In 2025, OWASP’s LLM Top 10 labeled prompt injection as LLM01, and it kept that spot for the second consecutive edition. The reason is brutally practical: LLMs still struggle to reliably separate instructions from data, so crafted inputs can manipulate the model’s behavior.

That matters because this is not a “someday, maybe” risk for enterprise AI. CrowdStrike’s 2026 Global Threat Report, based on frontline intelligence across more than 280 tracked adversaries, documented that threat actors injected malicious prompts into legitimate generative AI tools at more than 90 organizations in 2025, then used those injections to generate commands that stole credentials and cryptocurrency. The report boiled it down in plain terms: “Prompts are the new malware.” Prompt injection was not just an entry point, it acted as a force multiplier, and AI-enabled adversaries increased overall attack volume by 89% year-over-year.

If you are a security leader, CTO, or product executive, the uncomfortable part is that many enterprise teams built AI around an assumption that “the model will follow system instructions.” But LLM behavior is shaped by the text it sees, and modern enterprise deployments feed it lots of text. The prompt injection angle attacks that mismatch. Businesses deploy LLMs to process instructions, summarize information, and trigger automated workflows. The problem is the model cannot consistently tell apart instructions from data, context from metadata, or user intent from metadata. That creates an opportunity for attackers to influence behavior directly through inputs, and indirectly through whatever content the system retrieves or routes.

Over the last couple years, prompt injection techniques have evolved from simple prompt tricks into attacks that match how enterprise systems are actually architected. The source calls out multi-agent architectures, retrieval-augmented generation (RAG) pipelines, model routers, and long-term memory capabilities. Each one changes the blast radius.

Take RAG supply chain poisoning. Attackers can create malicious information such as documentation, blog articles, and GitHub READMEs. They then wait until that material is ingested into an enterprise RAG pipeline, and use it as an attack vector. In other words, your knowledge base is also your attack surface. Or consider cross-model prompt injection. Enterprises often run multiple LLMs in a workflow. An attacker corrupts the output of one model while knowing other models will process that content next, so the corruption propagates through the whole AI system.

Then there is agent hijacking. AI agents are now capable of sending emails, modifying cloud infrastructure, executing code snippets, and interacting with internal corporate systems. If the agent can be nudged with a single instruction into harmful behavior, the impact is no longer limited to “bad text.” Add context overflow attacks too: with million-token context windows, an attacker can place malicious code inside a document and hope the LLM stumbles upon it and executes it, overriding earlier instructions. And with memory poisoning, long-term memory implementations can let attackers inject instructions that permanently reconfigure state.

To make this real, the source includes two incidents that were disclosed and then patched. In August 2024, PromptArmor researchers disclosed a prompt injection vulnerability in Slack AI that allowed an attacker to exfiltrate data from private Slack channels they had no access to. The attacker did it by placing a malicious instruction in a public channel or embedding it in an uploaded document, and the exfiltrated data included API keys shared in private developer channels. In June 2025, Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3), described as the first documented zero-click prompt injection exploit against a production AI system, targeting Microsoft 365 Copilot. By sending a single crafted email, with no user interaction required, an attacker could cause Copilot to access internal files and transmit their contents to an attacker-controlled server. Both vulnerabilities were patched.

So what should business leaders take from this besides “prompt injection is bad”? The source is clear that prompt injection directly affects customer-facing systems such as chatbots and support agents, internal copilots like developer tools and security assistants, and automation workflows including ticketing, cloud operations, and HR processes. It also hits data governance because it targets RAG pipelines and knowledge bases. In 2026 terms, the risk is expanded beyond incorrect answers. Prompt injection can trigger unauthorized actions, leak sensitive data, corrupt internal workflows, manipulate analytics, alter business logic, and compromise multi-agent systems.

The operational implication is that you cannot treat LLMs as magical black boxes that only “generate text.” The source’s recommendations point to how to reduce decision rights and harden the pipeline: constrain model permissions, segment untrusted content including RAG sources, monitor tool invocation and require human approval for high-impact actions, validate content provenance so poisoned external content does not enter RAG pipelines, harden model routers so attackers cannot force routing to weaker models, and treat LLMs as untrusted components. The bottom line in the source is blunt: prompt injection remains the most effective way to compromise enterprise AI systems because it exploits the fundamental way LLMs interpret text. Until organizations treat LLMs as untrusted interpreters, not autonomous decision-makers, prompt injection will keep dominating the enterprise AI threat landscape.

For boards and executives overseeing AI strategy, the stake is continuity. Every additional workflow you connect to an LLM, every new agent capability you ship, and every retrieval source you add to RAG can silently enlarge the attack surface. The question is not whether prompt injection exists. The question is whether your controls match how your systems are actually built.