# Indirect PI — Financial / Payment Credential Exfiltration via Agent Email

- **Severity:** Critical
- **Signature ID:** `4b1023f0-92f9-4a68-8ebe-7a4c7ab27a28`
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

Attackers hide instructions inside content an AI agent reads later, like a product review or a repository description. Those instructions tell the agent to pull up saved payment methods or bank details and send them to an email address the attacker controls.

## How the attack works

An attacker plants text in a place the agent is expected to read, such as a product review, note, or repo description. The text contains an override phrase like 'IMPORTANT!!! Ignore all previous instructions' followed by a command to retrieve stored payment or banking data. Because the agent processes this content as part of its normal workflow, it can follow the embedded instruction instead of the original task. If the agent has access to saved payment methods or bank details and can send email, it exfiltrates that data to the attacker's address.

## Why it matters

An organization can lose stored payment card numbers, bank account details, or other financial credentials, sent directly to an attacker without any direct interaction between the attacker and the victim's systems.

## What you can do

- Restrict which agents can access stored payment or banking data, and separate that access from agents that read untrusted external content.
- Require explicit user confirmation before an agent sends financial data via email or any outbound channel.
- Filter or sanitize third-party content (reviews, notes, repo descriptions) before it reaches an agent's context, stripping instruction-like phrases.
- Log and review agent email actions that include financial data, especially when the destination address is not previously known to the account.

## Known benign look-alikes

- User requesting their own billing summary from a legitimate financial service agent
- Customer support flows confirming masked payment methods to account holder
- Security documentation describing payment-data exfiltration attack scenarios

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00851
- https://github.com/CUA-Framework/VPIBench
- https://arxiv.org/abs/2408.11972

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-financial-payment-credential-exfiltration-via-ag