Warning: This story will go fairly deep into the details of agentic artificial intelligence (AI) and agentic security. And another warning: You need to go there. Here’s why. An employee doesn’t have to approve a fraudulent payment for an AI agent with access to financial accounts to follow an attacker’s instructions.
No. The culprit could be an innocent-looking document. In that case, “someone hides an instruction in an email, a shared document or a support ticket,” J.D. Salbego, founder and CEO of ClawSecure, told PYMNTS.
It’s called indirect prompt injection, and it’s a threat that can escape the notice of both the person using an agent and the agent itself. For financial institutions, the potential damage depends on what the system can reach: payment accounts, passwords, customer information or infrastructure supporting other operations.
ClawSecure tested 14 models across five labs. Salbego told PYMNTS the research found a recurring pattern across models and integrations involving Dropbox, Notion and Linear. Testing several providers, he said, was intended to establish whether the exposure extended beyond an individual model.
Connected applications give the attack additional routes. Salbego described an agent working through Dropbox that could also connect to Gmail. Security teams need to examine the exchanges between those services, including instructions and requests that might appear ordinary when considered separately.
“You have to watch and understand the messaging between a model and a tool,” he added.
He argued that model defenses need support from continuous monitoring that examines behavior during operation. Security providers would have to revise those protections as new attacks emerge, much as they update defenses against conventional intrusions.
Salbego also wants government attention directed toward what purchasers are told before deployment. He said he’s discussed agent security with congressional offices from both parties and spoken with the Federal Trade Commission (FTC) about the subject.
His own recommendations concern the allocation of responsibility. Providers, he argued, should explain publicly where their protections end and what customers must supply. Salbego said obtaining answers during ClawSecure’s disclosure process required repeated follow-ups, leaving ordinary buyers with information they might never think to request.
Small Firms Face Exposure Without Security Staff
Salbego singled out small businesses and consumers who can install agents and connect accounts without employing anyone responsible for security. Simple setup services allow people with little technical experience to grant access to financial and business applications.
“These are the people who have no security team,” he elaborated.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
For a small business owner, the exposure could involve the account used to operate the company. For a consumer, it could involve passwords or private financial information. Larger institutions have security personnel, but an agent’s access can extend the consequences beyond what the employee initially affected.
Consider, in Salbego’s telling of it, a hypothetical developer at a Fortune 500 company. If an attack obtained credentials available through the developer’s computer or connected server, corporate cloud systems and customer databases could be exposed. He described potential data extraction, service disruption and ransom demands.
ClawSecure’s business addresses the same vulnerabilities its research identifies. Salbego said he leads the company’s team that searches for exploits, reports them to affected providers and seeks fixes. The company also supplies security services. He described the research as serving both commercial purposes and his interest in informing consumers and policymakers.
Asked what bank technology executives should do immediately, his recommendation was unusually sweeping: suspend agents while arranging security assistance and continuous protection.
“First, shut down every single AI agent in their system right now,” he advised.
His proposed independent framework would give buyers another source of evidence before deployment. Salbego described a market comprising providers’ own evaluations, paid auditors and researchers publishing individual findings. He wants a dedicated program producing publicly available, comparable safety ratings.
He favors a government institution such as the National Institute of Standards and Technology, citing its evaluation work in facial recognition and cryptography. Models could participate voluntarily, with buyers weighing both their ratings and any decision to abstain.
Salbego said ClawSecure developed a framework it’s trying to give to Washington. He acknowledged that its commercial interests would prevent the company from serving as an independent administrator.
“We’re not going to own it because I sell into the market,” he said. His preferred route would establish an institutional testing program without waiting for a bill, although he said getting the framework into operation will take time.
Watch the full interview with J.D. Salbego to learn more about:
- How an agent can encounter malicious instructions during everyday work.
- What banks and businesses should examine across connected applications.
- How public testing could influence the models organizations choose.
Add as Preferred Source
