Prompt Injection in Production: What We Found Red-Teaming Enterprise LLM Deployments
Prompt injection has held the #1 position in the OWASP Top 10 for LLM Applications since the list was created, and across our red-team engagements, it remains the vulnerability class we exploit most reliably. The uncomfortable finding: most enterprise LLM deployments are tested like software, but attacked like people. Traditional AppSec testing barely touches the failure modes that matter.
The three patterns that keep working
1. Indirect injection through retrieval. The copilot doesn't need to trust the user, it trusts the documents. Payloads planted in a shared drive, a support ticket, an inbound email, or a scraped web page get retrieved into context and executed as instructions. In RAG-heavy deployments this is consistently the softest entry point, because content-ingestion pipelines were never designed as trust boundaries.
2. Privilege inheritance. LLM applications frequently run with the union of all users' permissions rather than the caller's. When an assistant can query the data warehouse, the question "summarize everything you can see about executive compensation" becomes an access-control bypass, no exploit code required.
3. Tool-chain escalation. Agentic deployments that can send email, file tickets, or call APIs convert a text vulnerability into an action vulnerability. A single injected instruction in a low-trust input can trigger a high-trust action downstream.
The guardrails that held
- Least-privilege per request. The model's effective permissions must equal the requesting user's, enforced at the tool and data layer, not in the system prompt.
- Trust-tiered context. Retrieved content is labeled and constrained; instructions are accepted only from designated channels. Content from ingestion is data, never directive.
- Human approval on consequential actions. Anything that sends, deletes, pays, or grants requires an approval step. This single control neutralized the majority of our successful attack chains.
- Output handling as a security boundary. Model output rendered into HTML, SQL, or shell contexts must be treated as untrusted input to those systems.
- Continuous adversarial testing. Point-in-time pen tests decay fast because prompts, models, and connected tools change weekly. Testing must run at release cadence.
How we test
ZenC Labs engagements map every finding to OWASP LLM Top 10 and MITRE ATLAS technique IDs, replay attack chains against staging with your engineers watching, and deliver fixes ranked by exploitability, not a severity-score spreadsheet. Typical engagement: two weeks from scoping to executive readout.