publish the tool.
Three properties make agentic C2 hard to see with existing tooling:
- No malware binary: tasking travels over the agent's normal web or API calls, so endpoint detection sees a legitimate agent process doing legitimate-looking requests. ATLAS records this as AML.T0108 AI Agent under the Command and Control tactic; the closest ATT&CK analogue is T1102.002 Web Service: Bidirectional Communication.
- Probabilistic execution: the same payload works sometimes and not others, which weakens signature-style detection.
- Cheap background models: heartbeat and scheduled tasks often run on smaller models; Rehberger observed these were easier to inject, and the CSA note recommends the same model tier for background and interactive work.
The CSA note adds that for an agent with shell, file and network access, compromising the agent is effectively compromising the host.
Breaking the chain: controls by stage
| Stage | Control that breaks it | Notes |
|---|---|---|
| Initial Access | Reduce untrusted inputs; sanitiser classifiers; plan-then-execute so injected content cannot add tools; instruction-data separation | The paper calls sanitisers probabilistic: useful, never sufficient |
| Privilege Escalation | Models with instruction hierarchy and adversarial training; never rely on refusals for safety | Mostly the model provider's control; choose and pin models deliberately |
| Reconnaissance | Keep system prompts, tool lists and credentials out of answers to content-derived requests; alert on such requests | Cheap and early signal |
| Persistence | Separate, authorised write path for memory; integrity monitoring of memory, skills, heartbeat and scheduled-task files; provenance on RAG documents | ATLAS mitigation AML.M0031 Memory Hardening |
| Command and Control | Egress allow-list for agent traffic through a logging proxy; block agent-initiated fetches of instructions from new domains or repositories | The single most effective structural break for C2 |
| Lateral Movement | Least capability per agent; no outbound email or sharing where not needed; separate identities per agent and per integration | Limits worm-style and pipeline spread |
| Actions on Objective | Human confirmation enforced outside the model for code execution, data transfer, credential use, payments and messages; scoped, rotatable credentials | Limits blast radius when everything else fails |
Where identity fits
Every promptware objective is achieved with the agent's own permissions. Give each agent its own non-human identity, scope its tokens to the task, keep secrets out of files the agent can read or write, and make credentials automatically rotatable so response is fast. The AgentFlayer and SpAIware cases both end in credential or data access the agent already had. See the Agent Identity and Access Guide and How to Find Secrets in AI Agent Transcripts and Traces.
Decision guidance
- Assistants that only read: focus on the lethal trifecta. If the agent reads untrusted content and sees sensitive data, remove external communication (no link rendering, no web fetch, no outbound mail) and the exfiltration path closes.
- Autonomous or always-on agents: heartbeat, scheduled and email-triggered agents are the natural home for C2. Run them on isolated hosts under non-root accounts with their own mailboxes, restrict egress and monitor their configuration files.
- Coding agents and computer-use agents: shell access makes actions on objective equal to remote code execution. Sandbox, block network by default and require approval for commands outside an allow-list.
- Multi-agent systems: lateral movement between agents is the main extra risk; treat each agent as a separate principal and inter-agent messages as untrusted. See the Agent Session Smuggling Guide.
- Small organisations: start with the two structural breaks, egress control and confirmation gates. Large organisations add central logging of prompts and tool calls, configuration integrity monitoring and red-team exercises per agent platform.
How to implement
- Inventory agents and triggers: list every agent, where it runs, its model, tools, data access, outbound paths and every trigger (user chat, email, calendar, schedule, heartbeat, webhook).
- Score the trifecta: for each agent record untrusted input, sensitive data and external communication; prioritise agents with all three.
- Log before you block: capture prompts, retrieved content identifiers, tool calls with parameters, outbound requests and writes to memory or configuration, in a store the agent cannot modify.
- Put egress in report mode: route agent traffic through a proxy, learn normal destinations for two to four weeks, then enforce an allow-list. Keep the report-only policy ready as the rollback.
- Protect persistence locations: hash and monitor heartbeat, scheduled-task, skill and configuration files; make memory writes require a separate tool with its own policy.
- Add confirmation gates: enforce approval at the system level for high-consequence tools, pilot with one team and tune to avoid approval fatigue.
- Red-team each stage: test injection through each trigger, then check which later stage stopped it. Repeat after any model, prompt or platform update.
Detection and measurement
| Signal | Stage |
|---|---|
| Instruction-like text in emails, invites, tickets or pages processed by an agent | Initial Access |
| Agent output or tool calls that reveal its tools, files or system prompt in response to content | Reconnaissance |
| Changes to memory, heartbeat, scheduled-task, skill or configuration files outside a change process | Persistence |
| Periodic agent requests to the same new external URL or repository, especially from background runs | Command and Control |
| Agent sending messages or sharing content to many recipients, or content that repeats the inbound payload | Lateral Movement |
| Data volume to new destinations; credential use outside the agent's normal pattern; suppressed output from background runs | Actions on Objective |
Metrics:
- Share of agents with all three trifecta legs, trending down.
- Share of agent outbound traffic going through an enforced allow-list.
- Share of persistence locations (memory, configuration, schedules) under integrity monitoring.
- Share of high-consequence tools behind system-enforced confirmation.
- Red-team chains stopped by stage, and the median stage reached.
- Time to disable an agent and rotate its credentials after detection.
Responding to a promptware infection
Use the kill switch first: disable the agent and its triggers, then revoke and rotate its credentials. Preserve prompts, reasoning and tool logs, the retrieved content that delivered the payload, and copies of memory and configuration files before cleaning. Search every memory store, RAG index, mailbox and shared document the agent could write to for the payload, since persistence and lateral movement may have copied it. Block the C2 destination at the proxy, restore clean configuration from source control and re-enable in stages with heightened logging. See the Prompt Injection Incident Response Playbook and the AI Agent Memory Poisoning Response Playbook.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATLAS | AML.TA0014 Command and Control; AML.T0108; AML.T0096; AML.T0080.000; AML.T0061; AML.M0031 | Agent C2, memory persistence, self-replication, memory hardening |
| MITRE ATT&CK v20 | T1102.002; T1071.001; T1053 | Analogues for web-service C2 and scheduled-task persistence |
| OWASP Top 10 for Agentic Applications | ASI01, ASI06, ASI07 (as mapped by the CSA note) | Goal hijack, memory poisoning, inter-agent communication |
| NIST SP 800-53 Rev. 5 | SC-7 Boundary Protection; CM-7 Least Functionality; AC-6 Least Privilege | Egress control, least capability |
| NIST SP 800-53 Rev. 5 | SI-7 Software, Firmware, and Information Integrity; SI-4 System Monitoring; AU-2 Event Logging; IR-4 Incident Handling | Persistence detection, logging, response |
| NIST CSF 2.0 | PR.PS-01, PR.IR-01, DE.CM-09 | Configuration management, network protection, runtime monitoring |
Common failure patterns
- Betting everything on the filter: an injection classifier at the front door with nothing behind it. The paper is explicit that such defences are probabilistic.
- Zero-click channels left open: email, calendar and CRM inputs reach agents with no human in the loop, as in the EchoLeak Microsoft 365 Copilot case and the Gemini calendar invite incident.
- Unrestricted egress: an agent that can fetch any URL can also check in with any C2 server and send data to it.
- Unmonitored self-configuration: agents that may edit their own memory, heartbeat or schedule files with no integrity monitoring give the payload a permanent home.
- Developer tools treated as trusted input: error reports, issues and tickets that coding agents read are attacker-writable, as the Sentry MCP Agentjacking incident shows.
- Logs only of the final answer: without prompts, retrieved content and tool calls the chain cannot be reconstructed.
Practitioner checklist
- Inventory every agent, its triggers, tools, data access and outbound paths.
- Remove at least one leg of the lethal trifecta from every agent that has all three.
- Route agent egress through a logging proxy and enforce an allow-list.
- Monitor memory, heartbeat, scheduled-task, skill and configuration files for unapproved change.
- Enforce human confirmation outside the model for code execution, data transfer, messaging, payments and credential use.
- Run background and scheduled tasks on the same model tier as interactive work.
- Give each agent its own scoped, rotatable credentials and a tested kill switch.
- Log prompts, retrieved content, tool calls and outbound requests where the agent cannot alter them.
- Red-team the full chain per trigger and record which stage stopped it.
Standards and references
- Brodt, Feldman, Schneier and Nassi (arXiv): The Promptware Kill Chain
- MITRE ATLAS: AI Agent (Command and Control)
- MITRE ATLAS: AI Agent Context Poisoning
- MITRE ATLAS: LLM Prompt Self-Replication
- NIST: SP 800-53 Rev. 5
- Cloud Security Alliance: Agent Commander, Promptware Turns AI Agents into C2 Infrastructure
- Embrace The Red: Agent Commander, Promptware-Powered Command and Control
Related NHI Mgmt Group resources: Prompt Injection Guide · AI Agent Memory Poisoning Guide · Agent Session Smuggling Guide · Prompt injection data theft · Agentic AI Security Guide