From Prompt Injection To Agentic Compromise: The Full Attack Chain

Download Description:

Agentic AI systems join probabilistic language models with deterministic tools and privileged runtime environments. This composition creates a security condition in which untrusted content can influence planning, tool selection, parameters, memory, and downstream actions. The resulting attack path resembles a malware campaign more than a malformed chatbot interaction. This paper presents a technical model of the agentic injection kill chain, analyzes each stage, identifies observable artifacts, and proposes a control architecture centered on intent provenance, least agency, capability isolation, and action mediation. It also defines a red-team method for measuring attack success across the full chain rather than at the model-response layer alone.