Prompt Injection: New Malware Threat to Enterprises

Prompt injection attacks were reported at over 90 organizations in 2025, according to the CrowdStrike 2026 Global Threat Report. These injected prompts were used to steal credentials and cryptocurrency. What's interesting is that CrowdStrike now frames prompts as functioning like malware. The report also found that AI-enabled adversary operations rose 89% year over year, and 82% of intrusions involved no traditional malicious code. This comes as companies are increasingly using AI agents and copilots with access to sensitive data. Prompt injection remains the top vulnerability for large language model applications. Language models struggle to differentiate between developer instructions and text from other sources like webpages or emails. The bottom line is that this vulnerability has moved from a curiosity to a real operational threat, meaning businesses need to address this new form of attack.