Anatomy of an Admin Key Exfiltration on a Banking AI Assistant (CVSS 9.8)

2026-07-12 · Source: Artificial Intelligence on Medium · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Advanced, short

Summary

A critical Indirect Prompt Injection vulnerability (CVSS v3 score: 9.8 - Critical) was demonstrated in a production banking AI assistant, leading to the exfiltration of an administration API key. The attack involved an adversary embedding a malicious payload into a transaction memo, which the autonomous tool-using LLM agent later processed as trusted instructions. When a user requested a transaction summary, the model executed an internal admin_internal_config tool and then used send_email to send the ADMIN_KEY to an attacker. Guardrails failed due to trust boundary collapse between system prompts and retrieved data, excessive agent agency allowing access to admin tools, and a lack of output-side validation for sensitive data or third-party recipients.

Key takeaway

For AI Security Engineers designing or auditing banking AI assistants, you must prioritize robust tool orchestration and data validation. Implement a deterministic tool broker to enforce strict policies, preventing agents from executing unauthorized actions like sending internal secrets or contacting third parties. Additionally, treat all data flowing into the LLM from external sources as untrusted, and integrate continuous adversarial testing into your CI/CD to proactively identify and mitigate indirect prompt injection risks.

Key insights

Autonomous AI agents are vulnerable to indirect prompt injection when treating retrieved data as trusted instructions for tool execution.

Principles

• Separate privileges: customer-facing agents should not access admin tools.
• Taint untrusted data from retrieval sources.
• Implement deterministic egress filters for all outbound actions.

Method

Implement an orchestration layer or "tool broker" between the LLM and tools to deterministically enforce policies, such as preventing sensitive keyword leakage in send_email bodies or validating recipients against authenticated users.

In practice

• Wire LLM red-team payloads into CI/CD pipelines.
• Treat all tool call parameters as hostile until validated.
• Design agents with distinct scopes and keys.

Topics

• AI Security
• Prompt Injection
• Banking AI
• LLM Agents
• Tool Orchestration
• API Key Exfiltration

Best for: AI Security Engineer, MLOps Engineer, AI Engineer

Related on AIssential

• As builders race to ship AI agents, searches for “prompt injection” have doubled in a year — Public interest in prompt injection attacks is rapidly increasing, posing significant risks for autonomous AI agents.
• The Model Called a Tool I Never Gave It — When LLM tools run on uncontrolled client devices, the architecture shifts from prompt engineering to trust and reliability.
• Last week in AI | 16 March — AI advancements like GPT-5.4 and Claude Code require robust security, explicit instructions, and rigorous testing to counter inherent vulnerabilities and instability.
• Brit mathematician lets AI agent loose with credit card – cue password leaks, CAPTCHA chaos and more — Autonomous AI agents, while capable, pose significant risks regarding data privacy and security when given agency.
• Is a secure AI assistant possible? — AI personal assistants with external access pose significant security risks, especially from prompt injection attacks.
• I Tried to Break an AI’s Security — Here’s Everything I Learned as a Complete Beginner — The core vulnerability in prompt injection lies in language itself, making traditional security controls insufficient.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence on Medium.