Prompt Injection Attacks: The Key Vulnerability in Enterprise AI

Large language models (LLMs) are being actively integrated into corporate processes, but their growing popularity has drawn the attention of cybercriminals. One of the most serious threats remains prompt injection—an attack method that exploits the inability of models to reliably separate instructions from data. In 2025, this vulnerability was recognized as critically important: OWASP included it in the top 10 threats for LLMs for the second year in a row, while a CrowdStrike report recorded an 89% increase in attacks compared to the previous year.

Real-world incidents underscore the severity of the issue. In August 2024, researchers discovered a vulnerability in Slack AI* that allowed attackers to extract data from private channels, including API keys, through malicious instructions in public chats or documents. In June 2025, a vulnerability in Microsoft 365 Copilot (CVE-2025-32711) was identified, enabling attackers to access internal files via a single email without user interaction. Both cases were resolved, but they demonstrate that prompt injection is not a theoretical threat but a real risk to businesses.

Modern attacks target complex AI system architectures. Cybercriminals employ cross-model injection, RAG pipeline poisoning, agent hijacking, and model router manipulation. For example, attacks on RAG systems involve injecting malicious content into corporate knowledge bases, which is then used to manipulate AI. Agents capable of interacting with cloud infrastructure and internal systems can be compromised through a single malicious instruction.

To mitigate such attacks, experts recommend restricting model permissions, segmenting untrusted content, validating RAG data sources, and monitoring tool invocations. A key step is treating LLMs as untrusted components rather than autonomous decision-making systems. Without these measures, prompt injection will remain one of the primary threats to enterprise AI.