Research demo
Promptware C2: using assistant memory and allowlisted AI platforms as command-and-control
AIR-2026-0088 AIR record · 2026-04-csa-promptware-c2
From the supporting source
By exploiting ChatGPT's memory persistence feature, an attacker could establish a beaconing agent without any dedicated infrastructure.labs.cloudsecurityalliance.org
The record
Disclosed
2026-04-06
Vendor
multiple
Product
ChatGPT, Microsoft 365 Copilot, GitHub Copilot, Google Jules, Grok, Cursor
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — the assistant persisted C2 instructions in memory and acted on them
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Command and control, Data exfiltration, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Assistants with persistent memory and routine file ingestion
Capability abused
Taxonomy & references
Curator notes
CSA AI Safety Initiative research note. Names the technique class rather than a single vendor bug; also cites Unit 42's Dec 2025 in-the-wild IDPI detection as corroboration.
Supporting sources
Cite as
Enkrypt AI. "Promptware C2: using assistant memory and allowlisted AI platforms as command-and-control". AIR, AIR-2026-0088. https://agentincident.vercel.app/i/AIR-2026-0088/ (accessed 2026-10-19).