# Unauthorized Financial Action by AI Agent

- **Severity:** Critical
- **Signature ID:** `99e415b6-9b5a-40c4-b77b-d35958fb3aac`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI08 (Supply Chain Attacks on Agent Ecosystems), ASI09 (Traceability and Accountability Gaps), LLM06 (Excessive Agency)

## Summary

This detects an AI agent invoking a payment, transfer, or purchase tool without getting explicit human approval in that conversation. Financial actions are irreversible, so an agent acting on chat context alone — rather than a clear, current confirmation — is a serious problem regardless of how it got there.

## How the attack works

An agent is given access to tools that can move money: bank transfers, WeChat/Alipay payments, red packets, crypto transactions, subscriptions, or in-app purchases. Something in the conversation — a manipulated instruction, a poisoned document, a chained tool result, or even a bug — pushes the agent to treat a financial action as already approved. The agent then calls the payment or transfer tool directly, without the user explicitly confirming that specific action in the current turn. This rule catches that tool call itself, so it still fires even if an earlier prompt-injection detection was evaded.

## Why it matters

Money leaves the organization or a user's account without a real human decision behind it — a direct financial loss that may also be hard to reverse.

## What you can do

- Require explicit, per-transaction human confirmation before any agent-controlled payment or transfer tool executes, and don't accept prior chat context as consent.
- Set hard spending limits and allow-lists for any account or wallet an agent can reach.
- Log and review all agent-initiated financial tool calls separately from read-only actions like balance or history checks.
- Separate read-only financial tools (status, history) from action tools (pay, transfer, purchase) so agents can't escalate from one to the other implicitly.

## Known benign look-alikes

- User explicitly asking agent to check payment status (read-only)
- Agent displaying payment history or transaction records
- Financial education chatbot explaining how payments work
- Agent generating payment-related code (not executing)
- A financial compliance training chatbot explaining the steps involved in wire transfers and payment processing workflows

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00098

---
Source: https://www.netzilo.com/threats/atr-unauthorized-financial-action-by-ai-agent