Prompt Injection Is Now the Top AI Security Risk. Most Enterprises Aren't Ready.

Prompt injection - feeding an AI system input designed to override its intended instructions - is ranked LLM01, the top risk, in OWASP's list of AI security threats, with reported attack success rates of 50–84% depending on configuration and attempt count. Cisco's State of AI Security 2026 report found that while 83% of organisations plan to deploy agentic AI, only 29% feel ready to do so securely, and just 34.7% have deployed dedicated prompt injection defenses.

Why agentic AI raises the stakes

A successful prompt injection against a simple chatbot produces misleading text. A successful injection against an agentic AI system - one with the ability to take real actions, like querying databases, sending emails, or executing transactions - can produce real-world consequences. Reported testing has shown autonomous agents moving through enterprise systems in under two hours once compromised, and the average cost of an AI agent-related breach now sits at roughly $4.7 million. Critical vulnerabilities with active exploitation have already surfaced in mainstream coding and productivity copilots, with CVSS scores as high as 9.8.

There's no clean fix yet

This is the uncomfortable part: even frontier models from the major AI labs remain vulnerable to prompt injection after their best current defenses are applied. There is no patch that fully closes this class of vulnerability today - which means the practical answer is defense in depth, not a single control.

What this means for Fintech and Insurance firms adopting AI agents

• Treat any AI agent with access to customer data, payment systems, or claims data as a new attack surface requiring its own threat model - not as a feature bolted onto an existing, already-secured application.
• Constrain what agents can actually do, not just what they're instructed to do - least-privilege access controls matter more than prompt-level guardrails, because guardrails can be bypassed.
• Log and monitor agent actions the way you'd monitor a new, unvetted employee with system access - because functionally, that's a reasonable way to think about what an agent is.
• Test your own AI-powered features for prompt injection before an attacker does; this is now a standard component of a modern application penetration test, not an optional add-on.