IBM Researchers Map Out 'Promptware Kill Chain' Targeting Generative AI Systems

IBM security expert Jeff Crume has outlined a structured attack framework called the 'Promptware Kill Chain,' describing how malicious prompts — rather than traditional malicious code — can be used to compromise generative AI chatbots and agents. Drawing on research by Bruce Schneier and others, the framework breaks the attack into stages including initial access via direct or indirect prompt injection, privilege escalation through jailbreaking, reconnaissance, persistence, command-and-control, lateral movement, and final data theft or fraud. A core vulnerability highlighted is that large language models treat all input as tokens, erasing the traditional boundary between code and data and allowing malicious instructions to carry the same weight as system commands. Crume warns that prompt injection is architecturally unfixable and cannot be patched by vendors, making it a systemic rather than incidental risk. He recommends adopting a Zero Trust approach — assuming breaches have already occurred, treating AI agents as untrusted environments, and defending at every stage of the kill chain through strict permission controls and anomaly detection.