Prompt injection attacks hit over 90 firms in 2025 as AI security risks escalate

Prompt Injection Attacks Target 90+ Organizations in 2025

CrowdStrike's 2026 Global Threat Report has documented a concerning escalation in prompt injection attacks, revealing that threat actors successfully targeted more than 90 organizations during 20252

2

. These prompt injection attacks generated malicious commands that stole credentials and cryptocurrency, fundamentally changing how cybercriminals exploit LLM applications. The report, built on frontline intelligence across more than 280 tracked adversaries, stated it plainly: "Prompts are the new malware"1

1

. AI-enabled adversary operations increased by 89% year-over-year, with 82% of intrusions involving no traditional malicious code2

2

. This shift occurred as enterprises transitioned to using agents, copilots, and browser automations that access email, code, payments, and file shares.

Enterprise AI Design Flaws Create Critical Vulnerabilities

The OWASP LLM Top 10 (2025) lists prompt injection as LLM01, identifying it as the most critical category of LLM-specific vulnerabilities for the second consecutive edition1

1

. OWASP's ranking reflects a fundamental enterprise AI design flaw: LLMs struggle to reliably separate instructions from data, making them susceptible to manipulation through crafted inputs. The core challenge stems from how businesses deploy these systems to process instructions, summarize information, and trigger automated workflows, yet the models cannot distinguish instructions from data, information from context, or user intent from metadata1

1

. This creates opportunities for attackers to manipulate model behavior either directly or through indirect prompt injection techniques.

Security Risks in LLM Apps Demonstrated Through Real-World Incidents

Real-world incidents illustrate the operational impact of security risks in LLM apps. In August 2024, researchers at PromptArmor disclosed a prompt injection vulnerability in Slack AI that allowed attackers to exfiltrate data from private Slack channels they had no access to, including API keys shared in private developer channels, by placing malicious instructions in a public channel or embedding them in uploaded documents1

1

. More concerning was EchoLeak (CVE-2025-32711, CVSS 9.3), disclosed by Aim Security researchers in June 2025, which represented the first documented zero-click prompt injection exploit against a production AI system targeting Microsoft 365 Copilot1

1

. By sending a single crafted email with no user interaction required, an attacker could cause Copilot to access internal files and transmit their contents to an attacker-controlled server. While both vulnerabilities were patched, the class of attacks remains unresolved2

2

.

Exploiting AI Agents and Copilots Through Advanced Techniques

Modern prompt injection techniques have evolved significantly, now exploiting AI agents and copilots through multiple sophisticated attack vectors. Agent hijacking has become particularly dangerous as AI agents can send emails, modify cloud infrastructure, execute code snippets, and interact with internal corporate systems—requiring just a single instruction to make agents act harmfully1

1

. Cross-model injection attacks corrupt the output of one model, knowing other models will process that malicious content, propagating corruption through all AI systems. The vulnerability surface has expanded to include the broader agentic stack, where agents treat their context as authoritative, meaning long-term agent memory can retain and execute malicious instructions repeatedly2

2

.

RAG Pipelines and Model Routers Under Attack

Attackers have developed specific strategies targeting RAG pipelines through supply chain poisoning, creating malicious content in documentation, blog articles, and GitHub READMEs, then waiting until this malicious content is ingested into enterprises' RAG pipelines to use as an attack vector. Model routers, which enterprises increasingly use to select between multiple LLMs, face manipulation as attackers craft prompts that force routing to the weakest or least-guarded model. Context overflow attacks leverage million-token context windows, with attackers placing malicious content within documents hoping an LLM will stumble upon it and execute it, overriding all previous instructions.

Why Traditional Input Validation Falls Short

The pattern repeating across organizations reveals fundamental gaps in AI security: chatbots deployed with no input validation and no output filtering, RAG pipelines fetching external documents without verification, and multi-agent systems passing data between models with each trusting the last. Traditional defenses miss prompt injection because the input arrives as natural language, and the model is built to interpret it flexibly. Keyword filtering gets bypassed by rephrasing, encoding, or translation, while attackers can base64-encode payloads, write instructions in different languages, or split them across multiple messages. OpenAI acknowledged in December 2025 that prompt injection is unlikely to be fully solved, often likening it to social engineering. Anthropic's Claude Opus 4.6 system card indicated a 17.8% success rate for a single prompt injection attempt, escalating to 78.6% over 200 attempts without safeguards in place, while Google reported a 53.6% success rate for prompt injection against its Gemini deployment.

Implementing External Controls and Defense Strategies

A separate finding indicated that 65.3% of organizations lack dedicated defenses against prompt injection, relying instead on vendor-supplied measures and policy training2

2

. Effective external controls should include limiting each agent's authority, requiring human approval for critical actions, tagging retrieval sources based on sensitivity, and implementing auditing practices2

2

. In December 2025, Gartner advised CISOs to block all AI browsers, citing indirect prompt injection and other risks associated with insufficient controls, with Cyberhaven reporting that 27.7% of organizations had at least one user with the blocked AI tool Atlas installed. Security teams should ask vendors about detection capabilities, success rates against prompt injections, adherence to OWASP recommendations, and the capacity to log exact agent actions. Given the vulnerabilities, enterprises must assume that models may occasionally follow injected instructions, necessitating robust external controls to protect customer-facing systems, internal copilots, automation workflows, and data governance systems.