Prompt injection against financial agents
Prompt injection, jailbreak attacks and LLM security appear on 37 recent papers, all in AI journals. Banks and brokers are deploying agents that read emails, documents and web pages and then act. A hidden instruction in a document can make such an agent move money or leak data. How exposed are deployed financial agents, and which defences hold?
What prompted this#
Since October 2025, 37 papers carry a prompt-injection, jailbreak, adversarial-prompt, LLM-security, agent-security or red-teaming keyword, all in AI journals: "prompt injection" on 11, "jailbreak attacks" on 10, "LLM security" on 6, "adversarial prompts" on 5, "red teaming" on 4. Agentic AI and LLM agents are among the rising keywords in the AI journals, and none of the security papers concerns finance.
Questions#
- In a sandbox with a financial assistant that reads documents and can call payment and trading tools, what share of injected instructions in invoices, emails and web pages succeed?
- Which defences (tool permission layers, instruction hierarchies, human confirmation thresholds) reduce success without making the agent useless?
- How would an attack look in audit logs, and could existing fraud controls catch it?
Data that could help#
Open agent frameworks, a corpus of documents with injected instructions, and the control frameworks that banks use for payment authorization.
Next step#
Build a sandboxed financial agent with payment tools and measure the success rate of injected instructions in 1,000 documents under three defence configurations.