Unauthorized Financial Action by AI Agent
This detects an AI agent invoking a payment, transfer, or purchase tool without getting explicit human approval in that conversation. Financial actions are irreversible, so an agent acting on chat context alone — rather than a clear, current confirmation — is a serious problem regardless of how it got there.
How the attack works
An agent is given access to tools that can move money: bank transfers, WeChat/Alipay payments, red packets, crypto transactions, subscriptions, or in-app purchases. Something in the conversation — a manipulated instruction, a poisoned document, a chained tool result, or even a bug — pushes the agent to treat a financial action as already approved. The agent then calls the payment or transfer tool directly, without the user explicitly confirming that specific action in the current turn. This rule catches that tool call itself, so it still fires even if an earlier prompt-injection detection was evaded.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 99e415b6-9b5a-40c4-b77b-d35958fb3aac
- Severity
- Critical
Why it matters
Money leaves the organization or a user's account without a real human decision behind it — a direct financial loss that may also be hard to reverse.
What you can do
- →Require explicit, per-transaction human confirmation before any agent-controlled payment or transfer tool executes, and don't accept prior chat context as consent.
- →Set hard spending limits and allow-lists for any account or wallet an agent can reach.
- →Log and review all agent-initiated financial tool calls separately from read-only actions like balance or history checks.
- →Separate read-only financial tools (status, history) from action tools (pay, transfer, purchase) so agents can't escalate from one to the other implicitly.
Known benign look-alikes
- User explicitly asking agent to check payment status (read-only)
- Agent displaying payment history or transaction records
- Financial education chatbot explaining how payments work
- Agent generating payment-related code (not executing)
- A financial compliance training chatbot explaining the steps involved in wire transfers and payment processing workflows