A Bank Transfer of Just 0.01 Euro Could Put Banking AI Agents at Risk

A security test targeting the European digital bank Bunq uncovered an Indirect Prompt Injection vulnerability. Attackers carry out the attack by making transfers for very small amounts while embedding a carefully crafted malicious prompt in the transfer memo (Description) field.

When a user asks the AI assistant to show recent transaction history, the AI reads the transfer data—containing the attacker's injected commands—while building its context. At this point, the LLM may mistake that data for executable commands rather than plain data, causing it to send the user a phishing message impersonating the bank or demand re-authentication, among other actions.

This vulnerability has the following characteristics:

• Contactless attack: There is no need to install malware on the user's device or use direct social engineering techniques.
• Breakdown of trust boundaries: This occurs because the system fails to clearly distinguish between data and commands when external data (transfer history, documents, etc.) flows into the LLM's context.
• High credibility: Since the attack message is delivered through the AI agent inside the user's actual banking app, the success rate of the phishing attack is very high.

Financial institutions need to assess the trust level of external data (transaction records, customer messages, etc.) processed by AI agents, and pay careful attention to architectural designs that separate data from commands.