The Promptware Era: AI Security’s CrowdStrike Moment + Video

Introduction

The AI security landscape has undergone a fundamental transformation in 2026. What was once dismissed as “prompt injection”—a curiosity of conversational AI—has evolved into a sophisticated, multistage malware execution mechanism now termed promptware. As Zenity Labs’ podcast with Dr. Ben Nassi explores, the industry now faces an unprecedented convergence of threats: AI worms that self-replicate across agent ecosystems, coding agents weaponized as hacking tools, and supply-chain attacks that turn trusted AI skills into trojan horses. This article examines the technical realities behind these threats and provides actionable guidance for defenders racing to secure the AI attack surface.

Learning Objectives

Understand the evolution from prompt injection to the seven-stage promptware kill chain and its implications for enterprise AI security
Identify and mitigate agentjacking, AI worm propagation, and supply-chain attacks targeting AI coding agents and MCP infrastructure
Implement defense-in-depth strategies including least-privilege scoping, semantic guardrails, and architectural controls against prompt-to-RCE vectors

You Should Know

Prompt Injection to Promptware: The Kill Chain Matures

The term “prompt injection” was first formalized in September 2022 as the LLM analogue of SQL injection. OWASP ranked it as LLM01—the top vulnerability in its Top 10 for LLM Applications. But the threat model has expanded dramatically. A January 2026 paper by Oleg Brodt, Elad Feldman, Bruce Schneier, and Ben Nassi (arXiv:2601.09625) proposed the term promptware to describe prompt-based attacks that now exhibit the same operational complexity as traditional malware campaigns. Analyzing 36 documented attacks, the researchers found that at least 21 traverse four or more stages of a structured kill chain.

The Seven-Stage Promptware Kill Chain:

| Stage | Description |

|-|-|

Researchers have demonstrated working C2 channels over AI systems, turning platforms like ChatGPT, Google Jules, and Microsoft Copilot into command relays and data exfiltration channels without any traditional malware or compromised infrastructure. Indirect prompt injection propagating through RAG databases and MCP tool outputs can spread attacker instructions across an entire enterprise AI deployment from a single poisoned document.

Lab Exercise: Detecting Promptware Indicators

To identify potential promptware activity in your environment, monitor for:
– Unusual tool invocation patterns from AI agents
– Repeated retrieval of the same external documents
– Agent outputs containing encoded or obfuscated instructions
– Persistent behavioral changes across sessions

Linux command to monitor agent logs:

 Monitor AI agent logs for suspicious patterns
tail -f /var/log/ai-agent/agent.log | grep -E "(eval|exec|system|subprocess|<strong>import</strong>)"

Windows PowerShell equivalent:

Get-Content -Path "C:\ProgramData\AI-Agent\logs\agent.log" -Wait | Select-String -Pattern "(eval|exec|system|subprocess|<strong>import</strong>)"

Agentjacking: When Your Coding Agent Becomes the Attacker

In June 2026, researchers at Tenet Security demonstrated a new attack class called Agentjacking that tricks AI coding agents into running arbitrary code on developer machines. The attack exploits a critical architectural flaw at the intersection of Sentry’s event ingestion endpoint (which accepts arbitrary payloads from anyone with a Data Source Name) and the Sentry MCP server (which returns this data to AI agents as trusted system output).

The Attack Chain:

Attacker finds a target’s Sentry DSN (a public, write-only credential embedded in websites)
Attacker sends a malicious error event to Sentry’s ingest endpoint via POST request
The injected event contains carefully formatted markdown in the message field
When the Sentry MCP server returns this event to an AI agent, it appears as legitimate structured content
When a developer asks their AI coding agent to “fix unresolved Sentry issues,” the agent queries Sentry via MCP and receives the malicious event
The agent executes the attacker’s code with the developer’s full privileges

The scale is staggering: At least 2,388 organizations were found with exposed, injectable DSNs. In controlled tests against over 100 organizations, researchers achieved an 85% exploitation success rate across widely used AI coding assistants. Sentry acknowledged the issue but stated it’s “technically not defensible” to fix, instead implementing a global content filter blocking specific payload strings.

The attack bypasses EDR, WAF, IAM, VPN, and firewalls because “there is nothing malicious to detect—every action in the chain is authorized”.

Mitigation Commands:

Linux – Restrict agent permissions:

 Run AI coding agents with restricted home directory
HOME=/tmp/agent-sandbox ~/.local/bin/claude-code --1o-auto-exec
 Or use firejail sandbox
firejail --1oprofile --1et=none --private=/tmp/agent-sandbox claude-code

Windows – Run agent with limited privileges:

 Create a restricted user account for agent operations
New-LocalUser -1ame "AIAgent" -Password (ConvertTo-SecureString "TempPass123!" -AsPlainText -Force)
 Run agent under that account
runas /user:AIAgent "cursor --disable-auto-update"

Tool-specific mitigation:

Disable auto-execute flags: --auto-exec, --auto-run, --auto-test, `dangerously-skip-permissions`
– Run agents with `$HOME` pointed to a throwaway folder to protect `~/.ssh` and `~/.aws` credentials
Require explicit human approval for any consequential action an agent proposes after retrieving external content

3. Self-Replicating AI Worms: Propagation Without Payload

The theoretical threat of AI worms became reality in 2026. ClawWorm, published in March 2026, demonstrated the first publicly reported self-replicating worm targeting a production-scale AI agent framework, achieving a 64.5% aggregate success rate across four LLM backends.

AgentWorm (arXiv:2603.15727) took this further—the first self-replicating worm attack against a production-scale agent framework, achieving a fully autonomous infection cycle initiated by a single message:

The worm hijacks the victim’s core configuration to establish persistent presence across session restarts
It executes an arbitrary payload upon each reboot
It propagates itself to every newly encountered peer without further attacker intervention

Tested across five distinct LLM backends, three infection vectors, and three payload types, AgentWorm achieved a 63% aggregate attack success rate with sustained multi-hop propagation. Critically, the researchers found that the critical controls capable of breaking the infection loop were not enabled in any observed deployment.

Even more concerning: AI-adaptive worms demonstrated in June 2026 can autonomously exploit vulnerabilities published after the LLM’s training cutoff—the system successfully exploited CVE-2026-43284, CVE-2026-43500 (“Dirty Frag”), and CVE-2026-39987 (a critical RCE flaw in the Marimo notebook platform). These worms propagated autonomously across networks of Windows, Linux, and IoT devices.

Detection and Monitoring:

Linux – Monitor for unusual agent-to-agent communication:

 Monitor network connections from AI agent processes
sudo netstat -tunap | grep -E "(claude|cursor|copilot|codex)"
 Monitor for unusual outbound connections
sudo tcpdump -i any -1 "port 443" -v | grep -E "(claude|cursor)"

Windows – PowerShell monitoring:

 Monitor agent processes for unusual network activity
Get-1etTCPConnection | Where-Object { $<em>.OwningProcess -in (Get-Process -1ame "cursor","claude","copilot" | Select-Object -ExpandProperty Id) }
 Check for persistence mechanisms
Get-ScheduledTask | Where-Object { $</em>.TaskName -match "agent|ai|cursor" }

GuardFall: Bypassing Agent Safety with Decades-Old Shell Tricks

Adversa AI’s GuardFall research exposed a fundamental flaw in how AI coding agents validate shell commands. Most agents check each command against a blocklist of dangerous patterns before running it—but they check the command as plain text, while bash rewrites that text before execution.

The bypass is embarrassingly simple:

A filter watching for `rm` sees nothing wrong with r''m—to a text matcher, those are different strings
Bash removes the empty quotes and runs `rm` anyway
The same technique works with commands hidden in base64 and piped into a shell, or using tools like `find` and `dd` with destructive flags

The researchers tested 11 popular open-source coding and computer-use agents—10 were vulnerable. Only one, “Continue,” was built to defend against it. The vulnerable tools collectively carry roughly 548,000 GitHub stars. Adversa demonstrated full end-to-end attacks against production binaries.

Why traditional fixes fail: The researchers call this “not a bug but a dangerous convention and a class of problems”—adding more blocklist patterns fixes none of it.

Proper Defense Implementation (as used by “Continue”):

Read the command the way bash will before deciding
Break the command into the same pieces the shell would
Check what actually runs, not the raw text
Maintain a hard list of destructive commands blocked outright

Implementation example (Python-like pseudocode):

import shlex
import subprocess

def safe_command_check(cmd_string):
 Parse the command the way the shell would
parsed = shlex.split(cmd_string)
if not parsed:
return False
command = parsed[bash]
 Resolve command path and check against blocklist
if command in DESTRUCTIVE_COMMANDS:
return False
 Check for dangerous patterns after shell expansion
expanded = subprocess.run(['bash', '-c', f'echo {cmd_string}'], 
capture_output=True, text=True)
 Validate expanded command
return validate_expanded(expanded.stdout)

CoreBreak: Bypassing Model Guardrails at the Dispatch Layer

A vulnerability pattern presented at Black Hat USA 2026 identified a structural failure in AI agent infrastructure. CoreBreak affects the dispatch layers of Amazon Bedrock AgentCore, Google Agent Development Kit (ADK), and Vercel AI SDK. These harness packages execute tools without requiring a legitimate model turn—they accept data shaped like a model-generated tool call without verifying its provenance.

The Critical CVEs:

|–|-||-|

Why this matters: CoreBreak is distinct from prompt injection. Prompt injection attempts to manipulate the model’s judgment—CoreBreak bypasses the model entirely at the dispatch layer. The system assumes any tool-call-formatted data must have been generated by the model. When that assumption fails, system prompts and refusal training become irrelevant.

Remediation Steps:

AWS deployed fixes automatically before July 31, 2026
Google ADK version 2.5.0 (July 16, 2026) requires manual application for self-hosted operators
Vercel fixes in versions 1.0.29 and 1.0.28 (July 20, 2026)

Verification commands:

 Check AWS Bedrock AgentCore version and patch status
aws bedrock-agent list-agents --query 'agentSummaries[].[agentId,agentName,updatedAt]'

Check Google ADK version
pip show google-adk | grep Version

Check Vercel AI SDK version
npm list @ai-sdk/harness

6. The Broken Vulnerability Disclosure Paradigm

At Black Hat USA 2026, a keynote highlighted that vulnerability discovery has reached industrial scale. Anthropic’s Claude Mythos and Project Glasswing demonstrated how an AI model could uncover exploits in seconds. The scale calls into question the entire process of responsible disclosure, which, in the team’s view, “was already broken as disclosure often creates increased risk”.

The numbers are alarming:

Mandiant’s M-Trends 2026 report found that 28.3% of CVEs are exploited within 24 hours of public disclosure
Researchers hit “the barrier of discovering vulnerabilities at such speed that they could not keep pace reporting them”
AI-driven vulnerability generation was the “undeniable hot topic” of Black Hat 2026

The industry response: Microsoft’s David Weston argued that rather than attempting to respond faster than attackers, the security industry needs to build greater durability into systems by adopting memory-safe languages such as Rust, harnessing AI-assisted engineering, and automating remediation rather than sticking to monthly patch cycles.

7. Agent Supply-Chain Attacks: Trojanized AI Skills

Supply-chain attacks have found a new frontier: AI agent “skills.” Researchers from Zenity uncovered a large-scale attack in which trojanized AI skills (instruction/configuration files that tell AI agents how to use tools) were uploaded to the skills.sh marketplace. The malicious skills, which typo-squatted on popular AI services Paperclip and Browser Use, were downloaded more than 1.7 million times in less than a month.

Simultaneously, North Korea’s Sapphire Sleet (BlueNoroff) was formally attributed to a supply-chain attack that compromised 140+ npm packages distributed via the Mastra AI framework. Two self-replicating supply-chain worms—Miasma and IronWorm—emerged from the npm ecosystem in June 2026, explicitly targeting developer AI coding tool credentials.

Defensive measures:

NPM security audit:

 Audit dependencies for known vulnerabilities
npm audit --production
 Check for suspicious postinstall scripts
npm ls --depth=10 | grep -E "(postinstall|preinstall)"

PyPI security check:

 Check Python packages for known issues
pip-audit
 Verify package integrity
pip verify

General best practices:

Treat every data source an AI agent queries as a potential injection vector
Apply least-privilege scoping to agent credentials
Require explicit human approval for any consequential action
Audit AI skills and MCP servers before deployment
Monitor for typo-squatting and suspicious package names

What Undercode Say

Prompt injection is dead; long live promptware. The evolution from isolated input manipulation to the seven-stage promptware kill chain represents a fundamental shift in AI threat modeling. Security teams must adopt defense-in-depth strategies addressing all stages of the kill chain, not just initial access.
AI agents are the new attack surface. The agentjacking, GuardFall, and CoreBreak disclosures prove that AI coding agents and their infrastructure are now prime targets. Traditional security controls are structurally blind to these attacks because they exploit semantic reasoning rather than network or binary vulnerabilities. Organizations must treat agent security as a first-class concern, not an afterthought.
The CrowdStrike moment is here. The convergence of AI-powered vulnerability discovery, autonomous exploitation, and machine-speed attack execution has created a “CrowdStrike moment” for AI security. The industry faces a stark choice: invest now in durable, defense-in-depth AI security architectures, or wait for the inevitable catastrophic incident that forces change. CrowdStrike and Palo Alto Networks have already seen record quarters as AI threats bolster cyber demand—the market has voted.

Prediction

+1 The AI security market will experience explosive growth over the next 18–24 months, driven by mandatory regulatory frameworks and insurance requirements for AI agent deployments. Organizations that proactively implement promptware kill chain defenses will gain significant competitive advantage.

-1 The frequency and severity of AI agent compromises will increase dramatically before defenses mature. The “CrowdStrike moment” for AI—a widespread, cascading failure affecting multiple major AI deployments simultaneously—remains not just possible but probable within the next 12 months.

+1 Defense-in-depth approaches combining least-privilege scoping, semantic guardrails, and architectural controls will become the industry standard, creating new opportunities for security vendors specializing in AI agent protection.

-1 The broken vulnerability disclosure paradigm will worsen as AI-driven discovery outpaces human patching capacity. Expect an increase in zero-day exploitation and “machine-speed” attack campaigns that outrun traditional incident response.

+1 The open-source community will develop robust agent security frameworks, similar to how OWASP and MITRE ATLAS have evolved to address AI threats. “Continue” has already demonstrated that effective defenses are implementable—it’s roughly a two-day job for an experienced engineer.

-1 State-sponsored actors will weaponize AI agent supply-chain attacks at scale, as demonstrated by the Sapphire Sleet campaign. The 1.7 million downloads of trojanized AI skills represent only the beginning of this threat vector.

▶️ Related Video (94% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/earxcG43 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post