S0 --> S1 --> S2 --> S3 --> S4 --> S5 --> S6 --> S7
S7 --> S7A
S7 --> S7B
S7 --> S7C

classDef new fill:#ffe6e6,stroke:#cc0000,stroke-width:2px,color:#000
classDef mod fill:#fff4d6,stroke:#cc8800,stroke-width:2px,color:#000
classDef expanded fill:#e6f0ff,stroke:#0044cc,stroke-width:2px,color:#000

Red is new, yellow is original with AI sub-techniques, blue is original but structurally expanded.

The framework adds three things to the seven-stage original. A new pre-attack Stage 0 sits in front of Reconnaissance to cover adversary activity against the AI supply chain. Each original stage picks up its own AI-specific sub-techniques with EKC IDs, so detection rules and threat reports can reference them. Stage 7 splits into three peer sub-stages: classical exfiltration stays in place as 7a, with Model Extraction (7b) and Agentic Pivot (7c) added next to it. These are not variants of exfiltration. They are distinct adversary objectives that need their own controls.

## Stage-by-stage specification

Each stage spec below covers four things. What the adversary is doing. The AI-specific sub-techniques (with `EKC` IDs that can be cited in detection rules and threat reports). The detection signals a defender can act on. The mitigations.

### Stage 0. Model Supply Chain Compromise (new)

**What the adversary is doing.** Compromising a model, dataset, fine-tuning adapter, or distribution channel that the target organization will pull into its own AI systems later. The adversary never touches the target's network. They put the compromise into the supply chain and wait.

**Sub-techniques.**

| ID | Sub-technique | Description |
|----|---------------|-------------|
| EKC-0.1 | Training data poisoning | Inject manipulated examples into a public dataset, web-scraped corpus, or labeling pipeline that future training runs will ingest. |
| EKC-0.2 | Fine-tuning backdoor | Distribute a fine-tuning adapter, LoRA, or full-model checkpoint with a hidden trigger-and-behavior pair. |
| EKC-0.3 | Pre-trained model trojan | Publish a malicious model to a public registry (Hugging Face, Ollama Library, GitHub) under a plausible name or by typosquatting a real one. |
| EKC-0.4 | Tokenizer or preprocessing manipulation | Alter tokenization, normalization, or feature-extraction code in an upstream dependency to add a covert input channel. |
| EKC-0.5 | Malicious MCP server or tool catalog entry | Publish a tool description, MCP server manifest, or function definition designed to be invoked by downstream agents and exploit them through prompt injection in the tool description itself. |

**Detection signals.**
- Provenance gaps in deployed model artifacts (no signed manifest, no known training-data lineage).
- Cryptographic hash drift between a model pulled from a registry today and the same identifier pulled at a prior date.
- Tool descriptions from third-party MCP servers that contain unusually long, instruction-like text or non-printable characters.
- Anomalous neuron-activation distributions in a deployed model when probed with a curated trigger suite.

**Primary mitigations.**
- Keep a model bill of materials (M-BOM) for every deployed model, including base model identity, fine-tuning data hashes, and adapter provenance.
- Sign and verify model artifacts. Pin specific commit hashes for registry-hosted models.
- Quarantine and sandbox newly added MCP servers. Review tool descriptions as untrusted input.
- Routine backdoor-trigger scanning against deployed models using published benchmarks.

### Stage 1. Reconnaissance (AI-augmented)

**What the adversary is doing.** Finding the target's AI systems, what they can do, what their guardrails are, and what they connect to.

**AI-augmented sub-techniques.**

| ID | Sub-technique | Description |
|----|---------------|-------------|
| EKC-1.1 | Model fingerprinting | Identify the base model, fine-tune family, and version of a deployed LLM through response-style probing, latency analysis, or known-answer tests. |
| EKC-1.2 | System prompt enumeration | Use leakage queries, role-play probes, or boundary-case prompts to recover the system prompt or its main constraints. |
| EKC-1.3 | Capability and tool enumeration | Discover which tools, plugins, MCP servers, or function-call interfaces the agent has access to. |
| EKC-1.4 | Guardrail mapping | Map the policy boundary by probing refusal patterns and finding topics, formats, or input shapes that bypass classifiers. |
| EKC-1.5 | Embedding and retrieval surface discovery | Identify which retrieval sources the system reads from (vector store contents, document corpora, web fetch domains). |

**Detection signals.** High-entropy prompt sessions from a single source. Systematic exploration of refusal boundaries. Queries that closely match published jailbreak corpora. Repeated requests for the system to "repeat the instructions above."

**Primary mitigations.** Rate-limit and behavior-cluster prompt traffic per user identity. Redact identifying response artifacts. Add canary tokens to the system prompt that fire on exfiltration. Restrict tool enumeration to authenticated, audited callers.

### Stage 2. Weaponization (AI-augmented)

**What the adversary is doing.** Building a payload that will be delivered to the target.

**AI-augmented sub-techniques.**

| ID | Sub-technique | Description |
|----|---------------|-------------|
| EKC-2.1 | Adversarial prompt crafting | Build a prompt-injection payload tailored to the fingerprinted target model, guardrails, and toolset from Stage 1. |
| EKC-2.2 | Multi-modal payload construction | Embed instructions in images, audio, PDFs, or structured documents that a multi-modal model will parse. |
| EKC-2.3 | Malicious tool or MCP package | Build a tool that looks benign in name and description but executes attacker-controlled actions when invoked. |
| EKC-2.4 | Jailbreak chain assembly | Combine known bypass techniques (persona priming, encoding tricks, low-resource language pivots, structured role-play) into a single payload that defeats layered guardrails. |
| EKC-2.5 | AI-generated polymorphic malware | Use a model to produce semantically equivalent but lexically diverse malware variants that evade signature-based detection. |

**Detection signals.** Pattern matches against known indirect-injection markers in inbound content. Image, PDF, and audio analysis for steganographic instructions. Static analysis of newly registered MCP packages.

### Stage 3. Delivery (AI-augmented)

**What the adversary is doing.** Getting the payload to the AI system or its operator.

**AI-augmented sub-techniques.**

| ID | Sub-technique | Description |
|----|---------------|-------------|
| EKC-3.1 | Indirect prompt injection via web content | A browsing or web-fetching agent retrieves an attacker-controlled page with instructions in it. |
| EKC-3.2 | RAG corpus poisoning | An attacker submits content (via support tickets, public docs, code contributions, or vector-store ingestion) that will later be retrieved as context for an LLM. |
| EKC-3.3 | Email or message-borne injection | Instructions placed in an email that an AI assistant is configured to read or summarize. |
| EKC-3.4 | Document-borne injection | Instructions placed in PDFs, spreadsheets, or office documents processed by an AI workflow. |
| EKC-3.5 | Tool-description poisoning | Instructions placed in the descriptions or schemas of MCP tools or function definitions exposed to the agent. |
| EKC-3.6 | Image, audio, or QR-code injection | Instructions encoded in non-text modalities that a multi-modal agent will process. |

**Detection signals.** Anomalous instruction-like text in untrusted content streams. High entropy in image alpha channels and metadata for multi-modal pipelines. Unexpected language shifts inside retrieved documents.

### Stage 4. Exploitation (AI-augmented)

**What the adversary is doing.** Triggering the payload. In AI terms: getting the model to follow the attacker's instructions or violate its policy.

**AI-augmented sub-techniques.**

| ID | Sub-technique | Description |
|----|---------------|-------------|
| EKC-4.1 | Direct prompt injection success | The user-facing prompt achieves the attacker's policy violation. |
| EKC-4.2 | Indirect prompt injection success | Instructions delivered via Stage 3 are followed by the model when the content is processed. |
| EKC-4.3 | Confused-deputy tool invocation | The model invokes a privileged tool on behalf of the attacker, using the agent's own permissions. |
| EKC-4.4 | Guardrail or classifier bypass | A safety classifier or rule-based filter is evaded such that disallowed content is produced or disallowed actions are taken. |
| EKC-4.5 | Memory or context pollution | A persistent memory store is updated with attacker-controlled content that will influence future sessions. |

**Detection signals.** Tool invocations whose arguments derive from untrusted input strings. Outputs that include canary tokens from the system prompt. Large-step deviations in conversation state caused by a single retrieved document.

### Stage 5. Installation (AI-augmented)

**What the adversary is doing.** Setting up persistence so the compromise survives a single session.

**AI-augmented sub-techniques.**

| ID | Sub-technique | Description |
|----|---------------|-------------|
| EKC-5.1 | Persistent memory implant | Inject content into long-term memory, user preference stores, or per-account context that will be reloaded in future sessions. |
| EKC-5.2 | System prompt override | Modify a custom GPT, assistant configuration, or agent definition to embed attacker instructions in its system prompt. |
| EKC-5.3 | Malicious connector installation | Cause a user or admin to install an attacker-controlled MCP server, plugin, or browser extension that gives the attacker a persistent foothold. |
| EKC-5.4 | RAG corpus persistence | Ensure poisoned documents stay in the vector store across re-indexing operations. |
| EKC-5.5 | Stored skill or workflow contamination | Modify a stored skill, automation, or saved workflow that the agent will load and execute on a schedule or on demand. |

**Detection signals.** New entries in memory stores not attributable to a legitimate user action. Unauthorized changes to system prompts, custom GPTs, or saved skills. Newly registered MCP endpoints. Vector-store ingestion events outside expected pipelines.

### Stage 6. Command and Control (AI-augmented)

**What the adversary is doing.** Holding an interactive or scheduled channel that lets them direct further activity.

AI agents introduce new C2 channels. ATLAS now covers some of these (for example, AI Service API AML.T0096; the SesameOp case study AML.CS0042 documents the OpenAI Assistants API being used as C2 infrastructure). The sub-techniques below organize the same phenomena as kill-chain stages.

**AI-augmented sub-techniques.**

| ID | Sub-technique | Description |
|----|---------------|-------------|
| EKC-6.1 | LLM channel as C2 | Encode commands in seemingly benign user prompts, retrieved documents, or tool outputs that the agent reads on a schedule. |
| EKC-6.2 | Memory-mediated C2 | Use the agent's long-term memory store as a dead-drop. The attacker writes instructions to memory through one entry point, the agent acts on them through another. |
| EKC-6.3 | RAG-mediated C2 | Update a poisoned document in the vector store to deliver new instructions. The agent retrieves them on the next relevant query. |
| EKC-6.4 | Tool-output C2 | A compromised MCP server returns instruction-laden responses on each invocation, steering the agent's subsequent behavior. |
| EKC-6.5 | Cross-session steganographic C2 | Encode command payloads in fields the agent passes between sessions (user notes, project descriptions, ticket comments) where they evade content classification because each fragment looks innocuous on its own. |

**Detection signals.** Conversation-graph analysis showing instructions repeatedly arriving from the same retrieved source. Outputs from external tools containing imperative language inconsistent with the tool's documented purpose. Entropy analysis on agent-to-agent fields.

### Stage 7. Actions on Objectives (expanded)

**What the adversary is doing.** Achieving the mission. Stage 7 splits into three peer sub-stages because AI systems make two new classes of objective viable that did not previously exist as first-class targets.

#### Sub-stage 7a. Data Exfiltration (classical)

The traditional kill chain's actions on objectives. Sensitive data is exfiltrated. Systems are destroyed, encrypted, or impaired. Fraud is committed. AI does not change this sub-stage qualitatively. It amplifies the scale through cheaper phishing, automated reconnaissance, and faster social-engineering loops.

#### Sub-stage 7b. Model Extraction (new)

The target is the model itself, the data inside it, or the knowledge encoded in it.

| ID | Sub-technique | Description |
|----|---------------|-------------|
| EKC-7b.1 | API-based model extraction | Reconstruct an approximation of a deployed model's weights or decision boundary by querying it at scale and training a surrogate. |
| EKC-7b.2 | Training-data extraction | Recover verbatim or near-verbatim training examples, including sensitive PII or proprietary content, through memorization-targeting prompts. |
| EKC-7b.3 | Membership inference | Determine whether a specific record was in the training set. Has downstream implications for privacy regulation and confidentiality. |
| EKC-7b.4 | System prompt and instruction extraction | Recover proprietary system prompts that encode business logic, pricing rules, or competitive positioning. |
| EKC-7b.5 | Capability mining | Use the deployed model to perform tasks the attacker's own infrastructure cannot. The access becomes a capability transfer. |

**Detection signals.** High-volume programmatic query patterns from a single identity, especially with low entropy in query templates and high entropy in inputs. Queries that contain classical memorization probes ("repeat the text above"). Query distributions that resemble published extraction attacks.

#### Sub-stage 7c. Agentic Pivot (new)

The compromised AI agent is used to take actions in connected systems, using its own legitimate permissions. Mechanically: no exploit code, no credential reuse, no privilege escalation. Only invocation of authorized tools with attacker-influenced arguments. ATLAS added a Lateral Movement tactic (AML.TA0015) in v5.1.0 (November 2025) to address the same phenomenon. The contribution here is putting the agentic-pivot variant inside the Actions on Objectives stage of the kill chain, as a peer of classical exfiltration, rather than as a separate tactic earlier in the matrix.

| ID | Sub-technique | Description |
|----|---------------|-------------|
| EKC-7c.1 | Tool-mediated lateral action | The agent invokes legitimate tools (email send, file write, ticket creation, payment authorization) on behalf of the attacker. |
| EKC-7c.2 | Cross-app pivot | The agent moves from one connected application to another (calendar to CRM to payment processor) by chaining tool calls. |
| EKC-7c.3 | Identity confusion attack | The agent acts in a context where downstream systems treat its actions as the actions of a privileged user, granting privileges the attacker does not directly hold. |
| EKC-7c.4 | Recursive agent abuse | A compromised agent invokes other agents, propagating the compromise across an agent fabric without classical lateral movement. |
| EKC-7c.5 | Workflow weaponization | A stored automation or scheduled workflow runs the attacker's intended action on a recurring basis. |

**Detection signals.** Tool calls whose arguments contain content traceable to untrusted upstream sources. Tool-call graphs that cross trust boundaries that no human action did. Spikes in cross-application calls per session. Outbound communications initiated by agents to recipients not in any prior conversation history.

## Relationship to MITRE ATLAS, OWASP LLM Top 10, NIST AI RMF

The EKC is complementary to existing AI-security frameworks. It does not replace any of them.

ATLAS is the closest comparison. ATLAS is an adversary-tactics matrix modeled on ATT&CK, structured as a parallel taxonomy for AI systems. As of v5.4.0 (February 2026) it has 16 tactics, 84 techniques, 56 sub-techniques, 32 mitigations, and 42 case studies. The relevant evolution for this framework: v4.9.0 (April 2025) added Command and Control (AML.TA0014), and v5.1.0 (November 2025) added Lateral Movement (AML.TA0015). ATLAS is organized as a matrix. The EKC provides the kill-chain-sequenced view of the same threat surface. Most EKC sub-techniques map to one or more ATLAS techniques; see [`mappings/mitre-atlas-mapping.md`](https://github.com/gouravnagar-infosec/ai-kill-chain/blob/main/mappings/mitre-atlas-mapping.md). Use both: EKC for defenders who reason in kill-chain stages, ATLAS for red teamers and threat-intel analysts who reason in tactics-techniques matrices.

The OWASP Top 10 for LLM Applications (2025), published in November 2024 by the OWASP GenAI Security Project, is a risk-prioritization list for application developers. Its ten categories are: Prompt Injection (LLM01), Sensitive Information Disclosure (LLM02), Supply Chain (LLM03), Data and Model Poisoning (LLM04), Improper Output Handling (LLM05), Excessive Agency (LLM06), System Prompt Leakage (LLM07), Vector and Embedding Weaknesses (LLM08), Misinformation (LLM09), and Unbounded Consumption (LLM10). The list is organized by risk category. It does not specify where in an attack each risk is exploited. The EKC's mapping file (`mappings/owasp-llm-mapping.md`) provides that view: each OWASP category mapped to the EKC stages where the vulnerability becomes operational.

The NIST AI Risk Management Framework (AI RMF 1.0) operates at a different level. It provides four governance functions (Govern, Map, Measure, Manage) for AI risk. The associated Generative AI Profile (NIST AI 600-1, July 2024) catalogs twelve risk categories specific to generative AI with over 200 suggested actions. These are programmatic risk-management frameworks, not adversary models. The EKC provides the adversary-side detail that the NIST RMF's Map and Measure functions need to be operationally complete.

ATT&CK remains the canonical adversary-tactics framework for non-AI cyber operations. Stages 1 through 7 of the EKC are fully compatible with ATT&CK techniques used at those stages. The EKC adds AI-specific sub-techniques on top of that compatibility, without trying to replace ATT&CK's coverage of classical adversary behavior.

## Worked case studies

[`examples/case-studies.md`](https://github.com/gouravnagar-infosec/ai-kill-chain/blob/main/examples/case-studies.md) walks four scenarios through the kill chain end to end:

1. Indirect prompt injection of a browsing agent. A public web page contains instructions that hijack the agent's tool-use behavior to exfiltrate the user's open-tab content.
2. MCP server compromise. A third-party MCP server published to a public registry contains a backdoor in its tool descriptions that triggers when a downstream agent queries a specific topic.
3. RAG corpus poisoning of an enterprise assistant. An attacker submits a support ticket whose contents are ingested into the company's RAG corpus and later retrieved by an internal assistant, causing it to disclose sensitive configuration.
4. API-based model extraction against a proprietary domain model. A competitor uses authenticated API access to query a fine-tuned domain model at scale, training a surrogate that replicates much of its behavior.

Each case study maps observed adversary behavior to specific EKC sub-technique IDs and identifies the detection signals that would have surfaced the activity earliest.

## Detection and mitigation guidance

The kill-chain disruption logic carries over. Break one stage, break the chain. Defender teams should spread controls across stages rather than concentrate them at one point.

Highest-leverage controls by stage:- **Étape 0.** Bill of materials du modèle. Artefacts signés. Épinglage de registre. Sondage périodique de backdoors.
- **Étape 1.** Analyse comportementale du trafic de prompts. Jetons canaries dans les prompts système. Limites de débit sur les requêtes ressemblant à des sondages.
- **Étapes 2 et 3.** Détection d'injection indirecte sur chaque flux de contenu entrant non fiable : web, courriel, corpus RAG, descriptions d'outils MCP, entrées multimodales.
- **Étape 4.** Traçabilité de la lignée des arguments d'appels d'outils. Tout appel d'outil dont les arguments proviennent d'un texte non fiable est traité par défaut comme à haut risque.
- **Étape 5.** Pistes d'audit des écritures mémoire. Contrôle des modifications sur les prompts système et les compétences stockées. Attestation sur les points de terminaison MCP.
- **Étape 6.** Analyse du graphe de conversation pour faire émerger les sources récurrentes d'instructions. Analyse d'entropie sur les champs agent-à-agent.
- **Étape 7a.** DLP classique, surveillance, segmentation.
- **Étape 7b.** Analyses de motifs de requêtes. Sondes de mémorisation dans les suites d'équipe rouge. Tatouage des sorties du modèle.
- **Étape 7c.** Limites de rayon d'explosion par outil. Humain dans la boucle pour les outils à fort impact. Vérification de la propagation d'identité : le système en aval sait-il qu'il agit au nom d'un agent, et non d'un utilisateur ?

## Déclaration d'originalité

Ce que ce cadre apporte que les travaux antérieurs n'offrent pas :

1. Une intégration séquencée en kill chain des menaces de l'ère IA avec le modèle Lockheed Martin. Le flux temporel et la logique de disruption des étapes autour desquels les équipes défensives ont construit leurs opérations depuis plus d'une décennie sont préservés. MITRE ATLAS, l'OWASP LLM Top 10 et le NIST AI RMF sont tous organisés sous forme de matrices ou de listes de priorité de risques ; aucun n'est une kill chain.
2. L'étape 0 (Compromission de la chaîne d'approvisionnement du modèle) comme une seule étape pré-attaque. L'empoisonnement des données d'entraînement, les backdoors de fine-tuning, la distribution malveillante de modèles et d'adaptateurs, et le compromis du catalogue d'outils sont consolidés ici en une étape séquentielle unique qui précède les sept étapes canoniques. ATLAS distribue les techniques équivalentes à travers les tactiques de Resource Development, d'Initial Access et de ML Model Access. La formulation en une seule étape est la contribution.
3. L'étape 7 divisée en trois sous-étapes de même niveau. L'extraction de modèle (7b) et le pivot agentique (7c) sont nommés comme des objectifs adverses de première classe aux côtés de l'exfiltration de données classique (7a), à l'intérieur de l'étape Actions on Objectives. Cela soutient la conception de playbooks SOC qui fonctionnent déjà sur la colonne vertébrale des sept étapes.
4. Le schéma d'IDs de sous-technique `EKC-x.y`. Les IDs sont conçus pour être référencés dans les règles de détection, les rapports de menaces et la documentation SOC, avec des références croisées one-to-many vers les techniques MITRE ATLAS et les catégories OWASP LLM Top 10.
5. Un cadrage côté défenseur tout au long. Le cadre est optimisé pour l'ingénierie de détection et l'usage SOC, où l'étape de la kill chain est l'unité d'analyse, plutôt que pour la taxonomie d'équipe rouge ou les cas d'usage de catégorisation de risques qui fonctionnent mieux sous forme de matrices.

Le cadre s'appuie sur la Lockheed Martin Cyber Kill Chain (Hutchins, Cloppert et Amin, 2011) et sur le traitement opérationnel dans Nagar et Kumar (2025). La structure originale en sept étapes reste en place. ATLAS et l'OWASP LLM Top 10 restent en place. Il s'agit de la vue kill chain de la même surface de menace, pour le public qui travaille déjà dans ces termes.

## Comment citer

Citation recommandée (APA) :

> Nagar, G. (2026). *Extended Cyber Kill Chain for AI-Era Threats* (Version 1.0) [Framework]. Zenodo. https://doi.org/10.5281/zenodo.20349357

BibTeX:```bibtex
@misc{nagar2026extendedkillchain,
  author       = {Nagar, Gourav},
  title        = {Extended Cyber Kill Chain for {AI}-Era Threats},
  year         = {2026},
  month        = {5},
  version      = {1.0},
  publisher    = {Zenodo},
  doi          = {10.5281/zenodo.20349357},
  url          = {https://doi.org/10.5281/zenodo.20349357},
  howpublished = {\url{https://doi.org/10.5281/zenodo.20349357}},
  note         = {Extends the kill-chain treatment in Nagar and Kumar (2025), Cyber Security Kill Chain: Tactics and Strategies, Packt Publishing.}
}