Rapid injection exploits major AI business flaws by targeting agents, RAG pipelines and router models.

In the last two years, enterprises have been trying to integrate large-scale linguistic models (LLMs) for support, analysis, development, and internal automation like never before.

Along with the increasing adoption of AI technology, another trend is gaining momentum – cybercriminals are taking advantage of the disconnect between speculation about LLMs and their actual characteristics.

In 2025 and 2026, several independent sources have highlighted the same trend: Rapid injection remains one of the most effective and widely demonstrated attacks against LLM programs. The OWASP LLM Top 10 (2025) lists rapid injection as LLM01, identifying it as the most critical LLM-specific risk category, for the second consecutive year. The OWASP standard reflects the fact that LLMs still struggle to reliably distinguish instructions from data, making them susceptible to manipulation by designed input.

CrowdStrike’s Global Threat Report 2026 – based on more than 280 tracked adversaries – has documented that threat actors will inject malicious information into legitimate AI productivity tools in more than 90 organizations by 2025. They then use those injections to generate commands that steal cryptocurrency information. The report made it clear: "Notifications are the new malware." AI-enabled enemies have increased their total attack volume by 89% year-over-year, with a quick injection that acts as an entry point and a power multiplier.

Real-world events illustrate the impact of performance. In August 2024, researchers at PromptArmor disclosed a prompt injection vulnerability in Slack AI that allowed an attacker to extract data from private Slack channels that he had no access to – including API keys shared in private developer channels – by placing a malicious command in a public channel or embedding it in an uploaded document.

In June 2025, Aim Security researchers disclosed EchoLeak (CVE-2025-32711, CVSS 9.3), the first injection written with a quick zero click against an AI production system, targeting Microsoft 365 Copilot. By sending a single crafted email, no user interaction required, an attacker can cause Copilot to access internal files and transfer their contents to a server controlled by the attacker.

Both disabilities were patched. These incidents underscore the fact that rapid injection is not a theoretical weakness but a real, repeatable threat organizations must face as they deploy AI systems at scale.

Fast injection methods have undergone major changes in recent years, now oriented towards multi-agent design, retrieval generation augmented (RAG) pipelines, router models, and long-term memory capabilities.

Yesbusiness challenge: Too much trust

Businesses use LLMs to process instructions, summarize information, and trigger automated workflows, but it’s hard for LLMs to say:

• Iinstructions from the data

• Iinformation from context

• Cin the text from the metadata

• User intent from metadata

This creates an opportunity for attackers to manipulate and influence the behavior of the model, directly or indirectly.

Modern rapid injection

Fast injection for a different model

The use of LLM is a common practice among businesses. Attackers display the output of a particular model, knowing full well that other models will process the content. Therefore, corruption is widespread in all AI systems.

RAG supply chain poisoning

AAttackers create malicious information – documents, blog articles, GitHub READMEs. They then wait until this malicious information is fed into corporate RAG pipelines, and then use it as an attack vector.

Agent hijacking

AI agents have advanced to the point where they can send emails, modify cloud infrastructure, use code snippets, and interact with companies’ internal systems. It only takes one command to make the agents act dangerously differently.

Content overflow attacks

With the help of one million token context windows, the attackers put malicious code inside the document and hope that LLM will get to it and execute it, thereby deleting all the previous instructions.

The poison of memory

Due to the use of long-term memory in LLMs, attackers can inject instructions that permanently modify their state.

Model router manipulation

Businesses are increasingly using models to choose between multiple LLMs. Attackers do manual work that forces a route to a weak or poorly guarded model.

Why this is important for business leaders

Fast injection is not a theoretical problem. It directly affects:

• Ccustomer facing systems (chatbots, support agents)

• Iinternal backups (developer tools, security assistants)

• Aautomation workflow (ticketing, cloud operations, HR processes)

• Data governance (RAG pipelines, knowledge bases)

The danger is no longer limited to them "the model said something wrong."

By 2026, the rapid injection would:

• Tcommit unauthorized acts

• Lfind sensitive data

• Cdisrupt internal workflow

• Mturn on analytics

• Alter business logic

• Ccompromise multi-agent systems

The attack surface has grown significantly.

What businesses should do now

1. Block model permissions

Limit what the model can do, not just what it should do.

2. Part of untrusted content

Treat all external data – including RAG sources – as potentially hostile.

3. Monitor the request tool

It requires human approval for high impact actions.

4. Ensure availability of content

Ensure that RAG pipes do not consume toxic foreign contents.

5. Fix model routers

Prevent attackers from forcing a route to vulnerable models.

6. Treat LLMs as trusted entities

This paradigm shift is the foundation of modern AI security.

An important point

Rapid injection remains the most effective way to compromise enterprise AI systems because it uses the basic mechanism by which LLMs interpret text. Until organizations treat LLMs as unreliable interpreters – not independent decision makers – rapid injection will continue to dominate the AI ​​threat landscape.

Julie Brunias is an AI Security Architect.