Synthetic-PAN Payment Probe — Test Credit-Card Data Submitted to a Live Payment System
An attacker instructs an AI agent that has payment or transaction capabilities to submit a specific, made-up credit card number into a live payment system, framing it as a 'security test'. Real payment testing never works this way — it uses sandbox tokens on sandbox endpoints, not arbitrary card numbers on production infrastructure.
How the attack works
The attacker gives the agent a prompt containing a full 16-digit card number and language claiming it is for testing or simulating the security of an online payment system. The agent, if it has tooling to submit payment or transaction data, follows the instruction and passes the card number into a live payment endpoint. Because the request is framed as a security test rather than an obvious fraud attempt, the agent may not recognize it as harmful. The result is an unauthorized transaction attempt on a production payment rail using attacker-supplied card data.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4631c5df-1986-48b4-8e48-c2b2dd790edf
- Severity
- High
Why it matters
An organization could see fraudulent or unauthorized charges attempted through its live payment system, potential card-network flags for suspicious activity, and misuse of agent tooling that was meant for legitimate transactions.
What you can do
- →Restrict agents with payment or transaction tools so they cannot submit card data to production endpoints under any 'test' or 'simulation' pretext.
- →Require that all payment testing go through dedicated sandbox environments with designated test tokens, never real-looking PANs on production systems.
- →Review agent logs for card-number patterns combined with words like 'test', 'simulate', or 'security check' directed at payment tools.
- →Add explicit guardrails or human approval steps before an agent can submit any card or payment data to a live system.
Known benign look-alikes
- Abstract questions about payment-system security with NO card number present.
- Legitimate sandbox/test-token usage that references documented test PANs only in a clearly non-production sandbox context (reviewer discretion).
- Security research corpora cataloguing ASB attack strings as reference samples — should be allowlisted by a reviewer.