AI agent security in banks and payment firms

The best-known attack is prompt injection: instructions hidden in an email, a document or a web page that the agent reads and then follows. IBM lists further routes, among them tricking an agent into misusing a connected tool, planting false data in its memory, and stealing the credentials an agent uses so an attacker can pose as it. The damage grows with the agent's rights, and IBM's list of controls starts with zero trust and least privilege.

The OWASP Top 10 for Agentic Applications, written with more than 100 security experts, sorts these risks from agent goal hijack to rogue agents. A bank can use it as a checklist for penetration tests and model risk reviews of an agent before go-live.

BaFin's guidance on ICT risks in the use of AI at financial entities applies DORA to AI systems and names three risks in operation. A language model can be forced into unplanned behavior by malicious prompts, for example through a link to a web page with hidden instructions. A compromised assistant can hand confidential data to users who have no right to see it. And API access to a model can give attackers a way into the systems connected to it. BaFin suggests monitoring AI interactions, detecting anomalies and assigning access rights with care.

The guidance is not binding, but the duties behind it are: ICT risk management and third-party risk management under DORA. Each model provider and each MCP server an agent uses is an ICT service that the bank has to assess, contract and record.

Stripe lets agents act through its MCP server with narrow agent keys and requires a person to approve refunds and outgoing payments before they run; its documentation warns of prompt injection when agents combine several servers. Visa and Mastercard give shopping agents signed identities, so a merchant can block a bot that only pretends to be one; the Trusted Agent Protocol page explains the method.

In the United States, FINRA's observations on AI agents list agents acting beyond their intended authority and multi-step reasoning that is hard to trace among the risks it sees at member firms. Logging every tool call is the common answer to both.

AI agent security is the protection of AI agents, their credentials and the systems they can reach against manipulation and misuse. It covers what the agent reads and what it is allowed to do.

Prompt injection is an attack in which text the agent reads, such as an email or a web page, contains instructions that make the agent do something its owner did not intend, for example send data out or call a payment tool.

In the EU, DORA's rules on ICT risk and ICT third parties, and in Germany BaFin's guidance on ICT risks of AI. The EU AI Act adds accuracy and cybersecurity duties for high-risk systems such as credit scoring.