A new class of AI-specific malware called 'promptware' exploits the architectural flaw in LLMs where instructions and data are indistinguishable. Based on Bruce Schneier's research, the promptware kill chain mirrors traditional cyberattack stages: initial access via prompt injection, privilege escalation through jailbreaking, reconnaissance of connected tools and APIs, persistence via long-term memory stores like RAG databases, command-and-control through the LLM's internet access, lateral movement across interconnected agents, and final action on objective such as data theft or code execution. Defenses require a zero-trust approach — treating AI agents as untrusted execution environments, limiting tool access, constraining privileges, and designing systems to break the kill chain at each stage rather than relying on preventing initial access.