The rapid adoption of large language model (LLM)-based systems -- from chatbots to autonomous agents capable of executing code and financial transactions -- has created a new attack surface that existing security frameworks inadequately address. The dominant framing of these threats as "prompt injection" -- a catch-all phrase for security failures in LLM-based systems -- obscures a more complex reality: Attacks on LLM-based systems increasingly involve multi-step sequences that mirror traditional malware campaigns. In this paper, we propose that attacks targeting LLM-based applications constitute a distinct class of malware, which we term \textit{promptware}, and introduce a five-step kill chain model for analyzing these threats. The framework comprises Initial Access (prompt injection), Privilege Escalation (jailbreaking), Persistence (memory and retrieval poisoning), Lateral Movement (cross-system and cross-user propagation), and Actions on Objective (ranging from data exfiltration to unauthorized transactions). By mapping recent attacks to this structure, we demonstrate that LLM-related attacks follow systematic sequences analogous to traditional malware campaigns. The promptware kill chain offers security practitioners a structured methodology for threat modeling and provides a common vocabulary for researchers across AI safety and cybersecurity to address a rapidly evolving threat landscape.

翻译：大型语言模型（LLM）驱动系统的快速普及——从聊天机器人到能够执行代码和金融交易的自主智能体——催生了一个现有安全框架无法充分应对的新型攻击面。当前主流观点将这些威胁笼统地称为“提示注入”——一个涵盖基于LLM系统安全失效的通用术语——这掩盖了一个更为复杂的现实：针对LLM系统的攻击日益呈现出多步骤序列化的特征，其模式与传统恶意软件攻击活动高度相似。本文提出，针对基于LLM应用的攻击构成了一类独特的恶意软件，我们将其命名为\textit{提示软件}，并引入一个五阶段杀伤链模型来分析此类威胁。该框架包括初始访问（提示注入）、权限提升（越狱）、持久化（记忆与检索污染）、横向移动（跨系统与跨用户传播）以及目标行动（涵盖数据窃取到未授权交易等行为）。通过将近期攻击案例映射至该结构，我们证明了LLM相关攻击遵循着与传统恶意软件活动类似的系统性序列。提示软件杀伤链为安全从业者提供了威胁建模的结构化方法论，并为跨越AI安全与网络安全领域的研究人员提供了应对快速演变威胁态势的共同术语体系。