Exploiting Enterprise AI: Targeting Agents, RAG Pipelines, and Model Routers in Prompt Injection Attacks

Over the past couple of years, businesses have been increasingly integrating large language models (LLMs) into various aspects of their operations, such as support, analytics, development, and internal automation. This trend has been accompanied by a rise in cybercriminals exploiting the gaps between assumptions about LLMs and their actual characteristics.

In the years 2025 and 2026, multiple sources have highlighted a significant trend: Prompt injection has emerged as a highly impactful and widely utilized method for attacking LLM systems. The OWASP LLM Top 10 (2025) identifies prompt injection as the most critical vulnerability category for LLM systems, highlighting the challenges these models face in distinguishing instructions from data.

According to CrowdStrike’s 2026 Global Threat Report, threat actors injected malicious prompts into legitimate generative AI tools at over 90 organizations in 2025. This prompted the generation of commands that enabled the theft of credentials and cryptocurrency, leading to a substantial increase in overall attack volume by AI-enabled adversaries.

Real-world incidents have demonstrated the operational consequences of prompt injection vulnerabilities. For instance, in August 2024, researchers discovered a prompt injection vulnerability in Slack AI that allowed unauthorized data exfiltration from private channels. Similarly, in June 2025, a zero-click prompt injection exploit targeting Microsoft 365 Copilot was disclosed, emphasizing the practical threat prompt injection poses to organizations deploying AI systems at scale.

Prompt injection techniques have evolved significantly in recent years, targeting various aspects of LLM systems such as multi-agent architecture, retrieval-augmented generation (RAG) pipelines, model routers, and long-term memory capabilities.

Businesses often rely on LLMs to process instructions, summarize information, and automate workflows, but these models struggle to differentiate between instructions, data, context, and user intent. This ambiguity provides attackers with opportunities to manipulate the model’s behavior directly or indirectly.

Modern prompt injection methods, such as cross-model prompt injection, RAG supply chain poisoning, agent hijacking, context overflow attacks, memory poisoning, and model-router manipulation, pose significant challenges to enterprise AI security.

To address these threats, businesses should implement strategies such as constraining model permissions, segmenting untrusted content, monitoring tool invocation, validating content provenance, hardening model routers, and treating LLMs as untrusted components.

In conclusion, prompt injection remains a critical threat to enterprise AI systems due to its exploitation of how LLMs interpret text. Organizations must adopt a cautious approach towards LLMs, viewing them as interpreters rather than autonomous decision-makers, to effectively mitigate the risks posed by prompt injection attacks.