AI Kill Chain: Put Controls at the Transitions

An AI kill chain is useful when it forces a security review to name each transition in an attack. The adversary gathers information and gains access before interacting with a model or AI application. It can then reach another capability and collect something valuable before producing an outcome. Each step has a different owner and evidence source. A single box labelled "AI security" hides those handoffs and almost guarantees that two teams assume the other one is watching.

TL;DR

• Treat the AI kill chain as an analysis method built from observable transitions; each operation follows its own sequence.
• Map every transition to four fields: its precondition and control owner, plus its evidence source and containment action.
• An HTTP AI gateway covers routed model requests and responses. Identity compromise and endpoint execution sit elsewhere, as do training pipelines.
• Test the handoffs with one attack path and one request ID before relying on the diagram.

The AI kill chain starts with a real path

MITRE ATLAS provides a stronger foundation than an invented six-box slide. The official ATLAS data set begins with Reconnaissance and Resource Development before Initial Access. Its later tactics cover AI Model Access and Execution. Other behaviors include Persistence, Defense Evasion, Credential Access, Discovery, Collection and Exfiltration, as well as Impact. An operation can use only a subset or repeat a tactic while moving between conventional infrastructure and an AI component.

Build the chain around a system you run. Start with an authenticated customer-support agent that retrieves account records and calls an external model over HTTPS. Draw four groups: the browser and application; the identity provider and retrieval service; the model route and tools; and the audit stores. Then trace one plausible adversary objective through those components.

I distrust kill-chain diagrams with identical arrows between every box. Real transitions have protocols and credentials tied to policy decisions. Put those labels on the arrow or the diagram has no operational value.

Access and model interaction are different transitions

Initial access might occur through a stolen session or compromised endpoint. An exposed application creates another route. Those events belong to IAM or application-security controls. Endpoint compromise stays with endpoint controls. Model interaction begins when the compromised or malicious actor can place content into an AI workflow or call a model route.

The distinction changes containment. Revoking a session can stop a compromised user. Blocking one prompt pattern addresses a request but leaves the identity active. Removing a tool permission can limit an agent's actions even when the model continues to answer. The AI agent lateral movement analysis shows why a credential and a model request should remain separate events in the timeline.

For every transition, write four fields beside the arrow: precondition and decision point, followed by evidence and owner. The model-request arrow may carry authenticated identity and route authorization. It may also carry prompt classification and a policy decision. The endpoint-execution arrow needs process and host telemetry. Asking one product to own both produces missing evidence.

Model behavior can open the next stage

Prompt injection and jailbreaking operate during model interaction, but their objectives differ. A jailbreak targets provider safety behavior. Prompt injection targets the application's instructions or trusted context. In an agent, a successful injected instruction may ask for a tool call or retrieve sensitive material. It may also shape output consumed by another system.

OWASP's Top 10 for LLM and Generative AI applications separates Prompt Injection and Sensitive Information Disclosure from Improper Output Handling and Excessive Agency. That separation helps a kill-chain review identify the transition at risk. The model may produce attacker-shaped text, while the application creates impact only when it trusts that text as a command or exposes protected data.

The prompt injection techniques guide covers payload placement. The chain review should identify the data or tool that becomes reachable after the model follows the instruction. Do the same for a route or external destination. Scope that capability before tuning a detector.

Controls belong on the arrows

A useful kill-chain review assigns controls to transitions instead of surrounding the whole diagram with a shield. Identity verification sits before application access. Per-request authorization sits before a routed model call. Tool authorization belongs before execution. Output validation belongs before another component treats model text as data or instruction. Egress controls govern an outbound transfer.

NIST's Adversarial Machine Learning taxonomy establishes common terminology for attacks and mitigations across predictive and generative AI systems. Its scope includes evasion and data poisoning, along with privacy and large language models. That range is a warning against shrinking the entire AI threat model to prompt inspection.

For HTTP model traffic, an enforcement point can evaluate supplied identity and role, then apply policy based on destination and data classification before the call proceeds. It can also preserve the decision. Application patching and endpoint-token revocation stay with their respective owners. Provider training validation does too. Mark each exclusion on the architecture drawing.

Evidence should connect adjacent stages

An incident timeline becomes readable when adjacent systems share stable identifiers and synchronized time. The application event should identify the initiating user or agent. The model-request record should carry the route and policy decision. Tool execution should retain its authorization context. Later response work needs to connect those records without guessing which model call triggered which action.

Run a tabletop with one concrete path. At 10:14 a.m., a test user submits a retrieved document containing an injected instruction. The agent requests an unapproved model route and then attempts a customer-record export. Ask each owner to produce the record for their transition. A blank screen or an unsearchable log exposes the gap. So does a timestamp with no identity.

The AI agent red-teaming guide recommends preserving successful attack chains as regression cases. That is the right unit. A single malicious prompt may be blocked while another route reaches the same objective through a different sequence.

Containment has to match the broken transition

Containment options should be prepared beside the evidence map. An identity incident may require session revocation. A compromised application route may need isolation. A model-request policy can deny a destination or data class. Tool access can be reduced at its authorization layer. Exfiltration may require an egress block and legal escalation.

This is also where the AI kill chain prevents inflated gateway claims. Local code execution and STDIO traffic bypass an HTTP LLM proxy. Credential theft happens before the request boundary. Calls sent around the approved route also bypass it. The gateway can enforce only traffic that reaches its policy point with usable identity context.

The opinion I would defend in a budget meeting is simple: fund the transitions before buying another dashboard. A dashboard can aggregate missing records into a cleaner empty panel. The missing inline decision stays missing after the chart renders.

DeepInspect

DeepInspect sits on one set of AI kill-chain transitions: HTTP requests and responses between authenticated users or agents and LLM endpoints. For deliberately routed traffic, it evaluates identity-aware policy before the request proceeds and creates a per-decision audit record.

The surrounding chain still needs IAM and application security. It also needs endpoint controls, tool authorization and incident response. DeepInspect supplies an enforcement point and evidence at the AI request boundary. The rest of the attack surface remains under those adjacent controls.

Book a technical deep dive at deepinspect.ai.