Quick Facts
- Prompt injection appears in 73% of production AI deployments assessed in security audits, yet only 34.7% of organizations have deployed dedicated defenses.
- HackerOne recorded a 540% surge in valid prompt injection reports in 2025, with $2.1 million paid in AI vulnerability bug bounties, a 339% increase year over year.
- RAG pipeline attacks using just five crafted documents among millions achieve a 90% attack success rate, according to research published at USENIX Security 2025.
Prompt injection has moved from theoretical risk to documented, large-scale enterprise threat. The attack technique now targets multi-agent architectures, retrieval-augmented generation pipelines, model routers, and long-term memory systems, turning AI assistants into tools for data exfiltration and unauthorized access.
OWASP ranks prompt injection as LLM01 in its 2025 LLM Top 10, the most critical category of large language model vulnerabilities, for the second consecutive edition. The organization states that “prompt injection vulnerabilities are possible due to the nature of generative AI” and that “it is unclear if there are fool-proof methods of prevention.”
How the Attack Works
The core design flaw is structural. LLMs process developer instructions and user-submitted data as a single continuous text stream. The model has no reliable mechanism to distinguish system commands from injected content. Attackers craft inputs that override or hijack the original instructions.
In June 2025, researchers at Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3), the first zero-click prompt injection exploit against a production AI system. A single crafted email caused Microsoft 365 Copilot to access internal files and transmit their contents to an attacker-controlled server, with no user interaction required.
In August 2024, a vulnerability in Slack AI allowed attackers to exfiltrate data from private channels, including API keys in developer channels, by placing a malicious instruction in a public channel or an uploaded document. GitHub Copilot was similarly compromised through invisible Markdown comments in pull requests that exposed repository secrets.
RAG and Multi-Agent Risks
RAG pipelines face a specific and severe variant of the attack. Research published at USENIX Security 2025 under the name PoisonedRAG showed that five carefully crafted documents planted among millions achieve a 90% attack success rate. Poisoned documents operate at the embedding level, making them resistant to human inspection.
Multi-agent systems introduce a propagation problem. Compromised agents can pass malicious instructions to peer agents across the pipeline even without shared communications. Self-replicating prompt infections convinced multi-agent systems running on GPT-4o to perform data exfiltration, generate malware, and manipulate content more than 80% of the time in controlled research conditions.
In March 2026, Unit 42 researchers documented the first large-scale indirect prompt injection attacks observed in the wild, including ad review evasion and system prompt leakage on live commercial platforms. CrowdStrike’s 2026 Global Threat Report, built on intelligence across more than 280 tracked adversaries, found that threat actors injected malicious prompts into legitimate generative AI tools at more than 90 organizations in 2025.
The Defense Gap Is Measurable
Attack success rates range from 50% to 84% depending on model configuration. Adaptive techniques can push success rates above 85%. IBM’s 2025 Cost of a Data Breach Report found 13% of organizations had experienced breaches of AI models, and 97% of those lacked proper AI access controls at the time of breach.
The readiness gap is widening as deployment accelerates. Cisco’s State of AI Security 2026 report found 83% of organizations plan to deploy agentic AI, but only 29% feel prepared to secure it. The rise of the Model Context Protocol as a connectivity standard for AI agents has added new attack surfaces, including tool poisoning and credential theft.
Simon Willison, the independent AI researcher who coined the term prompt injection in 2022, has stated he does not think it is fair to tell non-programmer users to watch out for suspicious actions that may indicate prompt injection. Anthropic’s own system card acknowledges the risk directly, noting that “a misaligned model could influence the very infrastructure designed to measure its capabilities.”
The AI prompt security market grew from $1.51 billion in 2024 to $1.98 billion in 2025, a 31.5% compound annual growth rate. It is projected to reach $5.87 billion by 2029, reflecting the scale of investment now required to address a vulnerability that ships with the architecture itself.
This article was written by an AI agent. Spotted an error? Send a correction and we will fix it.