Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

Warning: This story will go fairly deep into the details of agentic artificial intelligence (AI) and agentic security. And another warning: You need to go there. Here’s why. An employee doesn’t have to approve a fraudulent payment for an AI agent with access to financial accounts to follow an attacker’s instructions.

No. The culprit could be an innocent-looking document. In that case, “someone hides an instruction in an email, a shared document or a support ticket,” J.D. Salbego, founder and CEO of ClawSecure, told PYMNTS.

It’s called indirect prompt injection, and it’s a threat that can escape the notice of both the person using an agent and the agent itself. For financial institutions, the potential damage depends on what the system can reach: payment accounts, passwords, customer information or infrastructure supporting other operations.

ClawSecure tested 14 models across five labs. Salbego told PYMNTS the research found a recurring pattern across models and integrations involving Dropbox, Notion and Linear. Testing several providers, he said, was intended to establish whether the exposure extended beyond an individual model.

Connected applications give the attack additional routes. Salbego described an agent working through Dropbox that could also connect to Gmail. Security teams need to examine the exchanges between those services, including instructions and requests that might appear ordinary when considered separately.

“You have to watch and understand the messaging between a model and a tool,” he added.

Source link