The Problem With the SQL Injection Comparison
The industry has long treated prompt injection as the AI equivalent of SQL injection which is a classic attack where a hacker sneaks rogue commands into a database query. But the researchers say this comparison sells the threat short. SQL injection targets a passive database with limited reach. An AI system, by contrast, often has live tool access, active permissions across services, and deep integration into a user’s environment. That makes it a much more capable weapon in an attacker’s hands. Depending on what the targeted AI system can do, a successful attack could steal data, spread across connected systems, tamper with IoT devices, or run malicious code directly on a victim’s machine. The U.K. National Cyber Security Centre has called prompt injection “dangerously misunderstood” – a description the paper treats as accurate.
A Seven-Stage Attack Framework
To map out how these attacks actually unfold, the authors adapted the concept of a “kill chain”, a step-by-step breakdown of an attack from first entry to final damage, specifically for promptware:
- Privilege escalation via jailbreaking – pushing the model past its built-in safety restrictions
- Reconnaissance – using the model’s access to gather information about the target environment
- Persistence – ensuring the malicious payload survives beyond the initial session
- Command and control – setting up a channel so the attacker can keep directing the compromised model
- Lateral movement – spreading the attack to other connected users or systems
- Actions on objective – carrying out the intended damage, whether that’s theft, manipulation, or further spread
The paper makes an important technical distinction: prompt injection is the method used to get attacker instructions into the model’s context window in the first place, while jailbreaking is what removes the guardrails that would otherwise stop those instructions from doing harm. A fully realized attack often requires both.
Two Ways an Attack Can Persist
Once an attacker gains a foothold, keeping it is the next challenge. The paper identifies two ways this is done. The first, retrieval-dependent persistence, involves hiding a malicious payload inside content the AI regularly pulls in — documents, emails, or calendar entries, for example. Every time the system fetches that content, the payload reactivates. The second, retrieval-independent persistence, exploits long-term memory features built into some AI systems, such as the “memories” function in ChatGPT. By writing malicious instructions directly into that memory store, an attacker ensures the payload surfaces in every future session, no matter what the user is asking about — making the compromise durable and invisible to the user.
Attacks Are Getting More Complex
The researchers examined 36 documented attacks against real, deployed AI systems over a three-year window. In early 2023, typical incidents touched only two or three stages of the kill chain. In the most recent period studied, 15 out of 21 documented incidents covered four or more stages — a clear sign that attackers are becoming more sophisticated.
One of the most striking examples is the “Morris II” worm, documented in March 2024, which completed all five stages against AI-powered email assistants. It spread by embedding copies of its own malicious instructions into outgoing emails, jumping from user to user without any action required on their part. In a separate demonstration, researchers showed how a widely used LLM could be turned into a remotely controlled agent — what the paper calls a ZombAI — by writing persistent instructions into its long-term memory, directing it to regularly fetch updated commands from an attacker-controlled page on GitHub. This was the first confirmed case of what the authors call promptware-native command and control: an attacker maintaining ongoing control of a compromised AI system entirely through its prompt layer, with no traditional malware infrastructure needed underneath.
Why AI Coding Tools Are a Prime Target
AI coding assistants have become a particularly attractive target. These tools are built to execute code and routinely hold sensitive developer credentials and repository access. Of the 21 attacks documented in 2025 and early 2026, seven targeted this category. A vulnerability in GitHub Copilot, tracked as CVE-2025-53773, allowed an attacker to achieve code execution through a prompt injection attack.
Where the Industry’s Defenses Are Falling Short
The authors reviewed more than 20 categories of defensive measures and found a significant gap: the reconnaissance stage of the kill chain currently has no dedicated defenses at all. More broadly, the defenses that work best tend to make AI systems less convenient to use — a tradeoff that nobody has cleanly solved yet.
The paper’s central criticism is that the industry has focused its defenses on better classifiers — systems designed to detect and block malicious prompts at the point of entry. This approach assumes the attack can be caught before it gets in. The authors argue this is the wrong mindset. Instead, defenses should be built on the assumption that injection will happen, with independent protective layers placed at each stage of the kill chain. The researchers also note that fully automated promptware attacks are likely to emerge in the near future, which would significantly lower the barrier for carrying them out at scale.