Prompt Injection Attacks Target 90+ Enterprise AI Systems
Attackers exploited prompt injection vulnerabilities to compromise more than 90 enterprise AI systems in 2025, stealing credentials and cryptocurrency. Two high-impact incidents—a Slack AI vulnerability disclosed in August 2024 and a Microsoft 365 Copilot zero-click exploit disclosed in June 2025—demonstrated the technique's widespread effectiveness despite patches to individual systems.
What happened
CrowdStrike's 2026 Global Threat Report documented prompt injection attacks at more than 90 organizations in 2025, where attackers injected malicious prompts to generate commands that stole credentials and cryptocurrency.
In August 2024, PromptArmor disclosed a prompt injection vulnerability in Slack AI that allowed an attacker to exfiltrate data, including API keys, from private channels by planting an instruction in a public channel or uploaded file.
In June 2025, Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3), a zero-click prompt injection exploit against Microsoft 365 Copilot in which a single crafted email could cause Copilot to retrieve internal files and forward them to an attacker-controlled server with no user interaction.
Reported impact
The attacks resulted in theft of credentials and cryptocurrency from targeted organizations. AI-enabled adversary operations rose 89% year-over-year, with 82% of intrusions involving no traditional malicious code.
Index analysis
Prompt injection holds the top ranking (LLM01) on the OWASP Top 10 for large language models across two consecutive editions. Language models cannot reliably distinguish instructions written by developers from text retrieved from webpages, emails or documents, creating an operational vulnerability.
Governance controls
Both the Slack AI and Microsoft 365 Copilot vulnerabilities were patched following disclosure, but the underlying class of prompt injection attacks persists across the agentic stack, including agents that send mail, modify cloud infrastructure, execute code, RAG pipelines and model routers.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.