# Indirect PI — Unauthorized Financial Transfer via Agent Tool

- **Severity:** Critical
- **Signature ID:** `698563bf-f79e-4c87-a102-02e90d97290a`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection)

## Summary

AI agents that can read text from outside sources — product reviews, notes, repo descriptions, user bios — can be manipulated by hidden instructions planted in that text. If the agent also has access to payment or banking tools, an attacker can use this trick to make it move money or crypto to an account they control, without the real user ever asking for it.

## How the attack works

An attacker plants malicious instructions inside content the agent is likely to read as ordinary data, such as a product review, a customer note, a repository description, or a user bio. When the agent processes that content, it treats the embedded instructions as commands rather than data. If the agent has payment or banking tool access, those instructions can direct it to initiate a transfer, send cryptocurrency, or withdraw funds to an account the attacker controls. This happens without the legitimate user issuing any such request themselves.

## Why it matters

An organization can lose money or crypto assets directly, transferred by its own AI agent acting on injected instructions instead of user intent. It also loses assurance that any agent-initiated financial action reflects a real authorization.

## What you can do

- Require explicit human confirmation for any financial transfer or payment action an agent initiates, regardless of what triggered it.
- Do not give agents standing access to payment or banking tools unless the task strictly requires it; scope and time-limit that access.
- Treat all externally sourced text the agent reads (reviews, bios, descriptions, notes) as untrusted data, not instructions, and sanitize or isolate it before the agent processes it.
- Log and review agent-initiated financial actions for cases where the instruction did not originate from the authenticated user.

## Known benign look-alikes

- Legitimate payment automation workflows configured by authorized users
- Financial services tools where the user explicitly instructs payment actions

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00708

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-unauthorized-financial-transfer-via-agent-tool