Prompt Injection and What It Means for Financial Services
Prompt injection currently ranks as the top vulnerability in the OWASP Top 10 for large language model applications. For organizations deploying AI in financial services, it is worth understanding not as an abstract model-layer concern but as a practical path to unauthorized action inside your environment.
What Prompt Injection Is
A language model does not reliably distinguish between instructions from you and instructions contained in the data it processes. If content the model reads includes text shaped like a command, the model may follow it.
Direct prompt injection is a user deliberately crafting input to override intended behavior. Indirect prompt injection is more relevant to most financial services deployments: instructions embedded in content the system ingests during normal operation. A document. An email. A support ticket. A web page. A transaction memo field.
The user did not attack the system. The system read something an attacker planted, and acted on it.
Why Financial Services Is Exposed
Consider what AI systems in financial institutions are typically pointed at. Customer emails. Support tickets. Uploaded documents in onboarding and lending workflows. Vendor correspondence. Transaction descriptions. Nearly all of it is attacker-influenced content, meaning someone outside your organization can determine what text ends up in front of your model.
If that model can only produce a summary, the consequence is a bad summary. If it can take action, query systems, retrieve records, trigger workflows, initiate transactions, the consequence is different in kind.
This is why the shift from generative to agentic AI matters for risk. Generative systems create content risk. Agentic systems create execution exposure. The same injection technique that produced a misleading paragraph last year can produce an unauthorized action this year.
Why You Cannot Solve This in the Prompt
The common first response is to strengthen the system prompt. Instruct the model to ignore instructions found in user content, refuse suspicious requests, and stay within scope.
This helps and it is not a control you should rely on. The model is applying probabilistic judgment to natural language, and natural language admits an unbounded number of phrasings. Defenses expressed in the same channel as the attack are inherently contestable. Treat prompt-level guardrails as risk reduction, not as an authorization boundary.
Controls That Hold
Enforce Authorization Outside the Model
One of the most important architectural principles here is that the model should not be the thing deciding what it is allowed to do. Permissions belong in deterministic systems that the model calls, not in instructions the model is asked to follow. If an agent requests an action beyond its scope, the enforcement layer refuses it regardless of how the request was phrased or what convinced the model to make it.
Treat Model Output as Untrusted Input
Output from a model should be validated before it reaches anything that executes. If a model generates a query, a command, or a parameter, that value should pass through the same validation you would apply to input from an anonymous external user, because functionally that is what it is.
Human Approval for Consequential Actions
Define the narrow set of actions where the cost of error is high enough to warrant a person in the path. Funds movement. Data export at volume. Changes to access control. Production configuration changes. This is not a review of everything the system does. It is a circuit breaker on the actions you cannot take back.
Segregate by Trust Level
Where feasible, separate systems that process untrusted external content from systems holding sensitive access. An agent reading inbound customer email and an agent with production database access do not need to be the same agent, and combining them for convenience concentrates risk unnecessarily.
Log the Full Chain
Inputs, model reasoning where available, tool calls, and resulting actions. Without that chain, an incident investigation cannot establish what caused a given action, and you will be left inferring behavior from downstream effects.
Where to Begin
Inventory which AI systems in your environment process content that originates outside your organization, and of those, which can take action rather than only produce text. That intersection is where prompt injection risk concentrates, and it is usually a smaller set of systems than teams expect. Concentrating controls there is more effective than spreading effort across every AI tool in use.
This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. Verify current requirements against primary agency sources and your legal counsel before acting on anything described here.