AI Prompt Injection: What Your Business Needs to Know

A research team just proved they can steal a company's secrets by hiding the instructions inside a picture, not a line of code. The technique is called prompt injection. Security researchers have warned about it for two years. This week it moved from theory to a working demonstration with real numbers behind it.

If your business uses any AI tool that reads email, scans documents, or reviews attachments, this is worth five minutes of your time.

What the researchers actually did

A team at the University of Missouri-Kansas City's ASSET Research Group built a proof of concept called Ghostcommit. They opened a pull request on a code repository containing one new file: a coding-convention file named AGENTS.md, the kind of file AI coding agents read automatically and treat as policy.

Their first version spelled out the attack in plain text: encode the contents of a secrets file as a string of numbers and write it into the source code. AI reviewers like Cursor Bugbot and CodeRabbit caught it immediately and flagged it high severity before anyone could merge it.

So the researchers moved the instruction into a PNG image and pointed to it from the convention file. Text-based reviewers see a binary blob and move on. The AI coding agent opens the image, reads the hidden instruction, and later writes the stolen secret into the source code disguised as ordinary data.

The researchers tested the surrounding conditions across 6,480 pull requests spanning the 300 most active public code repositories over ninety days. Seventy three percent of merged pull requests got no substantive human review and no bot review at all. That is the gap the attack walks through.

One more detail worth sitting with. The same underlying AI model behaved differently depending on which tool wrapped it. Under Cursor and Antigravity, Claude Sonnet read the hidden instruction and dutifully recorded the secret. Under Claude Code, the identical model refused, stating that exfiltrating secrets was inappropriate. Same model. Different outcome. The tool wrapped around the model decided what happened, not just the model itself.

This is not a developer problem. It is an AI agent problem

It's tempting to file this under "something that happens to software teams." That's the wrong read. The vulnerability is about what AI agents do when they encounter content that isn't plain text: images, PDFs, scanned documents, screenshots. Any business running AI tools that process attachments, invoices, contracts, or customer emails carries the same exposure, whether or not anyone on staff writes code.

OWASP, the security research group that tracks vulnerability categories for AI systems, has ranked prompt injection as the single most critical risk to large language model applications for two years running. CrowdStrike's 2026 Global Threat Report found threat actors injected malicious prompts into legitimate generative AI tools at more than 90 organizations in 2025 alone, using the technique to steal credentials and cryptocurrency. Their assessment was blunt: "Prompts are the new malware."

Growing businesses have been adding AI agents into everyday workflows faster than most have built a way to track what those agents can actually reach. Ghostcommit is a fresh reminder of why that inventory gap matters.

It has already hit tools your business probably uses

Two earlier incidents show this is not confined to coding tools. In August 2024, researchers at PromptArmor disclosed a prompt injection flaw in Slack AI. An attacker could drop a message in a public channel and use it to pull data out of private channels the attacker had no access to, including API keys shared in private developer conversations.

In June 2025, researchers at Aim Security disclosed something more serious: EchoLeak, tracked as CVE-2025-32711 with a severity score of 9.3 out of 10. It was the first documented zero-click prompt injection against a production AI system, and it targeted Microsoft 365 Copilot. An attacker needed to send one crafted email. No click, no download, no action from anyone. Copilot would read the email, follow the hidden instruction, and send internal file contents to a server the attacker controlled.

Microsoft patched EchoLeak before it was exploited in the wild. But the mechanism is the same one Ghostcommit just demonstrated again: an AI agent trusts content it should not, and nobody sees it happen until someone goes looking.

What to actually do about it

None of this means AI tools are unsafe to use. It means they need the same scrutiny growing businesses already apply to any system that touches sensitive data. Most companies deploying AI agents right now aren't applying it. Businesses that have already run into shadow AI exposure are usually the ones who find out this gap exists the hard way.

A few questions worth asking before the next AI tool gets turned on:

• What can this AI agent read, and what can it act on? An agent that can read email and also send email, or read a document and also write to a shared drive, is a bigger exposure than one that only reads.
• Who reviews what the agent does, and how often? "We set it up and it has been fine" is not a review process.
• Does the vendor's safety claim hold up under the specific way your team uses the tool? Ghostcommit's own research showed the exact same model produce opposite outcomes depending on the wrapper around it. A vendor's general safety marketing does not tell you how your specific configuration behaves.

This is exactly the kind of question a managed IT partner is built to keep asking, and it connects directly to logging and governance gaps that most growing businesses haven't closed yet. The tools aren't the problem. Someone has to own the ongoing job of knowing what every AI agent in the business can touch, then checking that against what it should be able to touch. That's a standing task, not a one time setup, and it's easy to skip when nobody owns it.

FAQ

What is AI prompt injection?

Prompt injection is an attack that hides instructions inside content an AI system processes, like an email, document, or image, so the AI follows the attacker's commands instead of the user's. OWASP has ranked it the top security risk for AI systems two years running.

Can prompt injection attacks target AI tools other than coding assistants?

Yes. Confirmed incidents have hit Slack AI and Microsoft 365 Copilot. Any AI agent that reads external content, including email, documents, or images, can be a target.

Is prompt injection the same thing as a data breach?

Not exactly, but it can lead to one. Prompt injection is the technique that tricks the AI into acting on hidden instructions. What happens next, like data exfiltration or unauthorized changes, is the actual breach.

How can a growing business protect itself from prompt injection risk?

Start by mapping what each AI agent in the business can read and what it can act on. Limit agents to the minimum access they need, and put a review process in place for any agent that touches sensitive data. This is an ongoing task, not a one time setup.

Do AI vendors' safety claims protect against this?

Not reliably on their own. Research on this exact attack showed the same underlying AI model produce different outcomes: safe in one tool, exploited in another, depending on how the surrounding tool was built. Vendor marketing describes general capability, not your specific setup.