Prompt Injection: The Evolving Threat to Enterprise AI

Large language models (LLMs) are increasingly adopted by businesses for various functions, yet cybercriminals are exploiting their inherent characteristics. Prompt injection is identified as the most critical LLM-specific vulnerability, as LLMs struggle to differentiate instructions from data. In 2025, over 90 organizations experienced prompt injection attacks, leading to credential and cryptocurrency theft, with prompts described as 'the new malware.'

Real-world incidents demonstrate this threat. In August 2024, a Slack AI vulnerability allowed data exfiltration from private channels. In June 2025, a zero-click exploit against Microsoft 365 Copilot enabled attackers to access internal files via a single crafted email. Both issues have since been patched.

Prompt injection techniques are evolving to target multi-agent systems, RAG pipelines, and memory capabilities. Businesses often place too much trust in LLMs, leading to difficulties in distinguishing instructions from data or user intent from metadata. This creates opportunities for attackers to manipulate AI behavior.

Modern attacks include cross-model injection, RAG supply chain poisoning, agent hijacking, context overflow, memory poisoning, and model-router manipulation. These threats impact customer-facing systems, internal tools, automation workflows, and data governance. The risks extend beyond incorrect AI outputs to unauthorized actions, data leaks, workflow corruption, and compromised multi-agent systems.

To mitigate these risks, enterprises must constrain model permissions, segment untrusted content, monitor tool invocation, validate content provenance, harden model routers, and fundamentally treat LLMs as untrusted components. This mindset shift is crucial for securing AI systems against evolving prompt injection threats.