Promptware

Prompt injection began as a way to make chatbots say the wrong thing. Researchers now describe a promptware kill chain, in which injected prompts behave like malware: gaining a foothold, persisting in memory, spreading, and achieving objectives.

Promptware kill chain stages include:

• Initial access: Injected instructions delivered through content the AI processes.
• Privilege escalation: Jailbreaking or manipulating the AI into using powerful tools.
• Persistence: Planting instructions in memory, files, or configuration.
• Lateral movement: Spreading to other agents, users, or connected systems.
• Actions on objective: Data theft, fraud, or destructive actions.

Framing these attacks as malware helps security teams apply familiar disciplines such as kill-chain analysis, detection engineering, and incident response to AI systems.

Promptware is harder to detect than traditional malware because it uses ordinary language and legitimate features, so defenses must understand context and intent rather than match signatures.

How PointGuard AI Helps

PointGuard AI AI Runtime Guardrails detect injected instructions and risky tool use at runtime, and Guardian Agent monitoring tracks multi-step behavior that reveals a promptware chain. Agent Mission Control limits what a hijacked agent can do at each stage.

Learn More

• The Promptware Kill Chain (arXiv:2601.09625)
• Lawfare: The Promptware Kill Chain
• MITRE ATLAS