Prompt Injection Is Still #1: Attackers Now Target RAG, Model Routers and Fine-Tuning

One thing never changes in AI security: prompt injection. For a second edition it sits at the top of OWASP's LLM Top 10 as LLM01 — the most critical vulnerability. In 2026 the attack surface has widened: the target is no longer just the chat box.

Why the numbers matter

Attack success rates have reached 84% in agentic systems, and production exploits now carry CVSS scores above 9.0. CrowdStrike's 2026 Global Threat Report documented malicious prompts injected into legitimate generative AI tools at more than 90 organizations in 2025.

New targets: RAG, routers, fine-tuning

• RAG pipelines: the vector databases and embeddings are an attack surface in themselves. PoisonedRAG reaches 90% success with just five crafted documents among millions.
• Model routers: injection into the layer that decides which model a request goes to.
• Fine-tuning and synthetic data: poisoned examples bake a backdoor straight into model weights.
• 53% of companies moved from fine-tuning to RAG/agentic pipelines — so these flaws affect the majority.

Defense: one layer isn't enough

A single filter will not stop prompt injection. You need input validation, authorization on tool calls, output inspection and least-privilege together. The key point: security belongs in the request flow itself, not in the model.

The remot angle

remot moves security into the orchestration layer: it passes every request through a single point, inspects input and output, limits by policy which agent may call which tool and data, and masks sensitive information. That way prompt injection is met in a central, auditable layer rather than app by app.