CrowdStrike Identifies Prompt Injection as a New Threat

According to CrowdStrike's 2026 Global Threat Report, attackers injecting malicious prompts into legitimate AI tools to steal credentials and cryptocurrency were found at more than 90 organizations over the past year. The scale of AI-driven attacks increased 89% year-over-year.

Prompt Injection, unlike traditional code-based hacking, is an attack method that uses natural language to disable an AI's instructions (System Prompt) and induce it to follow new commands. It exploits the fact that AI models cannot clearly distinguish between a developer's rules and a user's input.

This attack method brings about the following serious changes:

• Collapse of the technical barrier: Instead of complex coding skills needed to find software vulnerabilities, attacks are now possible with just linguistic ability to persuade an AI.
• Expansion of the attacker pool: As AI-powered attacks become possible even at the level of ordinary users rather than professional hackers, the accessibility of attacks has increased dramatically.