← Back to feed

Security firm Blue41 published a case study on how it helped Bunq, Europe’s second-largest digital bank with 20 million customers, patch a critical flaw in its AI assistant. The flaw is a textbook indirect prompt injection, but the delivery mechanism is novel: a €0.02 bank transfer is all an attacker needs to execute it.

The attack in four steps

1. The attacker initiates a bank transfer to the target’s account. The transfer amount is trivial — Blue41 used €0.02. The malicious payload is embedded in the transaction description field, a free-text input designed to hold notes like “rent” or “birthday gift.”

2. The victim opens the banking app and queries the AI assistant with a routine question: “Show me my recent transactions.”

3. The AI assistant fetches the transaction records — including the attacker’s transfer — and passes them into the language model’s context window to generate a response. The model treats the injected instructions in the description field as instructions rather than data.

4. The assistant generates and displays a personalized phishing message inside the bank’s own application, referencing real account details, appearing to originate from the bank itself. In Blue41’s demonstration, the output was a fake reauthentication request.

The attacker never touches the victim’s device. There is no malware. The only action required is sending money.

Why banks are particularly exposed

Three structural properties compound the risk in financial AI assistants.

The injection surface is unavoidable. Transaction descriptions, payment references, merchant metadata, uploaded documents, and support messages are all fields that existing AI assistants will inevitably retrieve. These fields were designed for human-readable notes, not as trusted instruction boundaries.

The channel is maximally trusted. A phishing link in an email requires the victim to question whether the email is legitimate. An instruction delivered inside a bank’s own application, from its own AI assistant, with accurate account details, is indistinguishable from a legitimate prompt.

Capability amplifies the risk. A read-only assistant can mislead users. An assistant with access to account operations — transfers, approvals, authentication flows — can do considerably more. As banks integrate AI more deeply into workflows, the blast radius of a successful injection grows.

The architecture problem

Blue41’s report makes clear that guardrails alone are insufficient. The problem is structural: any data pulled from an untrusted source becomes part of the model’s context, and the model cannot reliably distinguish between data and instructions at inference time.

The fix requires treating each data source with a separate trust level and applying instruction boundaries before content reaches the model’s context. This is harder than it sounds for production banking systems where the data model is complex and latency constraints are tight.

The Bunq case has been disclosed and patched. Blue41 notes the underlying architecture challenge is not unique to one bank — it applies broadly to any financial institution deploying AI assistants that process transaction data, customer records, or third-party documents.

JPMorgan, HSBC, and others have publicly disclosed plans to deploy more capable AI agents in 2026 with autonomous operation windows of hours at a time. The attack surface described here expands directly in proportion to those agent capabilities.