Prompt Injection Attacks Targeting Enterprise AI Assistants
Security patches won't stop prompt injections; enterprises must limit AI assistant access instead.
Prompt injection attacks on enterprise AI assistants exploit a weakness in how they are built that a patch cannot fix. The same ability that lets an assistant follow instructions also lets hostile text redirect its work. Effective defense therefore depends on limiting what a compromised assistant can reach and do, detecting misuse, and governing its authority rather than expecting the model to reject every attack.
Why LLMs cannot separate instructions from data, and why that is not fixable at the model layer
An LLM processes system instructions, user input, and content from outside the system in a single context window. It predicts the next token from that context, without a built-in mechanism that can reliably verify the authority or origin of every instruction. Instruction following is a design objective, but it is not an enforced trust boundary. Text supplied as material to summarize can therefore become an instruction the model follows.
Ordinary software can keep executable instructions separate from the data they act on. Parameterized queries provide that structural separation against SQL injection. No equivalent architectural fix exists at the LLM layer, where interpreting instructions and interpreting content depend on the same capability.
This does not mean that system instructions and external text always influence a model identically. It means that instruction hierarchy is not the same as an independently enforced boundary between trusted commands and untrusted material. Better model behavior can reduce failures without removing the underlying ambiguity. OpenAI acknowledged that prompt injection in AI browsers “may never be fully patched” when it launched Lockdown Mode for ChatGPT on February 13, 2026. The UK NCSC has separately warned that indirect prompt injection “may never be fully fixed”.
How the three attack types distribute risk across the enterprise surface
Direct injection places malicious instructions in the user prompt itself. It remains a risk where internal tools have weak isolation or models accept untrusted user input, though the incidents in the notes suggest that indirect attacks are more common in enterprises. Indirect injection instead reaches the assistant through material it encounters while doing legitimate work, including emails, documents, web pages, and tool outputs.
Stored injection adds persistence to that route. Instructions hidden in long-term memory, indexed documents, or knowledge bases remain dormant until retrieval brings them into context. Retrieval can therefore activate an attack weeks after the original insertion, during an unrelated session. These categories describe different trust surfaces, but stored content can also deliver an indirect attack. The distinction is between who supplied the instruction, where it resides, and when it becomes active.
The severity then depends on the assistant’s authority. A model that can use tools and execute actions automatically can turn one injected instruction into a chain involving data exfiltration, code execution, or lateral movement. The attacker needs one instruction to work, while defenders must account for every input the agent touches. Unauthorized data access and hijacked workflows are therefore not separate concerns from prompt handling. They are downstream consequences of allowing untrusted language to influence privileged action.
What the 2025–2026 incident record shows about where injection lands in production
The George Washington University EchoLeak paper documents the first zero-click, remote data exfiltration from a production enterprise AI assistant. EchoLeak affected Microsoft 365 Copilot in June 2025 and received CVE-2025-32711 with a CVSS score of 9.3. An attacker sent a single crafted email that Copilot ingested during normal background processing. A later, unrelated query triggered the leak without requiring the user to interact with the malicious email.
The paper describes four linked bypasses. The attack evaded Microsoft’s XPIA classifier, bypassed link redaction with reference-style Markdown, exploited auto-fetched images, and abused a Teams proxy permitted by the content security policy. Together, these steps achieved full privilege escalation across LLM trust boundaries. Microsoft issued emergency patches.
Varonis Threat Labs disclosed Reprompt, CVE-2026-24307, affecting Microsoft Copilot Personal in January 2026. An attacker embedded instructions in a URL parameter, and a victim’s click caused Copilot to execute the injected prompt without plugins, connectors, or user-entered prompts. Microsoft patched it in January 2026. In a different form of state manipulation, a researcher demonstrated in 2025 that instructions in a Jira task description could silently wipe Google Gemini Enterprise memory without confirmation. The demonstration earned a Google AI VRP bounty.
Microsoft’s advisory assigns GitHub Copilot RCE CVE-2025-53773 a CVSS base score of 7.8. Instructions in source files, web pages, or GitHub issues told Copilot to change settings to allow code execution without the user’s approval. The February 2026 Cline/OpenClaw attack extended the path into the software supply chain. The unauthorized installation of OpenClaw, a legitimate open-source AI agent, demonstrated the potential for arbitrary code execution through the supply chain.
These incidents share the promotion of encountered content into operational authority, even though their triggers and consequences differ. The Slack AI vulnerability disclosed in August 2024 had already established the data-access pattern. Instructions in a public channel could exfiltrate information, including API keys, from private channels the attacker could not access. The assistant’s permissions bridged a boundary the attacker could not cross directly.
The enterprise vectors where injection pressure is highest — agents, RAG pipelines, model routers, and multi-agent systems
The relevant enterprise surface is the architecture connecting a model to information and action. Agents that use tools can act on hostile content with permissions its author does not have. MCP, or Model Context Protocol, servers give attackers another way in through the systems that connect agents to external systems. The Anthropic Git MCP Server CVEs illustrate indirect injection through malicious repository content. They are not, however, evidence of RAG supply chain poisoning, which involves a different ingestion path.
RAG pipelines create that path when external documentation, blog posts, or GitHub READMEs enter an enterprise index. Malicious instructions can persist there until retrieval places them before an assistant. Large context windows also let instructions buried deep in documents override earlier context as the model processes them normally. Long-term memory keeps the risk alive after the current task ends, as the Gemini/Jira incident shows.
An attacker can craft a prompt to steer a router toward the weakest or least-guarded model in a fleet. In a multi-agent chain, one model’s corrupted output becomes another model’s input, while agents that spawn sub-agents create further hops. The resulting machine-to-machine traffic falls outside the visibility of traditional SAST and SCA tooling. Monitoring only human-to-AI interactions therefore misses the channel through which an injection may propagate.
Why the prevailing enterprise response — better filters and input sanitizers — is insufficient on its own
Filtering assumes that a defense can distinguish malicious instructions from legitimate language with enough reliability to block the former without disrupting the latter. That assumption becomes difficult when the attack operates through meaning. WAFs and conventional input validation address syntactic attacks. Prompt injection can express the same hostile intent in changing language, so pattern matching degrades under adaptive attacks.
Sahar Abdelnabi and Eugene Bagdasarian’s May 2026 paper “AI Agents May Always Fall for Prompt Injections” presents a formal impossibility result. Preventing prompt injection may be fundamentally unsolvable without also degrading or blocking the legitimate agentic behaviors being protected. Safeguards can still have value despite this limit on complete prevention. Anthropic’s February 2026 system card reflects a more conditional approach by reporting attack success rates by surface, attempt count, and safeguard configuration. Such distinctions matter because a defense’s value depends on the conditions under which it is tested.
OWASP ranked prompt injection LLM01 in its 2025 Top 10 for LLMs for the second consecutive edition. The Five Eyes intelligence alliance, including CISA, NSA, and counterparts in the UK, Canada, Australia, and New Zealand, issued joint guidance in May 2026 naming prompt injection as the most persistent and difficult-to-fix threat facing agentic systems. The guidance states that no single safeguard is enough. It prioritizes resilience, reversibility, and risk containment over efficiency gains.
The layered defense architecture that reflects the threat's actual structure
A layered defense separates three jobs, namely architectural prevention, runtime detection, and governance. Architectural prevention limits what an injection can reach. Runtime detection looks for misuse that survives those limits. Governance constrains the actions agents may take, including when their reasoning has been compromised. Each can reduce the harm from a successful attack even if it lets some hostile instructions through.
At the architectural layer, least privilege means treating agents as untrusted intermediaries and scoping API permissions and credentials to the task. This restricts reachable resources but does not stop manipulation within the permitted scope. Provenance-based access control attaches source metadata to retrieved content and gives external, untrusted material less privilege than internal, authenticated material. Prompt hardening reinforces instruction hierarchy and refusal policies, chiefly reducing exposure to direct injection. It does little to protect against an attack that comes indirectly through content that seems useful.
Input and output filtering provide further boundaries. Validating responses before execution or display can intercept exfiltration attempts at the output stage without proving that the model’s reasoning remained trustworthy. Strict content security policies restrict outbound paths, addressing the kind of permissive allowlist exploited in EchoLeak. They do not prevent the model from accepting hostile instructions. Their purpose is to close a route the attacker would otherwise use after gaining influence.
At runtime, monitoring must follow behavior as well as inspect prompts. Unexpected external connections or file access outside an agent’s normal pattern are compromise indicators regardless of the triggering language. Dedicated visibility into agent-to-agent communication addresses the gap left by monitoring only user interactions. Continuous adversarial testing, which the EchoLeak paper recommends, probes whether these boundaries hold as attacks change. Detection and testing expose failures, but neither substitutes for limiting authority before an attack.
Governance adds human approval at decisions with significant or irreversible consequences, as the Five Eyes guidance recommends. This can interrupt a multi-step attack chain without requiring the reviewer to classify every input. An inventory of AI systems and their interactions defines what must be governed. Incremental rollout then defers capabilities such as code execution, external communication, and file system access until the security posture for them is established.
The EchoLeak authors recommend least privilege and defense in depth, both of which favor reducing the sensitive data a system can reach. Architectures that do not collect or retain user data, and do not route queries through vendor-controlled infrastructure, reduce the blast radius associated with those data paths.
How to build an organizational posture that treats prompt injection as a permanent condition
Continuous management begins by treating each AI integration as a new attack surface. Its threat model must cover both what the agent can read and what it can do, rather than inheriting assumptions from the application around it. Cisco’s State of AI Security 2026, published February 19, 2026, found that a large majority of organizations planned to deploy agentic AI while only a minority felt genuinely ready to secure it. That gap makes readiness an ongoing responsibility.
Before adding a capability, the governing question is what a successful injection would enable and whether the damage would be containable and reversible. Continuous red-teaming makes that question part of ongoing operations. Organizations also need to check which regulatory frameworks apply to their deployments, especially if they fall within EU AI Act Annex III scope. Prompt injection can create compliance exposure as well as security failure.
Vendor evaluation should end with architecture. Published defenses matter, but so do data access, retention, and the routes by which information can leave the system. A compromised assistant can exfiltrate only information it can access. Procurement should therefore assess what authority and data remain exposed when the safeguards fail.
