Promptware: The Kill Chain Turning Prompts Into Malware

Prompt injection has become a new malware execution model called promptware. The core architectural weakness is that LLMs treat instructions and data as indistinguishable tokens. This allows attackers to plant malicious prompts in emails, documents, or calendar invites, achieving initial access without breaking in.

Once inside, attackers use social engineering and roleplay to jailbreak safety alignment, escalate privileges, and map out connected tools, APIs, and permissions. Because AI agents often rely on long-term memory, they can be made to re-read and re-execute injected prompts, establishing persistence. The agent’s own internet access then becomes a command-and-control channel for dynamic updates.

The real danger is lateral movement: deeply interconnected agents (email, calendars, enterprise tools) can spread the infection to all contacts, functioning like a self-replicating virus. The endgame is data theft, fraud, or arbitrary code execution. These aren’t hypothetical—real-world demonstrations already exist.

The speaker argues it cannot be eliminated; vendors cannot patch away the architectural flaw. The only viable defense is a zero-trust architecture treating AI agents as untrusted execution environments. Teams must break each link of the kill chain: limit privilege escalation, constrain tool access, detect persistence, restrict actions, and design for containment assuming initial compromise.