Over the past two years, businesses have integrated large language models (LLMs) into support, analytics, development and internal automation at an unprecedented pace. Alongside wider AI adoption, another trend has accelerated: cybercriminals are exploiting the gap between assumptions about LLMs and their actual behavior.
Multiple independent sources in 2025 and 2026 highlighted the same trend: prompt injection continues to be one of the most impactful and widely demonstrated attack vectors against LLM systems. The OWASP LLM Top 10 (2025) lists prompt injection as LLM01, identifying it as the most critical category of LLM‑specific vulnerabilities for a second consecutive edition. OWASP's ranking reflects that LLMs still struggle to reliably separate instructions from data, leaving them open to manipulation via crafted inputs.
CrowdStrike's 2026 Global Threat Report — built on frontline intelligence across more than 280 tracked adversaries — documented that in 2025 threat actors injected malicious prompts into legitimate generative AI tools at more than 90 organizations. They used those injections to generate commands that stole credentials and cryptocurrency. The report put it plainly: "Prompts are the new malware." AI‑enabled adversaries increased overall attack volume by 89% year‑over‑year, with prompt injection serving as both an entry point and a force multiplier.
Real‑world incidents illustrate the operational impact. In August 2024, researchers at PromptArmor disclosed a prompt injection vulnerability in Slack AI that allowed an attacker to exfiltrate data from private Slack channels they had no access to — including API keys shared in private developer channels — by placing a malicious instruction in a public channel or embedding it in an uploaded document.
In June 2025, researchers at Aim Security disclosed EchoLeak (CVE‑2025‑32711, CVSS 9.3), the first documented zero‑click prompt injection exploit against a production AI system, targeting Microsoft 365 Copilot. By sending a single crafted email, with no user interaction required, an attacker could cause Copilot to access internal files and transmit their contents to an attacker‑controlled server.
Both vulnerabilities were patched. These incidents underscore that prompt injection is not a theoretical weakness but a practical, repeatable threat organizations must address when deploying AI systems at scale.
Evolution of techniques and expanding attack surface
Prompt injection techniques have evolved in recent years and now target:
- Cross‑model prompt injection: corrupting one model’s output knowing other models will process that content, propagating corruption across AI systems.
- RAG supply‑chain poisoning: attackers create malicious documentation, blog posts or GitHub READMEs and wait for enterprises' RAG pipelines to ingest them, then use that content as an attack vector.
- Agent hijacking: AI agents are capable of sending emails, modifying cloud infrastructure, executing code snippets and interacting with internal systems; a single instruction can cause harmful behavior.
- Context overflow attacks: with million‑token context windows, attackers embed malicious code in documents hoping an LLM will encounter and execute it, overriding prior instructions.
- Memory poisoning: long‑term memory implementations can be injected with instructions that permanently reconfigure model state.
- Model‑router manipulation: as enterprises use model routers to select between multiple LLMs, attackers craft prompts that force routing to the weakest or least‑guarded model.
The enterprise challenge: too much trust
Enterprises deploy LLMs to process instructions, summarize information and trigger automated workflows, but models struggle to distinguish reliably between:
- instructions and data,
- information and context,
- context and metadata,
- user intent and metadata.
This creates opportunities for attackers to manipulate model behavior directly or indirectly.
Why this matters for business leaders
Prompt injection is not hypothetical. It directly affects:
- customer‑facing systems (chatbots, support agents),
- internal copilots (developer tools, security assistants),
- automation workflows (ticketing, cloud operations, HR processes),
- data governance (RAG pipelines, knowledge bases).
By 2026, prompt injection can trigger unauthorized actions, leak sensitive data, corrupt internal workflows, manipulate analytics, alter business logic and compromise multi‑agent systems. The attack surface has expanded dramatically.
What enterprises should do now
- Constrain model permissions: limit what the model can do, not just what it should do.
- Segment untrusted content: treat all external data — including RAG sources — as potentially hostile.
- Monitor tool invocation: require human approval for high‑impact actions.
- Validate content provenance: ensure RAG pipelines don't ingest poisoned external content.
- Harden model routers: prevent attackers from forcing routing to weaker models.
- Treat LLMs as untrusted components: this mindset shift is the foundation of modern AI security.
Bottom line
Prompt injection remains the most effective way to compromise enterprise AI systems because it exploits the fundamental manner in which LLMs interpret text. Until organizations treat LLMs as untrusted interpreters — not autonomous decision‑makers — prompt injection will continue to dominate the AI threat landscape.
Julie Brunias, AI Security Architect
