An indirect prompt injection vulnerability was found in a European bank's AI assistant. An attacker can hide malicious instructions in a €0.02 transfer description to launch a phishing attack.
Security firm Blue41 discovered an indirect prompt injection vulnerability in a major European bank's AI assistant. An attacker sends a small transfer (€0.02) with a malicious prompt in the transaction description. When the user asks the AI assistant about recent transactions, the assistant retrieves the data and the LLM processes the injected instructions, potentially generating a phishing message within the bank's own app.
Modern banking apps use AI assistants that retrieve data from backend sources like transaction records and pass it to an LLM as context. The challenge is that externally set data (e.g., transaction descriptions) can be interpreted by the LLM as instructions rather than data. This is not unique to one bank but a broader architectural issue for financial AI agents processing untrusted inputs.
This attack requires no device access, malware, or traditional social engineering. It can produce highly credible phishing messages inside the bank's own app, referencing real transaction details. Financial institutions must implement security measures to assess the trust level of retrieved data and distinguish between instructions and data when feeding external inputs into LLM context.
Commenters view this attack as closer to phishing than SQL injection, noting that the essence of prompt injection lies in the "method of prompt delivery." They criticize the fundamental design flaw of banking AI agents indiscriminately displaying URLs from transaction histories. Some question the practicality of the attack, pointing out that it requires a three-step condition: "unfamiliar transfer → AI query → link click." Others suggest the article may be promotional content for a specific security product, citing a lack of evidence.