Rising Risks in LLM Security: Why Prompt Injection Remains a Top Enterprise Threat

Prompt injection has emerged as the primary security risk for Large Language Model (LLM) applications, with industry data indicating that these vulnerabilities cannot be fully patched through traditional software updates. According to OWASP, prompt injection holds the top spot in its Top 10 list for LLM applications, as language models often fail to distinguish between user-provided content and system instructions. Security researchers at OrcaRouter recently released findings highlighting that successful attacks on LLM applications now complete in an average of 42 seconds, with 90% of those incidents resulting in the exfiltration of sensitive data.

Why Traditional Security Tools Struggle with AI Models

Standard web application firewalls are largely ineffective against LLM-based attacks because they were designed to inspect structured data, not the natural language prompts that drive AI agents. In a traditional software environment, a firewall inspects a request for malicious code; however, in an LLM, the “code” is the instruction itself. As noted in the NIST AI Risk Management Framework, because models treat input as both data and programming, an attacker can manipulate an agent’s behavior simply by changing the text it processes. This structural vulnerability means that standard perimeter defenses often see an attack—such as a prompt injection—as a perfectly valid, authorized request.

The Escalation of Automated AI Incidents

The threat landscape has shifted from manual exploitation to highly automated incidents that target the “action plane” of AI agents. A notable example occurred in 2025, when the EchoLeak vulnerability allowed attackers to exfiltrate data from Microsoft 365 Copilot without requiring a user to click a link or open an attachment. Instead, the AI assistant processed a malicious email and followed instructions hidden within its content. More recently, researchers at Sysdig documented “LLMjacking,” where hijacked agents are forced to run intensive tasks, resulting in significant unauthorized cloud computing costs—in some instances reaching $46,000 per day.

How Enterprises Can Secure AI Workflows

Security experts argue that mitigating these risks requires shifting from a model-training focus to an architectural approach that polices the interaction between the AI and its environment. Effective defense strategies typically involve implementing controls at the gateway level, which include:

• Scoped Identity: Ensuring every agent operates under a restricted API key with defined limits on spending, IP access, and model permissions.
• Input Guardrails: Utilizing semantic analysis to detect jailbreak attempts and PII (Personally Identifiable Information) leakage before the model processes the input.
• Action Firewalls: Implementing a “default-deny” policy for tool calls, preventing an agent from accessing unauthorized networks or internal databases.
• Output Filtering: Screening the model’s final response to ensure that sensitive data or malicious URLs are blocked before they are returned to the user.

The Regulatory Shift: Moving Toward Evidentiary Security

With the EU AI Act becoming fully applicable, organizations are facing increased pressure to provide documented proof of their security posture. Unlike previous years, where self-attestation was often sufficient, current regulatory requirements—including those outlined in SOC 2 and ISO/IEC 42001—increasingly demand “show me” evidence. This has led to the development of automated compliance packs that generate tamper-evident audit trails. These logs track every action taken by an AI agent, allowing security teams to correlate specific events with user sessions and policy enforcement actions.

Summary of Key Risks

As organizations continue to integrate AI into production environments, the focus is shifting toward “governed paths.” Research from IBM suggests that when employees are denied access to sanctioned AI tools, they often turn to “shadow AI,” which significantly increases the risk of data breaches. By providing secure, monitored, and low-friction gateways, enterprises can reduce the incentive for shadow usage while maintaining visibility over the AI attack surface.