Indirect PI — Unauthorized Financial Transfer / Payment Initiation Hijack
This detects a prompt injection attack where instructions hidden in content an AI agent reads — like a document, email, or webpage — try to trick it into initiating a real financial transfer. The injected text typically overrides the agent's original task and supplies its own bank account number, payee ID, and payment amount.
How the attack works
An attacker plants text inside content that an AI agent will process, such as a document, support ticket, or webpage, disguised as a system directive using phrases like 'IMPORTANT!!! Ignore all previous instructions'. The hidden instructions tell the agent to initiate a wire transfer, account-to-payee payment, or service payment, and supply the attacker's own account number and payee identifiers along with an amount. If the agent has been granted the ability to execute payments and does not distinguish between its user's instructions and text it merely read, it can carry out the transfer as directed. This is distinct from attacks that only try to steal payment credentials — here the goal is to get money moved directly.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f9ae282d-1aa8-44cc-bb36-763fd82e30da
- Severity
- Critical
Why it matters
An organization can lose real funds through a payment the agent executes on the attacker's behalf, with the transfer going to an account the attacker controls.
What you can do
- →Require a separate, out-of-band human confirmation step for any financial transfer an agent initiates, especially when the instruction originated from content the agent read rather than from the authenticated user.
- →Restrict which agents or workflows have the authority to initiate payments, and cap transfer amounts they can execute without human sign-off.
- →Treat all content an agent ingests (documents, emails, web pages, tickets) as untrusted input that cannot alter the agent's authorized task or introduce new payment instructions.
- →Log and review payment-initiation actions taken by agents, flagging any where the payee, account number, or amount did not originate from the verified user request.
Known benign look-alikes
- Legitimate payment confirmation workflow triggered by verified user instruction
- Financial API documentation describing payment initiation parameters
- Security testing documentation describing financial injection attacks