ai-research-survey

scan.json (29521B)

---

 {
   "paper": {
     "title": "The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism",
     "authors": ["Oleg Brodt", "Elad Feldman", "Bruce Schneier", "Ben Nassi"],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2601.09625"
   },
   "scan_version": 3,
   "active_modules": ["survey_methodology"],
   "methodology_tags": ["meta-analysis", "theoretical"],
   "key_findings": "The paper introduces 'promptware' as a new class of malware execution mechanism triggered through prompts and proposes a seven-stage kill chain (Initial Access, Privilege Escalation, Reconnaissance, Persistence, C2, Lateral Movement, Actions on Objective). Analysis of 36 documented incidents from 2023–2026 shows kill chain coverage increased from 2–3 stages in 2023 to routinely 4+ stages in 2025–2026, with 22 attacks traversing four or more stages. The paper also finds that existing defenses focus disproportionately on initial access and privilege escalation while neglecting lateral movement, C2, reconnaissance, and action-on-objective stages.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The Open Science section explicitly states: 'Since no code was developed, we do not have additional artifacts to share beyond the paper.' No repository or supplementary materials are provided."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The 36 incidents are catalogued in Table II within the paper, but no structured dataset, CSV, or machine-readable format is released separately. A survey can release its analysis corpus; this one did not."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No code or computational environment was used. The paper is a purely analytical SoK with no software artifacts requiring environment specification, but it could have provided analysis scripts; it explicitly states none exist."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No reproduction instructions are provided. The paper does not describe how to reproduce the incident classification or kill chain analysis beyond the narrative in the paper itself."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": false,
         "answer": false,
         "justification": "Survey/SoK paper with simple counts and tabulations (Table III). No statistical inference is performed that would require confidence intervals."
       },
       "significance_tests": {
         "applies": false,
         "answer": false,
         "justification": "No comparative statistical claims are made. The paper reports descriptive counts of kill chain stages across time periods without testing for statistical significance."
       },
       "effect_sizes_reported": {
         "applies": false,
         "answer": false,
         "justification": "Survey/SoK paper with no experiments. The analysis is descriptive categorization, not effect measurement."
       },
       "sample_size_justified": {
         "applies": false,
         "answer": false,
         "justification": "Survey/SoK paper. The sample of 36 incidents is not justified through power analysis or formal methodology—this is typical for SoK papers but not ideal."
       },
       "variance_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments producing variable results. The kill chain classifications are deterministic categorizations, not measurements with variance."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares against seven prior surveys [12]–[18] in the Introduction, arguing they are 'narrow in scope for three primary reasons' and identifying specific gaps: failure to recognize multistep evolution, focus on only initial phases, and lack of defense-in-depth perspective."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The compared surveys span 2024–2025 (refs [12]–[18]), which are contemporary to the paper's 2026 publication. These include JailbreakZoo [12], JailbreakRadar [13], DAN characterization [14], prompt injection defense evaluation [15], design patterns for LLM agents [16], jailbreak guardrails SoK [17], and prompt security taxonomy [18]."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "No system with components to ablate. This is a conceptual framework paper, not an engineering contribution."
       },
       "multiple_metrics": {
         "applies": false,
         "answer": false,
         "justification": "No experiments with quantitative metrics. The analysis uses categorical classification (kill chain stages) rather than measured metrics."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "No system outputs to evaluate. This is a survey/framework paper with no experimental system."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "No experimental evaluation requiring train/test splits."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table II provides per-incident breakdowns across all seven kill chain stages, and Table III summarizes stage distribution by time period (2023, 2024, 2025–2026). Section IV also breaks down by category (enterprise AI, coding assistants, AI worms, etc.)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly acknowledges framework limitations: 'We do not claim that the seven-step kill chain model captures every possible attack scenario, nor that the boundaries between stages are always sharp' (Section III). It also notes no attack achieved all 7 stages, and reconnaissance is rarely demonstrated."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports several negative findings: no attack achieved all 7 kill chain stages (max is 5), promptware-native C2 was observed in only 2 of 36 incidents, reconnaissance was explicitly demonstrated in only 1 case (APwT), and strong prevention mechanisms all impose significant usability costs (Section V.G)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims (1) prompt injections evolved into promptware (argued in Section II), (2) seven-stage kill chain introduced (Section III), (3) at least 21 attacks traverse 4+ stages—Table III shows 22 (13 at 4 stages + 9 at 5 stages), and (4) defense-in-depth reviewed (Section V). All abstract claims are supported by the paper's content."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims prompt injections 'evolved into' promptware and that kill chain coverage 'increased steadily over time.' These temporal claims are based on observational data from 36 hand-selected incidents without controlling for confounds such as increased researcher attention, selection bias in incident reporting, or the growing ecosystem of LLM applications creating more attack surface."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper generalizes from 36 selected incidents to broad claims about 'LLM applications' and the evolution of 'promptware' as a class. The incidents are described as 'prominent' without defining selection criteria. The title claims prompt injections 'evolved into a multistep malware delivery mechanism' broadly, but the evidence comes from a hand-picked sample that may not represent the full landscape of attacks."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for the observed evolution pattern. For example, it doesn't consider whether increasing kill chain coverage reflects researcher focus on finding more stages rather than actual attacker sophistication, whether the selection of 'prominent' incidents biases toward complex attacks, or whether the growth in LLM application capabilities (not attacker innovation) drives the observed pattern."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 'kill chain coverage' (number of stages observed in an incident) as a proxy for attack sophistication and threat severity. It does not discuss whether kill chain coverage is an adequate measure—an attack traversing 5 stages is not necessarily more dangerous than a 2-stage attack that achieves devastating RCE. The mapping from stage count to threat level is assumed, not justified."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": false,
         "answer": false,
         "justification": "No models are used in this survey/SoK paper."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "No prompting is used. The paper analyzes attacks but does not conduct any LLM experiments."
       },
       "hyperparameters_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments or model usage requiring hyperparameter reporting."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. This is a survey/framework paper."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper states it 'analyzed thirty-six documented incidents and studies from February 2023 through January 2026' but does not describe how these 36 were identified or selected from the broader universe of prompt injection incidents. No search strategy, databases queried, or inclusion/exclusion criteria are stated. The incidents are described as 'prominent' without defining what constitutes prominence."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations or threats-to-validity section. The Ethical Considerations appendix only notes no experiments were performed. The Discussion (Section VI) presents four contributions but does not discuss limitations. Brief disclaimers are scattered in Section III ('We do not claim...') but there is no substantive concentrated discussion."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed. The paper doesn't address selection bias in incident choice, potential for the evolution narrative to be an artifact of researcher attention, survivorship bias (only documented/discovered attacks are analyzed), or the reliability of classifying incidents into kill chain stages."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly states specific scope boundaries: 'We explicitly exclude traditional software exploits, such as buffer overflows in LLM-enabled applications that rely on memory corruption, from the definition of promptware' (Section II). It also acknowledges: 'We do not claim that the seven-step kill chain model captures every possible attack scenario, nor that the boundaries between stages are always sharp. Attackers may skip stages, combine them, merge them' (Section III)."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The incident classifications are presented only in Table II within the paper. No downloadable dataset, supplementary spreadsheet, or machine-readable format is provided for independent verification of the kill chain classifications."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not describe how the 36 incidents were identified. No search databases, keywords, or systematic methodology is reported. The time range (February 2023 to January 2026) is stated, but the collection procedure itself is undocumented."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "The method for selecting the 36 incidents from the broader universe of prompt injection incidents/research is not described. No inclusion/exclusion criteria, search strategy, or sampling approach is documented. The incidents are called 'prominent' without defining the term."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "No documentation of how incidents were identified, filtered, classified into kill chain stages, or validated. The classification methodology (how the authors determined which kill chain stages an incident demonstrates) is not formally described."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section appears in the paper. No grants, sponsors, or funding agencies are mentioned anywhere."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Ben-Gurion University of the Negev, Tel Aviv University, Harvard Kennedy School, and University of Toronto."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so funder independence cannot be assessed. The absence of a funding statement makes this unanswerable."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "Survey/SoK paper that does not evaluate any pre-trained model's capability on a benchmark."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Survey/SoK paper with no model evaluation or benchmark testing."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Survey/SoK paper with no benchmark evaluation."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper is a survey/SoK analyzing published incidents and studies."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The Ethical Considerations section explicitly states: 'no experiments have been performed that required ethical considerations.'"
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey/SoK paper."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey/SoK paper."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants or experimental conditions in this survey/SoK paper."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants or experimental conditions in this survey/SoK paper."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey/SoK paper."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": false,
         "answer": false,
         "justification": "Survey/SoK paper with no computational method or model usage."
       },
       "compute_budget_stated": {
         "applies": false,
         "answer": false,
         "justification": "Survey/SoK paper with no computational experiments."
       }
     },
     "survey_methodology": {
       "prisma_or_structured_protocol": {
         "applies": true,
         "answer": false,
         "justification": "No PRISMA diagram, no structured review protocol, no reproducible search queries, and no protocol registration. The 36 incidents appear to be selected based on the authors' domain knowledge rather than a systematic search methodology."
       },
       "quality_assessment_of_sources": {
         "applies": true,
         "answer": false,
         "justification": "The survey treats all 36 sources—blog posts (e.g., Embrace The Red), security advisories, conference talks, and peer-reviewed papers—as equivalent evidence without any quality assessment or risk-of-bias evaluation. A blog post vulnerability disclosure carries the same weight as a CCS paper."
       },
       "publication_bias_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of publication or reporting bias. The paper does not consider whether documented incidents are biased toward successful or dramatic attacks, whether failed or partial attacks go unreported, or whether the security research community's focus on novel attack demonstrations skews the sample."
       }
     }
   },
   "claims": [
     {
       "claim": "Prompt injections have evolved from isolated exploits into multistep malware delivery mechanisms (promptware) following a structured seven-stage kill chain.",
       "evidence": "Section II argues that prompt injection shares characteristics with script injection (application-wide blast radius, RCE capability) more than SQL injection. Section III defines seven kill chain stages with examples from the literature. Table I provides a systematic comparison across 10 dimensions.",
       "supported": "moderate"
     },
     {
       "claim": "At least 21 documented attacks traverse four or more stages of the promptware kill chain.",
       "evidence": "Table III tallies: 13 attacks at 4 stages + 9 attacks at 5 stages = 22 total at 4+ stages across 36 analyzed incidents. Table II provides per-incident classification.",
       "supported": "moderate"
     },
     {
       "claim": "Kill chain coverage has increased steadily over time, from 2–3 stages in 2023 to routinely 4+ stages in 2025–2026.",
       "evidence": "Table III shows: 2023 had 0 attacks at 4+ stages (out of 3), 2024 had 7 (out of 12), and 2025–2026 had 15 (out of 21). Section IV.A provides chronological narrative of this evolution.",
       "supported": "moderate"
     },
     {
       "claim": "AI worms show the highest kill chain coverage of any attack category, with two of three achieving five stages.",
       "evidence": "Section IV.A.3 states this directly. Table II confirms Morris II Worm and AgentHopper both reached 5 stages (Initial Access, Privilege Escalation, Persistence, Lateral Movement, Action on Objective).",
       "supported": "moderate"
     },
     {
       "claim": "Existing defenses disproportionately address initial access and privilege escalation while neglecting later kill chain stages.",
       "evidence": "Table IV shows numerous mitigations for IA and PE, but only 3 for lateral movement, 3 for C2, 0 for reconnaissance, and 7 for action on objective. Section V.G explicitly concludes 'much less attention has been given to the development of mitigations against lateral movement, C2, reconnaissance and action on objective.'",
       "supported": "strong"
     },
     {
       "claim": "All prevention mechanisms significantly impact usability, creating an inherent tension between security and functionality.",
       "evidence": "Section V.G and Table IV show that instruction-data separation (P), action sandboxing (P), and policy grounding (P/M) all have medium to high usability impact. The paper concludes: 'strong prevention comes at the cost of usability' and 'all prevention mechanisms significantly impact usability.'",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No structured selection methodology for incidents",
       "detail": "The 36 incidents are described as 'prominent' without defining inclusion/exclusion criteria, search databases, or selection methodology. This creates risk of cherry-picking incidents that support the evolution narrative while omitting incidents that don't fit the framework."
     },
     {
       "flag": "Self-citation concern",
       "detail": "Co-author Ben Nassi is an author on several of the analyzed incidents, including Morris II Worm [7], APwT [37], and 'Invitation Is All You Need' [6]. The kill chain framework is partly built on and validated by the authors' own prior work, which could bias the analysis toward incidents that fit the proposed model."
     },
     {
       "flag": "No quality assessment of heterogeneous sources",
       "detail": "Blog posts (Embrace The Red), security vendor advisories (PromptArmor, Noma Security), conference talks (39C3), and peer-reviewed papers (ACM CCS) are all treated as equivalent evidence. A vulnerability demo in a blog post has different evidentiary weight than a peer-reviewed study, but both contribute equally to the kill chain analysis."
     },
     {
       "flag": "No limitations section",
       "detail": "For a paper proposing a comprehensive security framework from 36 selected incidents, the absence of a dedicated limitations section is notable. Key unaddressed threats include selection bias, the reliability of multi-author kill chain classification, and whether the evolution pattern reflects genuine attacker sophistication vs. increased researcher attention."
     },
     {
       "flag": "Evolution narrative may be artifact of observation bias",
       "detail": "The increasing kill chain coverage over time (Table III) could reflect researchers looking for more stages in newer work rather than actual attack evolution. Earlier incidents may have had more stages that simply went undocumented. The paper does not address this confound."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["K. Greshake", "S. Abdelnabi", "S. Mishra", "C. Endres", "T. Holz", "M. Fritz"],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection against production LLM applications (Bing Chat, GPT plugins), demonstrating data exfiltration via poisoned web pages."
     },
     {
       "title": "Here comes the AI worm: Preventing the propagation of adversarial self-replicating prompts within GenAI ecosystems",
       "authors": ["S. Cohen", "R. Bitton", "B. Nassi"],
       "year": 2025,
       "relevance": "First demonstration of AI worms (Morris II) with self-replicating prompt injection across email assistants, achieving 5 kill chain stages."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["A. Zou", "Z. Wang", "N. Carlini", "M. Nasr", "J. Z. Kolter", "M. Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Demonstrated universal adversarial suffixes that transfer across multiple LLMs, representing a key escalation in jailbreaking capability."
     },
     {
       "title": "Design patterns for securing LLM agents against prompt injections",
       "authors": ["L. Beurer-Kellner", "B. Buesser", "A.-M. Crețu"],
       "year": 2025,
       "arxiv_id": "2506.08837",
       "relevance": "Proposes architectural design patterns including plan-then-execute pipelines as structural defenses against prompt injection in LLM agents."
     },
     {
       "title": "Jailbroken: How does LLM safety training fail?",
       "authors": ["A. Wei", "N. Haghtalab", "J. Steinhardt"],
       "year": 2023,
       "relevance": "Analyzes failure modes of LLM safety alignment training, relevant to understanding why privilege escalation via jailbreaking persists."
     },
     {
       "title": "NeMo Guardrails: A toolkit for controllable and safe LLM applications with programmable rails",
       "authors": ["T. Rebedea", "R. Dinu", "M. N. Sreedhar", "C. Parisien", "J. Cohen"],
       "year": 2023,
       "relevance": "Provides programmable policy enforcement for LLM applications, directly relevant to defense-in-depth against promptware."
     },
     {
       "title": "IsolateGPT: An execution isolation architecture for LLM-based agentic systems",
       "authors": ["Y. Wu", "F. Roesner", "T. Kohno", "N. Zhang", "U. Iqbal"],
       "year": 2024,
       "arxiv_id": "2403.04960",
       "relevance": "Proposes component isolation architecture to mitigate lateral movement in LLM agentic systems."
     },
     {
       "title": "Prompt infection: LLM-to-LLM prompt injection within multi-agent systems",
       "authors": ["D. Lee", "M. Tiwari"],
       "year": 2024,
       "arxiv_id": "2410.07283",
       "relevance": "Demonstrates cross-agent prompt injection propagation in multi-agent systems, directly relevant to lateral movement in the kill chain."
     },
     {
       "title": "A jailbroken GenAI model can cause substantial harm: GenAI-powered applications are vulnerable to promptwares",
       "authors": ["S. Cohen", "R. Bitton", "B. Nassi"],
       "year": 2024,
       "arxiv_id": "2408.05061",
       "relevance": "First demonstration of reconnaissance stage in promptware, where injected prompts dynamically probe the host application's context."
     },
     {
       "title": "AirGapAgent: Protecting privacy-conscious conversational agents",
       "authors": ["E. Bagdasarian", "R. Yi", "S. Ghalebikesabi"],
       "year": 2024,
       "relevance": "Proposes task-conditioned data minimization architecture to protect against data exfiltration in LLM agents."
     },
     {
       "title": "SoK: Taxonomy and evaluation of prompt security in large language models",
       "authors": ["H. Hong", "S. Feng", "N. Naderloui"],
       "year": 2025,
       "arxiv_id": "2510.15476",
       "relevance": "Comprehensive taxonomy of prompt security attacks and defenses, one of the baseline surveys this paper positions against."
     },
     {
       "title": "AgentRIM: Tool risk mitigation for agentic AI",
       "authors": ["R. Betser", "S. Bose", "A. Giloni"],
       "year": 2026,
       "arxiv_id": "2601.12449",
       "relevance": "Proposes least-privilege tool access control for AI agents, directly relevant to mitigating lateral movement and action-on-objective stages."
     },
     {
       "title": "Firewalls to secure dynamic LLM agentic networks",
       "authors": ["S. Abdelnabi", "A. Gomaa", "E. Bagdasarian"],
       "year": 2025,
       "arxiv_id": "2502.01822",
       "relevance": "Proposes prompt injection sanitizer firewalls for LLM agent networks, addressing initial access defense in the kill chain."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "The kill chain framework and defense-in-depth assessment (Table IV) are directly useful for security practitioners designing LLM application architectures, though the paper provides no tools or code."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "Directly challenges the widely-held 'prompt injection = SQL injection' analogy, arguing this framing 'dangerously understates' the threat and citing NCSC agreement."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Catalogs escalating real-world attacks on production systems including IoT surveillance via Google Assistant, $47K cryptocurrency theft, RCE on AI coding assistants, and self-propagating AI worms."
     },
     "drama_conflict": {
       "score": 2,
       "justification": "Strong 'the industry is getting this wrong' framing—prompt injection is 'dangerously misunderstood' per NCSC, and existing defenses are insufficient for the full kill chain."
     },
     "demo_ability": {
       "score": 0,
       "justification": "Purely conceptual framework paper with no code, tools, or demo. The Open Science section confirms no artifacts exist."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Bruce Schneier (famous cryptographer and security commentator) is a co-author. Attacks analyzed target ChatGPT, Google Assistant, GitHub Copilot, and Microsoft Copilot."
     }
   }
 }