Prompt injection attacks against AI models are not simple attacks; they are the first step of a kill chain. Understanding this gives defenders a set of countermeasures.

YouTube video by Zenity

fragments 19 Feb 2026

The growing integration of LLMs into applications has introduced new security risks, notably known as Promptware - maliciously engineered prompts designed to manipulate LLMs to compromise the CIA tria...

Attacken auf große Sprachmodelle gehen mittlerweile weit über reine Prompt-Injections hinaus. Zeit für eine Bestandsaufnahme.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Prompt injection was initially framed as the large language model (LLM) analogue of SQL injection. However, over the past three years, attacks labeled as prompt injection have evolved from isolated…

<p><a href="https://www.schneier.com/wp-content/uploads/2026/02/promptware-kill-chain.jpg"><img src="https://www.schneier.com/wp-content/uploads/2026/02/promptware-kill-chain-660w.jpg" alt="The promptware kill chain: initial access, privilege escalation, reconnaissance, persistence, command &#38; control, lateral movement, action on objective" /></a></p> <p>Attacks against modern generative artificial intelligence (AI) large language models (LLMs) pose a real threat. Yet discussions around these attacks and their potential defenses are dangerously myopic. The dominant narrative focuses on &#8220;<a href="https://simonwillison.net/2022/Sep/12/prompt-injection/">prompt injection</a>,&#8221; a set of techniques to embed instructions into inputs to LLM intended to perform malicious activity. This term suggests a simple, singular vulnerability. This framing obscures a more complex and dangerous reality. Attacks on LLM-based systems have evolved into a distinct class of malware execution mechanisms, which we term &#8220;promptware.&#8221; In a ...</p>

This was just a demonstration, but you can take steps to protect yourself from similar promptware attacks.

Really good research on practical attacks against LLM agents. "Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous" Abstract: The growing integration of LLMs into applications has introduced new security risks, notably known as Promptware­ -- maliciously engineered prompts designed to manipulate LLMs to compromise the CIA triad of these applications. While prior research warned about a potential shift in the threat landscape for LLM-powered applications, the risk posed by Promptware is frequently perceived as low.

LLMs' integration in applications introduces new security vulnerabilities, specifically Promptware. Promptware utilizes malicious prompts to compromise the CIA triad of these applications. This research assesses Promptware risks for users of Gemini-powered assistants through a new TARA framework. The study focuses on Targeted Promptware Attacks, utilizing indirect prompt injection through common user interactions. Fourteen attack scenarios against Gemini assistants across five threat classes were demonstrated. These attacks have digital and physical consequences, like spamming, phishing, and home automation control. The research reveals Promptware's potential for device lateral movement beyond the LLM application's boundaries. The TARA analysis reveals 73% of the threats pose a high-critical risk to users. Mitigations were discussed to reduce the risk significantly. The findings were disclosed to Google, who deployed dedicated mitigations. The research highlights the real-world dangers of Promptware and the importance of security measures.

Really good research on practical attacks against LLM agents. “Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous” Abstract: The growing integration of LLMs into applications has introduced new security risks, notably known as Promptware­—maliciously engineered prompts designed to manipulate LLMs to compromise the CIA triad of these applications. While prior research warned about a potential shift in the threat landscape for LLM-powered applications, the risk posed by Promptware is frequently perceived as low. In this paper, we investigate the risk Promptware poses to users of Gemini-powered assistants (web application, mobile application, and Google Assistant). We propose a novel Threat Analysis and Risk Assessment (TARA) framework to assess Promptware risks for end users. Our analysis focuses on a new variant of Promptware called Targeted Promptware Attacks, which leverage indirect prompt injection via common user interactions such as emails, calendar invitations, and shared documents. We demonstrate 14 attack scenarios applied against Gemini-powered assistants across five identified threat classes: Short-term Context Poisoning, Permanent Memory Poisoning, Tool Misuse, Automatic Agent Invocation, and Automatic App Invocation. These attacks highlight both digital and physical consequences, including spamming, phishing, disinformation campaigns, data exfiltration, unapproved user video streaming, and control of home automation devices. We reveal Promptware’s potential for on-device lateral movement, escaping the boundaries of the LLM-powered application, to trigger malicious actions using a device’s applications. Our TARA reveals that 73% of the analyzed threats pose High-Critical risk to end users. We discuss mitigations and reassess the risk (in response to deployed mitigations) and show that the risk could be reduced significantly to Very Low-Medium. We disclosed our findings to Google, which deployed dedicated mitigations...

The large language model industry has mostly treated prompt injection attacks as a risk analogous to traditional web server prompt injection attacks. Researchers