Prompt injection is exploiting enterprise AI's biggest design flaws by targeting agents, RAG pipelines and model routers

OWASP’s LLM Top 10 (2025) again flags prompt injection as LLM01 (most critical LLM-specific vulnerability), while CrowdStrike reports prompt injection was used at 90+ organizations in 2025 and “prompt injection” drove an 89% YoY increase in overall AI attack volume. Reported incidents include a Slack AI prompt injection that enabled data exfiltration and a zero-click EchoLeak (CVE-2025-32711, CVSS 9.3) exploit against Microsoft 365 Copilot—both later patched—underscoring practical, repeatable enterprise risk. The article recommends constraining model permissions, segmenting untrusted content (incl. RAG sources), monitoring/approving tool use, validating provenance, and hardening model routers.

Analysis

The market is likely underpricing the budget reallocation this creates: AI rollout does not stop, but it becomes a security-and-governance purchase rather than a pure productivity upgrade. That favors platforms already embedded in identity, endpoint, cloud, and data controls; the best relative beneficiary is CRWD because AI risk expands the attach points for its existing stack, while smaller governance names could get a narrative lift if they have real distribution.

For MSFT, the bigger issue is not direct loss of Copilot demand but procurement drag. Once legal and security teams treat every autonomous workflow as a potential exfiltration path, adoption shifts from a broad rollout to gated deployment with human approval, which can defer monetization by 1-2 quarters and pressure near-term sentiment on AI-software multiples. The counterpoint is that Microsoft can monetize the remediation layer itself, so any downside is more about timing than structural demand destruction.

The contrarian view is that this is a secular tailwind for cybersecurity spend, not a reason to abandon enterprise AI. If the next earnings cycle shows rising commentary on AI governance, data loss prevention, and tool-approval workflows, the initial risk-off move in software should reverse. Falsifiers: no uptick in security budget language, no increase in incident-driven procurement scrutiny, or evidence that Copilot hardening is invisible to users and does not slow seat expansion.

Key Decisions for Investors

• Long CRWD on a 1-3 month horizon, ideally on any headline-driven pullback; the trade works if AI-security spend becomes a named budget bucket and should outperform broader software by 5-10% if AI governance is the new gating item.
• Pair trade: long CRWD / short MSFT into the next enterprise software earnings window; CRWD has cleaner direct monetization of the threat, while MSFT carries the most near-term trust/rollout friction. Use a tight stop if MSFT shows Copilot attach and usage metrics remain unaffected.
• If you want to express a broader software multiple reset, short IGV against CRWD rather than shorting single names aggressively; the thesis is slower deployment cycles for AI features, not a collapse in demand. Monitor for a reversal if security commentary turns into actual revenue acceleration.
• Watchlist only on AIPG: if this is a liquid AI-security/governance pure play, it could benefit disproportionately from the theme, but do not initiate without confirming revenue quality, customer concentration, and borrow/liquidity.