Promptware-Powered Command and Control (Agent Commander)
First seen Jul 5, 2026 · Updated Jul 5, 2026
This post describes 'promptware'-based command and control, where prompt injection payloads act like malware to give attackers persistent, remote-controlled influence over an AI agent's actions. It builds on prior research showing that combining browsing tools with persistent memory features can create a full C2 channel, letting an attacker issue ongoing instructions to a compromised agent over time.
Technical Analysis
The attack chain works by injecting malicious instructions into content an agent processes (e.g., web pages during browsing tasks), which the agent then treats as trusted input. When combined with persistent memory features, these injected instructions can be stored and re-invoked in future sessions, effectively giving an attacker a foothold that resembles malware C2 beaconing: the agent periodically 'checks in' with attacker-controlled content and executes updated instructions. The entry point is any untrusted content ingestion path (browsing, tool output, retrieved documents), and the attacker's gain is durable, remote command execution over the agent's behavior without needing further access. This crosses the boundary between a single prompt-injection event and a stateful, ongoing compromise by abusing memory persistence and tool/browsing capabilities together.
Affected Systems
ChatGPT (browsing and memory features)
Detection Signatures
- Unexpected changes to stored agent memory/preferences not initiated by the user
- Repeated outbound browsing/tool calls to attacker-controlled or unusual domains across sessions
- Agent behavior changes correlating with previously visited untrusted web content
- Instructions embedded in web page text, comments, or metadata that resemble command syntax (e.g., 'ignore previous instructions', 'remember this for future tasks')
- Memory entries containing imperative task instructions rather than user-stated facts/preferences
Remediation Steps
- 1
Sanitize and isolate untrusted content
Treat all browsed/tool-retrieved content as untrusted data; strip or neutralize embedded instructions before passing to the model context.
- 2
Restrict memory write triggers
Require explicit user confirmation before persisting any memory entries derived from external/untrusted content, especially instruction-like statements.
- 3
Audit persistent memory regularly
Implement automated scanning of stored agent memories for anomalous, instruction-like, or suspicious content and alert on drift from expected patterns.
- 4
Limit agent autonomy on repeated tool loops
Rate-limit or flag agents that repeatedly browse to the same domains or execute recurring task patterns without new user intent.
- 5
Segment capabilities
Avoid combining high-risk capability pairs (persistent memory + autonomous browsing/tool execution) without strict human-in-the-loop checkpoints.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.