Cyber Kill Chain Stages Adapted for AI Agent Intrusions

AI agent intrusions change how the cyber kill chain works while leaving the attacker’s underlying intent unchanged. The classical seven-stage model still helps, but for defense to work, each stage must be remapped around machine speed, inherited permissions, and trusted workflows. An intrusion can advance through an agent’s ordinary work without producing the signals conventional defenses expect.

Why the classical kill chain still matters for AI agent intrusions — and where it breaks down

The Lockheed Martin kill chain treats each stage an attacker must traverse as an opportunity for detection. Endpoint tools can catch a payload, network monitoring can expose lateral movement, and a SIEM can correlate anomalies across stages. That logic depends on the attacker taking distinct steps that leave distinguishable traces. AI agents weaken both assumptions because they can compress, skip, or invert stages while acting through approved access.

Two changes explain the disruption. Speed collapses the dwell-time windows in which defenders can investigate and intervene. Legitimacy makes malicious activity look like normal work because a compromised agent already has permissions and a reason to move data. The model therefore remains a map of attacker intent, but it is no longer a reliable map of observable events. Its application begins with a distinction between attacks on the agent, which hijack its behavior, and attacks through the agent, which use it as a pivot into downstream systems.

Stage 1 — Reconnaissance: what changes when the agent does the scanning

With agent-led reconnaissance, a human operator no longer has to spend time gathering findings and passing them to the next stage. An autonomous workflow can scan continuously, process results at scale, and produce structured intelligence ready for use. GreyNoise described the PaperCut actor’s progression from an empty workspace to first remote code execution against a real victim in just under four hours in September 2026. Preparation and execution are compressed. Reconnaissance becomes an investigative interval within a pipeline.

A compromised internal agent can shorten that interval further because its activity history already maps parts of the environment. It knows what data exists, where it lives, and which systems its work touches. An attacker who inherits that knowledge may not need active scanning at all. Anthropic’s September 2026 threat report describes agent frameworks anyone can get that connect models to tools that scan systems, test weaknesses, and process stolen information. Reconnaissance is consequently both reusable outside the environment and potentially preassembled inside it.

Stage 2 — Weaponization: prompt injection as the new payload format

Once the attacker understands the target, weaponization can take a form that endpoint defenses were not built to recognize. The payload is natural language rather than a binary, and the agent’s reasoning supplies the execution mechanism. The underlying weakness is instruction and data conflation when both arrive as text. A passage that should remain material to be analyzed can instead become a direction to act. Prompt injection therefore occupies a role structurally similar to executable payloads, despite its different format.

Brodt, Feldman, Schneier, and Nassi’s The Promptware Kill Chain argues that the label “prompt injection” understates this development. Their term “promptware” describes a multistep malware delivery mechanism. That distinction matters because the weapon can support an intrusion beyond the first successful change in behavior. OWASP’s Top 10 for LLM Applications ranks prompt injection at #1, which shows how much it matters to the application boundary. Anthropic’s report also describes frameworks such as PentAGI that provide reusable scaffolding, making attack workflows easier to adopt and share.

Stage 3 — Delivery: indirect prompt injection as the dominant channel

A text-based weapon does not require direct access to the agent’s input interface. Indirect prompt injection places instructions in documents, web pages, or emails that the agent retrieves during its assigned work. The attacker’s task is to place content where the agent will encounter it, rather than persuade a user to launch an unfamiliar program. Every retrieved source can therefore carry both useful information and an attempt to redirect the workflow.

Google and Forcepoint X-Labs published analyses in late April 2026 describing adversaries seeding the open web with hidden instructions aimed at browsing agents, coding assistants, and enterprise copilots. The Grith Team’s March 2026 account of the GitHub issue and Cline injection described a routine issue title as the delivery surface in a compromise affecting roughly 4,000 developer machines. The Morris II worm in 2024 demonstrated the corresponding email route, with an agent retrieving a poisoned message and embedding the payload in outgoing messages. In each case, the important boundary is between retrieved content and trusted direction. A legitimate retrieval need not produce a file drop or an unusual inbound connection that marks it as an attack.

Stage 4 — Exploitation: jailbreaking as privilege escalation inside the agent's reasoning

Delivery becomes exploitation when the agent treats an untrusted instruction as a privileged one. The failure is not memory corruption or a crashed process, but a crossing from data-handling into unauthorized action. The Promptware Kill Chain calls this “Privilege Escalation (jailbreaking)”. The escalation takes place within the agent’s interpretation of what it should obey. Its consequences become concrete when that interpretation drives a tool call.

The Devin case illustrates the distinction between acquiring new permissions and misusing existing ones. After a successful injection, the agent used legitimately granted tools to expose ports, exfiltrate tokens, and install malware. The exploit did not require a new software vulnerability because the necessary access was already present. Attacks through agents can still use software exploitation. The DIVD zero-day chain in September 2026 involved agents automating the chaining of CVE-2026-102489 and CVE-2026-102490 to obtain root access within seconds. Defense must therefore address both what can redirect the agent and what its full permission set allows after redirection.

Stage 5 — Persistence: memory poisoning as the agentic equivalent of a rootkit

An attacker’s influence can survive the end of the interaction that introduced it. Memory poisoning turns stored knowledge into an implant by causing the agent to retain false beliefs or malicious instructions. This can work without the registry key, scheduled task, or executable implant used in familiar persistence mechanisms. A session reset is insufficient when the next session draws on the same poisoned material. The rootkit analogy describes the durable foothold.

The Promptware Kill Chain identifies this stage as “Persistence (memory and retrieval poisoning)”. Poisoned long-term memories and documents indexed for retrieval can reactivate attacker influence whenever the agent reads them again. Morris II demonstrated this through an email database used to retrieve context for generation, where agents processing messages from infected senders could retrieve and execute the payload again. The persistent element was the material that future work would bring back into context. Conventional security tooling rarely monitors memory layers and vector stores, so the foothold sits outside much of the visibility designed for endpoint persistence.

Stage 6 — Command and control: when the agent's workflow is the C2 channel

Persistence gives the attacker durable influence, but command and control need not introduce a separate communication path. A compromised agent can use approved integrations, including Salesforce, Slack, Google Drive, and ServiceNow, as C2 channels. It accesses familiar systems and moves data through connections established for legitimate work. The absence of a separate beacon removes a conventional detection opportunity. Network monitoring can observe the traffic without revealing that the purpose behind it has changed.

The compromised workflow uses the same permissions and integrations as the authorized one, so destination and timing alone may provide nothing unusual to flag. API keys and tokens that pass through prompts, memory, or logs can also be exposed. Anyone with visibility into that memory layer can read exposed credentials and use them to support further attacks at the victim’s expense. The control boundary has shifted from spotting a foreign communication channel to checking whether an approved channel is being used for an unauthorized purpose.

Stage 7 — Actions on objectives: how agentic access turns a single foothold into multi-tenant breach

By the final stage, the cumulative effect is broader than a single exfiltration event. An agent is built to work across systems, so one compromise can expose every downstream system it is allowed to reach without separate lateral movement steps. Anthropic’s report on GTG-50014 describes attackers dumping more than 2,100 Azure AD token sets across over 40 corporate tenants in about 34 hours. AI agents performed nearly all the work, and one compromised software provider became a vector into its customers. Existing connectivity supplied the reach that a conventional intruder would otherwise need to build.

Anthropic’s November 2025 disclosure of a state-sponsored espionage campaign showed how tactical operations could be compressed in the same way. An AI coding agent ran an autonomous campaign against 30 global targets, doing most of the reconnaissance, exploit writing, and lateral movement. This pattern brings together the speed of attacks that agents carry out and the reach of attacks through trusted access. Kiteworks’ March 2026 study found that most organizations lack purpose-binding controls over their agents, making that reach especially consequential in regulated environments. At this point, the classical assumption of sequential, separately detectable steps no longer describes the defender’s opportunities.

What the remapped kill chain reveals about where defenses must go

Faster execution narrows intervention windows, legitimate workflows weaken anomaly detection, and poisoned memory escapes tools focused on endpoint implants. These are different gaps, so a safeguard at the prompt boundary cannot stand in for controls throughout the workflow. The Promptware Kill Chain argues that prompt injection classifiers and jailbreak mitigations address only the first two stages of its own model. Leaving the later stages uncontested means treating initial resistance as though it were complete containment.

Agent-Sentry addresses delivery and exploitation through argument-level provenance, which tracks the source of a value flowing into a tool argument. That is more precise than asking only whether an agent may use the tool. The CaMeL framework from Debenedetti et al., 2025 tackles instruction and data conflation by marking which parts are privileged instructions and which are untrusted data, then using structured channels to keep control flow separate from data flow. Both approaches focus on the trust boundary within a workflow that is otherwise allowed. They address why a particular action is being taken, rather than relying solely on the legitimacy of the actor taking it.

The AEGIS framework from Yuan et al., 2026 adds a pre-execution audit layer that fixes the agent’s tool registry and retrieval source list at the gateway. Under that design, the agent cannot invent a new tool or retrieve material outside an approved corpus. This limits what the agent can do, with no claim to deal with every risk in the later stages. Five Eyes joint guidance from CISA, NSA, and counterparts in the UK, Canada, Australia, and New Zealand in May 2026 likewise names prompt injection as a core manipulation vector and stresses that no single safeguard is sufficient.

The strongest objection: why technical controls alone cannot close the gap

Even a layered technical design has a moving boundary. Each new agent, tool connection, or permission changes the attack surface, while many organizations lack a continuous inventory of agents and their reach. A control cannot reliably bound access that the organization has not identified. The International AI Safety Report 2026 frames growing AI capability as a governance challenge as well as a security engineering problem. Governance must account for what systems can do.

That objection limits the claim for technical controls, but it does not make the remapped kill chain less useful. The model breaks a broad governance problem into chokepoints at each stage where practitioners can track behavior, require human approval, and demand evidence before a system goes into production. The credible standard is a verified record that every approved workflow still passes after every security change, with the blast radius bounded by what was actually tested.