documented real-world prompt injection attacks against RAG-based enterprise tools

CrowdStrike's 2026 Global Threat Report documented prompt injections into legitimate generative AI tools at more than 90 organizations in 2025, used to steal credentials and cryptocurrency. The report's framing was blunt: "Prompts are the new malware." AI-enabled adversaries increased overall attack volume 89% year-over-year, and 82% of these intrusions involved no traditional malicious code. For detection tooling built around recognizing malicious artifacts, that last statistic is not a warning sign. It's a structural indictment.

The sophistication trajectory is worth sitting with for a moment. Lateral movement appeared in zero documented multi-stage AI attacks in 2023. By 2025 and 2026, it showed up in 8 of 21 such attacks. Persistence capabilities appeared in 12 of those same 21. That's not a cluster of opportunistic experiments. That's a threat class developing the internal logic of a mature intrusion methodology, with the same progression toward persistence and lateral spread that defined the evolution of ransomware a decade earlier.

Financial impact crossed from theoretical to realized in November 2024, when social engineering via role-playing as an administrator extracted $47,000 from an AI-controlled cryptocurrency wallet in the Freysa AI incident. Modest, as proof-of-concepts go. But it establishes financially motivated exploitation as a demonstrated reality, and markets responded accordingly: the AI prompt security sector grew from $1.51 billion in 2024 to $1.98 billion in 2025 at a 31.5% CAGR. Enterprise procurement is beginning to treat this as a budget line, not a research curiosity.

The aggregate numbers confirm the class is real. The individual incidents explain how it actually operates.

Slack AI: how a public channel becomes a delivery mechanism for private data exfiltration

PromptArmor researchers disclosed this in August 2024, and the attack path is worth tracing precisely because it appears, on first read, almost too simple to be credible.

An attacker places a malicious instruction in a public Slack channel or an uploaded document. No access to private channels required. When a user queries Slack AI across their workspace, the RAG pipeline retrieves that content because it matches the query. The retrieved content is treated as trusted context. The injected instruction hijacks the model's response, and API keys and sensitive material from private developer channels move outward to the attacker.

The attacker never touched the private channel. The RAG pipeline did the reaching on their behalf.

MDPI's Information journal characterizes this as combining RAG poisoning with social engineering, noting that the poisoned document functions as both attack vector and lure. What makes it the canonical indirect injection case is the privilege asymmetry: the attacker contributes content to a shared space, the model's retrieval step grants that content implicit trust, and the model's output crosses the privilege boundary without any additional access on the attacker's part.

No foothold in the private channel. No elevated privileges. No code execution. Only the ability to write something the RAG system would eventually retrieve. The bar for meaningful consequences sits remarkably low here. But what if adversaries develop more precise targeting of the retriever itself, rather than relying on the blunt instrument of keyword proximity? That raises an important question about whether current defenses are calibrated against the attack as it exists today or the attack as it is developing.

Microsoft 365 Copilot's first vulnerability: chaining prompt injection with ASCII smuggling to exfiltrate MFA codes

Researcher Johann Rehberger reported this to Microsoft in January 2024. It was patched in July 2024. Microsoft's initial severity classification was low.

Let that sit there for a second before we walk through the chain.

The attack moved in four stages. A malicious instruction embedded in an email or shared document is retrieved by Copilot. Copilot then reads additional emails and documents without any user prompt or awareness, invoked automatically by the injected instruction. That instruction directs the LLM to render sensitive data, including MFA codes, using Unicode characters that mirror ASCII visually but are invisible in the UI; the data is staged for exfiltration without the user seeing anything unusual. Finally, that invisible staged data is embedded in a hyperlink, and if the user clicks, it transmits to the attacker's server.

The arXiv case record characterizes this as a four-stage chain establishing RAG-dependent persistence through workspace artifacts: emails, documents, messages. What persists is not a file or a process but a set of instructions distributed across the content the model retrieves. Security teams trained to hunt for persistence in process lists and registry keys are looking in the wrong layer entirely.

It is also worth considering the ASCII smuggling technique separately, because it doesn't stay put. Any LLM that renders Markdown and has tool-call capability is exploitable through the same pattern, regardless of the underlying model or the specific enterprise platform. The technique migrates independently of the vulnerability that introduced it.

Which brings us back to the severity classification. A four-stage chain capable of exfiltrating MFA codes, initially assessed as low. That gap between demonstrated impact and organizational perception is itself a vulnerability, and no technical control in any vendor's catalog closes it.

EchoLeak (CVE-2025-32711): the first zero-click production LLM exploit and what "zero interaction required" means for enterprise exposure

Aim Security researchers disclosed CVE-2025-32711 in June 2025. CVSS score: 9.3. The mechanism is simple to state: an attacker sends a malicious email to a target. The email sits unread in the inbox. The user does not open it, click anything, or interact with it in any way. The attack proceeds anyway.

M365 Copilot is a RAG-based assistant that pulls from the user's entire M365 environment at query time: emails, OneDrive, SharePoint, Teams chats. When Copilot runs, it retrieves that unread email as context. The injected instruction executes. The full chain involves bypassing Microsoft's Cross Prompt Injection Attempt classifier, circumventing link redaction using reference-style Markdown formatting, exploiting auto-fetched images to exfiltrate data out-of-band, and abusing a Microsoft Teams proxy permitted by the content security policy.

Everything within Copilot's access scope is within the attacker's scope: chat logs, OneDrive files, SharePoint content, Teams messages, preloaded organizational data.

Traditional controls fail here for a specific structural reason Hack The Box's analysis makes explicit: EchoLeak executes in natural language space. Antivirus, firewalls, and static file scanning have no surface to examine. There is no payload in any format those tools recognize.

Microsoft patched server-side and confirmed no exploitation in the wild before disclosure. But how does this affect our original confidence in that confirmation? Breach detection in AI environments now averages 290 days, nearly three months longer than in traditional systems. "No exploitation in the wild" and "no detected exploitation" are not the same claim, and in an environment with a 290-day average detection lag, the distance between those two statements is substantial.

What survives the patch is the structural exposure. Any LLM-based assistant with access to multiple internal data sources and automatic retrieval shares this attack surface. CVE-2025-32711 is a named instance of a class, not a closed chapter.

GitHub Copilot's RCE vulnerability: when injected instructions reach the shell

CVE-2025-53773 carries a CVSS score of 9.6. Responsibly disclosed June 29, 2025, patched in Microsoft's August 2025 Patch Tuesday. It affects GitHub Copilot and Visual Studio Code across Windows, macOS, and Linux.

The attack begins with malicious instructions embedded in source code comments, project files, GitHub issues, or web content a developer browses during normal work. The injection instructs Copilot to add "chat.tools.autoApprove": true to .vscode/settings.json, enabling what the security community calls "YOLO mode." That single setting disables all user confirmation prompts, after which Copilot can execute privileged shell commands without any user intervention.

This was demonstrated against Copilot backed by GPT-4.1, Claude Sonnet 4.0, and Gemini. The vulnerability is not model-specific. Any sufficiently capable model following the injected instruction produces the same outcome.

The worm vector is what makes this categorically more serious than prior cases. Once an attacker achieves code execution, they can modify other Git repositories and RAG sources to embed the same malicious instructions. Other developers unknowingly propagate the infected code upstream. The knowledge corpus becomes delivery mechanism and persistence layer simultaneously, and the propagation doesn't require the original attacker to remain active.

Developer tooling occupies a privileged position in enterprise environments: source code, secrets in configuration files, CI/CD pipeline credentials. The blast radius of remote code execution through a developer assistant is substantially wider than through a chat tool. The structural failure producing it is identical to what produced the Slack and M365 incidents. Retrieved content is trusted as instruction. The consequences just scale with what the affected tool can reach.

What PoisonedRAG and its successors show about the knowledge base as an attack surface

The academic research that preceded these production incidents describes the ceiling of what this attack class can achieve, and that ceiling sits considerably higher than anything in the production record so far.

PoisonedRAG, published as arXiv:2402.07867 and accepted at USENIX Security 2025, injected 5 documents into a knowledge base containing 2.6 million texts and achieved control of a frontier LLM's output 90% of the time. The attacker never touched the model or accessed the retriever. They only wrote documents that entered the corpus. The researchers evaluated the obvious defenses, found them insufficient, and explicitly called for new defensive approaches.

Two successor efforts tighten the threat model in ways that matter for practitioners. CorruptRAG, from Zhang et al. in 2025, constrains the attacker to a single poisoned text per query, which increases practical relevance for real enterprise deployments where bulk injection is detectable. Confundo, from 2026, frames poisoning as a learning problem, fine-tuning a poison generator to produce texts that survive preprocessing, reranking, and paraphrasing. Those are precisely the naive defenses enterprises deploy first, which means Confundo is specifically optimized to outlast the standard response.

Confundo also supports factual manipulation, opinion manipulation, and hallucination induction as distinct attack objectives. One might argue that data theft is the primary concern, but that last point deserves more attention than it typically gets. The goal is not always data theft. Sometimes the objective is corrupting the outputs a business relies on for decisions. A company monitoring for exfiltration but not for systematic output corruption has a different blind spot, and depending on how much the organization trusts its AI-assisted decisions, potentially a larger one.

The uncomfortable implication for practitioners: patching a named CVE does not close the retrieval trust problem. An attacker who can contribute to any indexed corpus retains meaningful capability regardless of what product-level patches have been applied.

Where the shared failure pattern sits across all these incidents

The same core failure runs through every case: retrieved content is granted the same trust level as system instructions, with no runtime mechanism to distinguish the two.

The attack chains differ in their particulars. Social engineering via a public channel in Slack. ASCII smuggling and invisible Unicode in M365 Copilot. Zero-click retrieval through an unread email in EchoLeak. Shell escalation through a settings file in GitHub Copilot. Different surfaces, same entry point, same exploitation of the trust model.

Standard security controls fail against this class in predictable ways. Antivirus and static file scanning have no executable payload to detect. Traditional data loss prevention sees data leaving through model-generated output or model-invoked tool calls rather than file transfer, so the telemetry that triggers alerts simply doesn't appear. Network perimeter controls observe traffic originating from the AI tool itself, which is an authorized endpoint. Patch management addresses individual CVEs without touching the underlying retrieval trust problem.

A 2025 arXiv benchmark across 847 adversarial test cases found that undefended RAG systems succeeded in attacks at a high rate. A combined defense framework brought that rate down sharply, but maintaining that baseline requires active controls, not a passive security posture. The difference between the undefended and defended rates is not a product decision. It's an operational commitment.

The lateral movement and persistence data matter operationally here. Successful injection is increasingly a foothold, not an endpoint. The named products are representative, not exhaustive. Any enterprise RAG deployment retrieving from user-contributed or externally indexed content shares this attack surface: internal knowledge bases, legal research tools, code assistants, customer service agents.

What continuous monitoring of vendor AI assets needs to catch that point-in-time assessments miss

The 290-day average breach detection lag in AI environments reframes every assurance about patching velocity. A vulnerability disclosed and patched in the same month still persists, undetected, in a deployed enterprise tool for the better part of a year. The patch and the detection are separate problems. Treating them as the same problem is where security programs are currently leaving the most exposure.

Point-in-time vendor assessments miss the class of risk these cases represent in several specific ways. A tool can pass a security review at procurement and receive an injection-enabling feature in the next update cycle. The knowledge corpus the tool retrieves from changes continuously, meaning poisoned content can enter well after the assessment closes. New retrieval connectors and plugins expand the attack surface without triggering reassessment. The M365 Copilot trajectory illustrates this precisely: first vulnerability in January 2024, EchoLeak in June 2025, same product, new injection vectors appearing as its capabilities expanded.

Effective continuous monitoring needs to surface what point-in-time assessments structurally cannot. Changes to retrieval scope: new data sources, new connectors, new plugin permissions. Model updates that alter instruction-following behavior or tool-call defaults. Newly disclosed CVEs and injection techniques against tools already running in production. Anomalous output patterns consistent with corpus poisoning rather than ordinary model error, which requires instrumenting the inference layer itself, not just the network traffic around it.

Platforms designed specifically for AI security posture monitoring, including offerings from vendors like HiddenLayer and CalypsoAI, have emerged because traditional security tooling does not instrument the retrieval and inference layers where these attacks execute. The evaluation criteria worth applying to any such platform: does it monitor retrieval scope changes continuously, can it detect output manipulation consistent with corpus poisoning, and does its alerting integrate with existing incident response workflows rather than creating a parallel silo that security teams have to check separately.

The cases examined here are not the ceiling of this attack class. They are the documented floor. From PoisonedRAG's 5 injected documents in a 2.6 million-document corpus to Confundo's poison generator designed to survive every naive defense, the research trajectory points toward adversarial capability advancing faster than the defensive tooling most enterprises currently have deployed. Patching addresses the named instance. Monitoring the retrieval and inference layers continuously is the only mechanism that addresses the class.