In June 2025, the Echo Leak vulnerability (CVE-2025-32711) showed that a single email could cause Microsoft 365 Copilot to retrieve internal files and send them externally, with no user interaction. By contrast, a team extracted part of a production OpenAI model for roughly $20 in API queries. Almost every LLM vulnerability traces to one property: instructions and data arrive as a single token sequence with no separation, unlike parameterized database queries that keep code and data apart.

Prompt injection exploits this through a direct route (hostile chat input) and an indirect route (text retrieved during legitimate tasks, as Echo Leak demonstrated). The OWASP Top 10 for Large Language Model Applications maps risks across the pipeline: input, retrieval via RAG, model processing, tool calls, output, monitoring, and supply chain. Poisoned RAG achieved a 90 percent success rate using as few as five malicious passages in a knowledge base of millions.

Attacks targeting model interiors—weight theft, training-data extraction, and training-time poisoning—are real but rank low for initial developer effort, as they tend to be expensive, narrow, or already mitigated by model providers.