A wave of prompt injection attacks is targeting enterprise AI systems. Most organizations lack dedicated defenses. Sensitive data and credentials are at risk as attackers exploit new vulnerabilities.
Prompt injection has rapidly become the leading threat to enterprise AI deployments, with attackers now using crafted prompts as a form of malware to steal credentials, exfiltrate data, and siphon cryptocurrency. According to CrowdStrike’s 2026 Global Threat Report, more than 90 organizations suffered prompt injection attacks in 2025, as adversary operations leveraging AI jumped 89% year-over-year. Notably, 82% of these intrusions involved no traditional malicious code, reflecting the shift from simple chatbots to AI agents with broad access to email, code, payments, and file shares.
The vulnerability remains entrenched at the top of the OWASP Top 10 for large language model applications, listed as LLM01 for two consecutive editions. The core issue: language models cannot reliably distinguish between developer instructions and content retrieved from emails, web pages, or documents. This ambiguity has moved from theoretical concern to operational risk, with named adversaries, assigned CVEs, and public admissions from leading AI labs underscoring the scale of the problem.
Prompt injection attacks come in two main forms. Direct injection occurs when a user deliberately overrides a system prompt, such as instructing a chatbot to ignore previous commands. Indirect injection is more insidious: attackers embed malicious instructions in content-like emails, Confluence pages, or uploaded documents-that the AI agent later processes on behalf of another user. In these cases, the payload remains invisible to the user, and the attacker never interacts directly with the model.
Two high-profile incidents highlight the risks. In August 2024, PromptArmor revealed that attackers with workspace access to Slack AI could extract sensitive data, including API keys, from private channels without being members. The attack worked by planting instructions in public channels or uploaded files. In 2025, Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3), the first documented zero-click prompt injection against a production AI system. A single crafted email could trigger Microsoft 365 Copilot to forward internal files to an attacker-controlled server, all without user interaction. Both vulnerabilities were patched, but the underlying class of risk persists and continues to expand across agentic stacks and retrieval-augmented generation (RAG) pipelines.
OpenAI publicly acknowledged in December 2025 that prompt injection, like scams and social engineering, is unlikely to be fully solved. The company described using reinforcement learning to train internal attackers to discover new injection strategies before they appear in the wild. Anthropic’s Claude Opus 4.6 system card disclosed that a graphical-interface agent fell to a single injection attempt 17.8% of the time, with success rates rising to 78.6% over 200 attempts without safeguards and 57.1% even with published defenses. Google reported its most effective attack against Gemini still succeeded 53.6% of the time after adversarial fine-tuning.
Security analysts have responded with stricter guidance. In December 2025, Gartner advised CISOs to block all AI browsers, including ChatGPT Atlas and Perplexity Comet, citing indirect prompt injection and credential exposure risks. This recommendation contrasted with Cyberhaven’s finding that 27.7% of organizations already had at least one user with Atlas installed. The UK National Cyber Security Centre and Germany’s BSI issued similar warnings. For more on how AI adoption strategies are shifting, see this analysis of AI startups prioritizing go-to-market over proprietary models.
Traditional security measures struggle to contain prompt injection because language models process instructions and data through a single text channel. Input validation, output filtering, and signature-based detection all depend on separating trusted commands from untrusted content-a distinction that does not exist inside the model. Vendor guardrails catch only the most common patterns, while classifier-based detection often misses obfuscated, multilingual, or image-encoded attacks. Adversarial training can improve a specific model, but new attacks routinely bypass updated defenses within weeks. Even a 1% failure rate can result in dozens of successful breaches per month for agents running thousands of times daily.
Frameworks are still catching up. NIST AI 600-1 recognizes prompt injection as an information security risk but addresses it at the policy level. OWASP’s December 2025 Top 10 for Agentic Applications added categories for Agent Goal Hijack and Memory and Context Poisoning, but controls remain advisory. CrowdStrike’s reporting found that 65.3% of organizations lack any dedicated prompt injection defenses, relying instead on vendor defaults, policy documents, and awareness training. This approach is insufficient as AI agents gain access to sensitive systems.
Durable defenses must operate outside the model. Enterprises can restrict each agent’s privileges, require human approval for sensitive actions, tag and exclude high-risk retrieval sources, allowlist permitted egress domains, and log every consequential agent action for audit and replay. CISOs evaluating AI products should ask about detection cadence, published attack success rates, which OWASP vulnerabilities are addressed with real controls, and whether security teams can replay the exact prompts and tool calls behind agent actions.
The reality for enterprises deploying AI is clear: models will follow injected instructions some percentage of the time. Only external controls can provide lasting protection. Treating the LLM as the trust boundary is equivalent to deploying a credential thief with a user-friendly interface.
CrowdStrike, founded in 2011 and headquartered in Austin, Texas, has grown into one of the world’s largest cybersecurity firms. As of 2026, the company employs over 7,000 people and reported annual revenues exceeding $3 billion. Its Falcon platform is widely adopted by Fortune 500 companies for endpoint protection and threat intelligence.
