Promptware
Also known as: prompt-based malware, agentic malware
Traditional malware exploits code vulnerabilities. Promptware exploits the fact that AI agents treat instructions and data as the same thing: text in a context window. An attacker who can insert text into that window, via a poisoned web page, a rigged document, a malicious tool response, or even an infected memory entry, can potentially redirect an agent's entire behavior without writing a single line of executable code.
The term was coined in a January 2026 academic paper co-authored by security researcher Bruce Schneier, and named the evolution from isolated prompt injection incidents to structured, multi-stage attack campaigns. Researchers have since demonstrated working command-and-control channels running entirely through AI context manipulation, where one compromised agent beacons instructions to another. The Cloud Security Alliance documented cases where full kill chains ran against production AI systems including ChatGPT, Copilot, and Grok.
For builders shipping agentic systems, promptware is the reason defense-in-depth matters more than any single guardrail. A model that can browse the web, read email, write files, and call APIs has a large attack surface, and input sanitization at the prompt level is not enough when the exploit itself is semantically valid text. Mitigations include scoping agent permissions tightly, treating every external data source as untrusted, running adversarial evals that simulate full kill chains, and keeping humans in the loop for any action that is irreversible.