Researchers Demonstrate Indirect Prompt Injection Vulnerability in Banking AI Assistants

Researchers discovered an indirect prompt injection vulnerability in banking AI assistants that could allow attackers to compromise the systems with minimal effort. By sending a small bank transfer with carefully crafted malicious instructions hidden in the transaction description, an attacker could manipulate the AI assistant into launching targeted phishing attacks. When a user subsequently queries the assistant about their recent transactions, the system retrieves the malicious transfer data and processes the hidden instructions as part of the language model's context, causing it to generate a fraudulent reauthentication request that appears to come from the bank itself. The attack requires no device access, malware, or traditional social engineering. The underlying issue stems from how financial AI assistants treat all retrieved data equally when passing it to language models, failing to properly distinguish between trusted instructions and untrusted external data like transaction descriptions set by third parties.