Research Describes Prompt Injection Developing a Multistep Kill Chain

Academic work published this year describes prompt injection developing into what researchers term a promptware kill chain — a multistep delivery mechanism rather than a single manipulation — alongside separate research on data-injection attacks against agents operating on real inputs.

The framing matters. A kill chain implies stages: delivery, execution, persistence, and movement toward an objective. Applying that vocabulary to injection is a claim that the technique now has all of them.

The interesting question is where an injected instruction persists when the attacker has no code execution and no storage.

The answer is the places an agent reads: a document in a knowledge base, a record in a ticketing system, a calendar entry, a comment in a repository. Content written once and retrieved repeatedly is functionally persistence, and it survives every restart because it was never in memory to begin with.

Where one agent writes output another agent later reads — a summary, a ticket update, a generated report — an injected instruction can propagate without touching a human.

That is the mechanism this desk described in the npm campaigns filed in 26-0520: compromise that converts directly into distribution. The substrate is different and the shape is the same.

This is research rather than a documented campaign, and we grade it accordingly. Academic attack work runs ahead of observed exploitation, sometimes by years, and sometimes the predicted campaign never arrives.

It earns a file because the preconditions already exist in production. Multi-agent systems that read each other’s output are being deployed now, and the containment question — what an agent may do with instructions it found in data — is the same one from 26-0509, asked at a worse moment.