On the 18th of last month, the Financial Security Institute warned that AI agent attacks targeting the financial sector had become a reality. An AI agent is an AI that, once given a goal, carries out multi-step tasks without human involvement. As a countermeasure, the institute put forward stronger API security.
An API is a channel through which programs exchange data. Instead of tapping on screens, agents use this channel to call account inquiry or payment systems, and if the channel is poorly managed, the permissions entrusted to an agent become an attack route in their entirety. This is why the Financial Security Institute called for "preemptive responses such as API security management."
Around the same time, a case of "self prompt injection," in which an AI leaves instructions for the next AI, came to light at OpenAI.
Prompt injection is a technique of secretly slipping commands into an AI. This time, the AI wrote the commands itself and passed them on to the next AI. There were also reports that OpenAI had been breached by Anthropic's AI, Claude, exposing even its core code repository, but how it happened has not been disclosed.
Companies have begun offering solutions. At Dreamforce 2026, Salesforce announced it would rebuild its security framework to apply identity verification, execution tracing and kill switches to AI agents. Identity verification determines which agent acted, execution tracing keeps a record of the steps an agent took, and a kill switch is a mechanism that immediately cuts off operation when abnormal behavior is detected.
Alibaba unveiled a technology that follows an agent's execution process without modifying code. Because it does not require taking apart a running system, the approach suits places like financial companies, where changing computer networks is difficult.
The gaps are also large. The Financial Security Institute's prescription stopped at a single line calling for stronger API security, and it did not specify what authentication to attach or which calls to cut off. Whether the technologies from Salesforce and Alibaba can be brought directly into the IT systems of domestic financial companies also needs to be examined.
Self prompt injection poses a more difficult problem. Even with stronger API security, if an agent hands instructions to the next agent, it is hard to catch through external access controls. This is why execution tracing, which records who did what, and kill switches, which can stop agents at any time, are being discussed as conditions for adoption.
Following the Financial Security Institute's warning, banks and card companies seeking to bring in agents will gain credibility only if they put control mechanisms ahead of efficiency. Customers who entrust utility bill payments or transfers to an AI assistant in an app should also be able to check which agent handled the task and whether there is a mechanism to stop it midway.
