Prompt Injection Has Moved From Security Research to Active Corporate Exploitation

Attackers Found the Gap Between What LLMs Promise and What They Do

Enterprises spent the last two years bolting large language models onto support systems, analytics pipelines, developer tooling, and internal automation. The attack surface that created is now being actively worked.

CrowdStrike's 2026 Global Threat Report, drawn from intelligence across more than 280 tracked adversaries, documented prompt injection attacks against more than 90 organizations in 2025 alone. Threat actors injected malicious prompts into legitimate generative AI tools to generate commands that exfiltrated credentials and stole cryptocurrency. The report's phrasing was direct: "Prompts are the new malware." AI-enabled adversaries grew their overall attack volume 89% year-over-year, with prompt injection functioning as both an entry point and a force multiplier.

The Open Worldwide Application Security Project (OWASP) listed prompt injection as LLM01 in its 2025 LLM Top 10, the most critical category of LLM-specific vulnerabilities. That's the second consecutive edition it has held the top spot. OWASP's assessment is that LLMs still cannot reliably separate instructions from data, which is the core design condition that makes prompt injection work.

Two Production Exploits That Were Real, Not Theoretical

In August 2024, researchers at PromptArmor disclosed a prompt injection vulnerability in Slack AI. An attacker who placed a malicious instruction in a public Slack channel, or embedded it in an uploaded document, could cause Slack AI to exfiltrate data from private channels the attacker had no access to, including API keys shared in private developer channels. The vulnerability was patched.

In June 2025, researchers at Aim Security disclosed what they called EchoLeak, assigned CVE-2025-32711 with a CVSS score of 9.3. It targeted Microsoft 365 Copilot and was documented as the first zero-click prompt injection exploit against a production AI system. A single crafted email, requiring no action from the recipient, could cause Copilot to access internal files and transmit their contents to an attacker-controlled server. Microsoft patched it.

Both incidents involved real enterprise tools, real user data, and real potential for damage before patches were applied. The fact that both were patched is good news. The fact that both existed in production systems used by thousands of organizations is the actual story.

Why the Problem Is Structural, Not Just a Bug List

Prompt injection persists because of a fundamental design tension in how LLMs process input. These models were trained to follow instructions embedded in text. When an attacker embeds instructions inside what is supposed to be data—an email, a document, a retrieved web page—the model often cannot tell the difference. The model doesn't have a reliable mechanism to distinguish:

• Instructions from data
• User intent from injected metadata
• Context from manipulated context

This gets harder as deployments grow more complex. Modern enterprise AI isn't a single model answering questions. It's multi-agent systems where one model delegates tasks to another, retrieval-augmented generation (RAG) pipelines that pull documents from internal databases, model routers that direct queries across different AI systems, and long-term memory stores that persist context across sessions. Each handoff point is a potential injection surface.

The Counterargument Worth Taking Seriously

Some security practitioners push back on the framing that prompt injection is uniquely catastrophic. Their argument: every technology layer introduces attack vectors, LLMs are no different from databases or web apps in the early 2000s, and the solution is standard security hygiene applied to a new context. Patching Slack AI and Microsoft 365 Copilot quickly, that argument goes, is exactly how the ecosystem is supposed to work. The vulnerabilities were found by researchers, disclosed responsibly, and fixed.

That view has merit. The Slack AI and EchoLeak patches demonstrate that vendors respond when researchers find problems. Responsible disclosure and rapid patching are functioning, at least for major platforms.

The problem with the reassurance is the CrowdStrike data: over 90 organizations were hit in 2025 before those patches, or through other vectors, by threat actors who were not waiting for academic papers. The 89% year-over-year increase in AI-enabled attack volume suggests the criminal side is scaling faster than the defensive side is adapting.

What Actually Needs to Happen

OWASP's classification and CrowdStrike's incident data point to the same gap. Organizations are deploying AI agents with tool access and data permissions before they have reliable controls for what those agents will do when their inputs are tampered with.

Input validation, least-privilege access for AI agents, monitoring for anomalous data retrieval, and human-in-the-loop checkpoints for high-stakes actions are all documented mitigations. None of them are exotic. Most are analogous to defenses organizations already apply to web applications and APIs.

The unresolved question is whether organizations running RAG pipelines against internal document stores—a common enterprise pattern—have audited what those pipelines would do if an attacker managed to place a crafted document inside the retrieval corpus. In the EchoLeak case, the attack surface was email. In the Slack AI case, it was an uploaded document. Both are ordinary enterprise data flows that happen to also be injection vectors.

CrowdStrike's 2026 report covers 2025 activity. The 2026 numbers aren't in yet.