The New Way Hackers Are Tricking Financial AI Assistants
by
Last Updated: 7 min read
Key Takeaways
- Hackers are actively deploying indirect prompt injection payloads in routine documents to hijack financial AI assistants.
- Unlike traditional fraud that tricks humans, this attack targets automated AI that executes commands instantly without suspicion.
- AI agents that can move money, initiate workflows, or access regulated client data are the highest-value targets for attackers.
- System prompts alone cannot secure an agent, making strict least privilege and mandatory human approvals essential.
- Because email is the primary delivery vehicle for these payloads, strict DMARC enforcement is required to authenticate messages before an AI processes them.
Security researchers scanning content in the wild recently uncovered something alarming. They found hidden instructions written not for a human, but for any AI agent reading the text. One of these was a fully weaponized payload designed specifically to make a payment-capable AI assistant execute a fixed $5,000 transaction. This was not a controlled lab demonstration. It was a real payload found in the wild.
For the last ten years, financial institutions have spent massive resources training employees not to act on convincing emails. Now, many of those same institutions have connected AI assistants to those identical inboxes. These assistants read everything, question nothing, and often operate with the permissions of the staff members using them.
This technique is called indirect prompt injection. It represents a massive shift in how financial fraud works. Below is a breakdown of how the attack functions, where banks are truly exposed, what researchers have actually proven in 2026, and the architectural controls required to stop it.
What Is Prompt Injection?
Prompt injection happens when an attacker manipulates an AI system into executing unintended commands. Direct injection occurs when a user types malicious instructions right into the chat window. Indirect prompt injection is much more dangerous. It happens when instructions are hidden inside external content the assistant reads automatically, like an inbound email, an attached invoice, or a web page.
The core reason this works is simple: current AI systems do not reliably separate instructions from data. Every document an assistant ingests is treated as potential input, meaning any external file can become a vehicle for an attack.
Why Financial AI Assistants Are the High-Value Target
Forcepoint senior security researcher Mayur Sewani frames the problem perfectly: impact scales with privilege. An AI assistant that only summarizes meeting notes represents a low risk. An assistant that can send mail, trigger a workflow, or move money is a critical, high-impact target.
The assistants currently being deployed across the financial sector are increasingly the second kind. They retrieve client records, parse compliance documents, initiate internal workflows, and in some deployments touch payment systems directly.
In a retail context, an injected instruction might simply leak a document. In a bank, that same injected instruction can move money, expose highly regulated client data, or corrupt a Know Your Customer (KYC) compliance decision.
Where a Financial Institution Is Actually Exposed
The threat model changes entirely when you give an AI agent access to banking systems. The table below details the specific operational areas where institutions are exposed today.
| Operational Area | Attack Vector | Potential Business Impact |
|---|---|---|
| Payment Operations | An assistant with approval or initiation capabilities reads an inbound instruction document containing hidden text. | The agent is tricked into routing funds to an attacker's account using the permissions of the human operator. |
| Client Onboarding & KYC | An assistant tasked with summarizing submitted documents is fed hidden text instructing it to suppress or alter a critical risk finding. | A high-risk client bypasses compliance checks. Payloads designed for content suppression are already documented in the wild. |
| Customer Service | An injected instruction arrives through a customer-submitted support ticket or chat message. | The malicious prompt executes commands using the elevated service-desk privileges granted to the AI assistant. |
| Internal Knowledge Search | Agents with access to deal documents, credit files, or board papers ingest a malicious link or document. | The AI scrapes confidential material it has access to and sends it outward to an attacker-controlled server. |
| Vendor Correspondence | Hidden payloads are embedded in inbound emails from compromised third parties. | Attackers exploit the highest-trust inbound channel to feed instructions directly to agents programmed to process vendor invoices. |
What Researchers Actually Demonstrated in 2026
This threat is no longer theoretical. Security researchers have thoroughly documented these vulnerabilities functioning in real enterprise environments in 2026.
Forcepoint’s ten in-the-wild payloads (April 2026)
On April 23, 2026, Forcepoint researchers published findings on ten indirect prompt injection payloads caught in the wild. These payloads covered content suppression, attribution hijacking, Unix command execution against developer tools, and API key theft. Most critically for banks, the research detailed a payment-fraud payload aimed at AI agents with integrated payment capabilities. The payload contained embedded instructions to trigger a fixed $5,000 PayPal transaction. Sewani characterized this as a weaponized payload intended for immediate execution rather than a harmless research probe.
The Reprompt attack on Microsoft Copilot (January 2026)
On January 15, 2026, Varonis detailed the “Reprompt” attack. This was a one-click data-exfiltration chain targeting Microsoft Copilot. The attack used a URL parameter to inject instructions. The assistant was told to repeat actions to bypass safety guardrails, setting up a continuous back-and-forth exchange with an attacker-controlled server to exfiltrate data. The attack was delivered via a legitimate-looking Copilot link sent by email, requiring just one click from the victim. Microsoft quickly patched the vulnerability, and the enterprise version of Microsoft 365 Copilot was reportedly unaffected, but the mechanism proved that an agent will happily hand over whatever internal context it can access if tricked.
The broader pattern
This is not a single vendor’s problem. Injection attacks have been successfully demonstrated against agentic coding tools via source-code comments, and guardrail bypasses are well-documented across multiple major models.
This Is Business Email Compromise With a Different Target
The pattern of an indirect prompt injection attack is functionally identical to Business Email Compromise (BEC). A fraudulent instruction arrives looking entirely legitimate, and someone acts on it. The critical difference is that the “someone” is now software. The AI has no hesitation, no gut feeling that something is wrong, and no instinct to pick up the phone and verify a strange request with the CFO.
Fortunately, the controls institutions already run for BEC transfer directly to this new problem. Out-of-band verification, multi-person approval for payment or payee changes, and hard caps on any single automated action are still your best defenses. An AI agent must operate inside those existing controls, never outside them.
Controls: Reducing the Blast Radius of an AI Agent
Security architects and risk teams need to build structural controls around AI agents. You cannot rely on system prompts alone to secure a financial platform.
| Control Principle | Practical Implementation | Security Goal |
|---|---|---|
| Least Privilege | Restrict payment, send, and approval authority heavily. | Ensure most assistants only possess read scope, limiting what they can break if compromised. |
| Human-in-the-Loop | Mandate human approval for consequential actions. | Keep the security boundary on the action itself. A financial payment must always require a human to click approve. |
| Zero Trust for Content | Treat all ingested documents (PDFs, emails, docs) as untrusted user input. | Prevent the agent from executing raw text scraped from external files without validation. |
| API & Tool Logging | Maintain strict audit trails of exactly what the agent read and what it executed. | Ensure rapid forensic visibility during an incident response investigation. |
| Strict Egress Filtering | Block outbound connections to unknown or untrusted IP addresses. | Stop attacks like the Reprompt chain that depend on reaching an attacker-controlled server to exfiltrate data. |
| Unified Workflows | Integrate AI agents into your current payment control frameworks. | Prevent the creation of parallel, untested approval processes that bypass existing security checks. |
Be realistic about detection. Filtering inbound documents for known prompt injection trigger phrases is just a speed bump. Attackers will simply rephrase their payloads.
You Cannot Prompt Your Way Out of This
As long as an AI agent can be persuaded by text, the only durable controls are structural. You must physically restrict what the agent is allowed to do, what systems it can reach, and which actions strictly require a human. Better system prompts and vendor guardrails definitely raise the cost of an attack, but they do not eliminate the vulnerability class. For a regulated financial institution, that distinction is the difference between a control you can prove to an auditor and one you can only guess is working.
What Supervisors Are Signalling
Regulators are paying close attention to this shift. FINRA’s 2026 Artificial Intelligence key-topics guidance and oversight reporting specifically singled out agentic AI as a distinct supervisory risk category. Because these systems take autonomous actions rather than just generating text, firms must maintain complete audit trails and implement human checkpoints before execution. FINRA also highlighted the risks of shadow AI and the necessity of treating third-party AI platforms as high-risk vendors (as detailed in secondary coverage by Smarsh).
The OCC has also signaled that comprehensive AI model governance guidance for banks is on the horizon. Additionally, FS-ISAC published a set of AI risk white papers for the financial sector covering adversarial AI taxonomy and vendor evaluation. Note that those papers were released in February 2024 and predate the agentic wave, but they remain useful for basic sector grounding.
Supervisors and security architects are fundamentally asking for the exact same thing: demonstrable human oversight of consequential AI actions. That regulatory alignment is the strongest internal argument a security leader has for securing funding to build these controls.
Where Email Authentication Fits
It is important to state clearly what email authentication cannot do. DMARC at p=reject does not stop prompt injection; it does not inspect message content, and it does not constrain what an AI agent is permitted to do.
However, the injection payloads most likely to succeed against a bank’s AI assistant are the ones that arrive looking like they came from the CFO, a correspondent bank, or a trusted payment processor. Email is the primary way untrusted content reaches these AI systems. The disclosed Reprompt chain was delivered by an emailed link. When an AI agent processes mail with zero human oversight, sender authenticity becomes the absolute last trust signal in the pipeline.
Financial services has some of the highest DMARC adoption rates of any industry, but unfortunately, some of the weakest enforcement. If you are hooking AI up to an inbox, enforcing strict email authentication is no longer optional. For more context on securing this vector, see our research on Phishing in Financial Services and Financial Institutions DMARC.
Conclusion
For the past decade, the weakest link in financial email security was the human employee who clicked a bad link. Institutions have now handed that exact same inbox over to software that reads everything, questions nothing, and holds real system permissions. The first payloads written specifically to exploit those automated agents are already operating in the wild.
The solution requires a layered approach. You must constrain what AI agents are physically allowed to do, keep human beings in the loop for consequential actions, bring these agents inside your existing payment controls, and heavily authenticate whatever data reaches them.
Check your domain’s security posture with our DMARC record checker or visit our Financial Services solution page to learn more about securing your inbound channels.
Frequently Asked Questions
What is prompt injection in simple terms?
It is a cyberattack where a hacker hides secret instructions inside a document or email. When an AI assistant reads that file, it unknowingly executes the hidden commands.
Can prompt injection make an AI assistant transfer money?
Yes. If an AI agent has been granted access to payment systems and lacks human-in-the-loop approval controls, a hidden instruction can force it to initiate unauthorized transfers.
Has prompt injection been used in real attacks?
Yes. In April 2026, researchers documented ten distinct indirect prompt injection payloads in the wild, including one specifically designed to execute a $5,000 PayPal transaction.
How is prompt injection different from business email compromise?
The attack pattern is similar, but the victim is different. Instead of tricking a human employee into wiring money, the attacker tricks an automated AI software agent that executes the request instantly.
What controls should a bank put around an AI agent?
Banks must enforce the principle of least privilege, require human approval for all consequential actions, implement strict network egress filtering, and log every API call the agent makes.
Does DMARC or email authentication stop prompt injection?
No, DMARC cannot inspect the content of an email for hidden prompts. However, it blocks spoofed emails from reaching the AI in the first place, removing a major delivery vector for the attack.
Content Specialist at PowerDMARC
Milena is a skilled writer and content creator with 7+ years of experience in crafting engaging content on IT, cybersecurity, virtual events, and more. She has a proven track record of delivering high-quality work for international magazines and is a graduate of prestigious institutions such as New York University Abu Dhabi, UWC China, and the College of Europe.
Latest posts by Milena Baghdasaryan (see all)
- The New Way Hackers Are Tricking Financial AI Assistants - September 7, 2026
- DNS Security Best Practices: A Complete Hardening Checklist - September 7, 2026
- Dynamic SPF vs Auto SPF vs Hosted SPF: Which One Actually Fixes Your SPF Record? - August 25, 2026
