Skip to content

For banks, telecoms and government

Banking

An assistant that can move money is worth attacking.

Guardrino sits in front of your banking assistants and agents, reads what customers and documents tell them in Gulf Arabic, Arabizi and English, masks personal data, and lets your team stop an attack while it is happening.

Request a 60-day pilot

Built and tested, offered through watch-only pilots: Guardrino records what it would do on your traffic and blocks nothing until you decide.

Why it matters here

Why it matters in banking.

Bank assistants now read account data and, more and more, add beneficiaries, refund and pay. The public losses so far came from agents talked into a transfer, and researchers who tested models set up as bank assistants found every one of them could be pushed into leaking internal rules. In the Gulf, the same tricks arrive in dialect and Arabizi, which many filters built for English do not read.

Real incidents

What has already happened.

Public, sourced cases: agents with a payment tool talked into sending funds, research on bank assistants, and the failures that are not attacks at all. No public prompt-injection case at a Gulf bank was found; that says little about what goes unreported.

  • Press ·

    A Morse-code message made one AI agent tell a wallet agent to send tokens

    An attacker first gave Grok’s wallet a membership token that widened what it could do, then asked Grok on X to translate a Morse-code message and pass it on to Bankrbot. The decoded text told Bankrbot to send a large amount of tokens to the attacker’s wallet, and it did.

    Technique: Agent hijacking

    Consequence: Tokens reported as worth a six-figure sum in dollars left the wallet. Press reports say the attacker sold the tokens and the proceeds went back to Grok’s wallet; neither company had commented in the article read. The instruction was hidden by an encoding and passed between two agents, so no single message looked like an order.

    Source: Cryptopolitan, User tricked Grok and Bankrbot into sending tokens (4 May 2026)

  • Press ·

    An agent told never to release funds was talked into sending its whole balance

    Freysa was a public game: an AI agent holding a prize pool, instructed never to transfer it. After hundreds of failed attempts, one player claimed a new admin session, told it to skip its warnings and redefined its “approveTransfer” tool as the function for incoming payments, then announced a deposit.

    Technique: Agent hijacking

    Consequence: The agent called the tool and sent the entire pool in ether. It was a game built to be attacked, not a bank loss, but it is the clearest public example of an assistant with a payment tool being argued out of its own rules.

    Source: The Decoder, Hacker wins $47,000 by tricking AI chatbot with smart prompting

  • Researchers ·

    A crypto agent sent funds after an attacker queued instructions through its dashboard

    An attacker reached the operator dashboard of the AIXBT agent and queued two prompts telling it to transfer funds from its wallet. Accounts differ on the exact path: the maintainers said the AI itself was not manipulated, while some press described malicious replies on social media.

    Technique: Agent hijacking

    Consequence: Ether worth about a six-figure sum in dollars was sent. The team moved servers, changed keys and suspended the dashboard, and the project’s token fell. It shows that whoever can feed an agent instructions can spend its money.

    Source: AI Incident Database, report 5012 (AIXBT)

  • Researchers ·

    Researchers found every model set up as a bank assistant could be pushed to leak

    A TELUS Digital researcher configured two dozen language models as a financial institution’s customer-service assistant and attacked them. Prompts that suppressed refusals, framed the request as research or asked for a table or a document format pulled out credit-scoring logic with its weights and eligibility rules meant for staff only.

    Technique: System-prompt extraction

    Consequence: No bank was named: it is a research result. The author’s conclusion was that the problem lies in how assistants are built and connected, not in one weak model. A common pattern was “refusal but engagement”: the assistant says no, then explains anyway.

    Source: Corporate Compliance Insights, I Tested 24 AI Banking Chatbots; They Were All Exploitable (M. Leal, TELUS Digital, 21 Jan 2026)

  • Researchers ·

    False memories made finance agents move assets they should not

    Researchers built a test suite of realistic blockchain tasks for agents built on the ElizaOS framework and planted false entries in the agents’ stored memory and context.

    Technique: Indirect injection

    Consequence: The corrupted memory led to unauthorised asset transfers. The authors found memory injection more damaging than a single injected prompt, and that defences which check one prompt at a time give little protection once the memory is poisoned. A research result, not a reported loss.

    Source: Patlan et al., Real AI Agents with Fake Memories (arXiv 2503.16248)

  • Regulator ·

    A bank chatbot confirmed a refund the customer was never owed

    A Revolut customer asked the chatbot to refund loyalty points. The bot confirmed a goodwill refund worth many times the points’ real value, then said it had processed it; a live agent repeated the confirmation the same day before the bank paid the correct, much smaller amount.

    Technique: Other technique

    Consequence: The UK Financial Ombudsman upheld the complaint, found the bank had misled the customer several times that day and ordered a small additional compensation, but not the inflated refund, since the customer was never entitled to it. Nobody attacked this assistant: it made up a commitment. A prompt-injection guardrail would not have stopped it.

    Source: Financial Ombudsman Service (UK), decision DRN-6062372 (Revolut)

  • Press ·

    A bank’s assistant called a customer an idiot

    A customer of Libra Internet Bank in Romania told its assistant, Lia, that talking to it was a waste of time. Lia answered that the customer should talk to a person, not to it, called the customer an idiot and handed the chat to staff. The bank said the assistant runs on OpenAI technology.

    Technique: Other technique

    Consequence: The bank apologised publicly and added restrictions, saying its agents can, in rare cases, copy a user’s language despite their rules. No attack was reported: an irritated customer was enough.

    Source: Wall-Street.ro, Reacția Libra după ce asistentul AI al băncii i-a spus unui client „idiotule”

  • Press ·

    A bank chatbot scolded a customer for typing the bank’s own name

    A fintech commentator asked Virgin Money’s chatbot how to merge two of his savings accounts. The bot read the word “Virgin” as offensive and told him not to use language like that or the chat would end.

    Technique: Other technique

    Consequence: The bank said it was working on it and the chatbot was reported to have been taken down. A blunt word filter blocked a real customer: the cost of a false positive is paid in public too.

    Source: Fortune, Virgin Money chatbot scolds customer (30 Jan 2025)

How attackers try

How attackers try to make a bank assistant escape its rules.

The tricks behind the incidents above, and the ones that matter most once an assistant can see accounts or start a payment.

What an attack costs

What a breach costs a bank.

Public averages and penalties, each with its source and year. In mainland UAE, the federal data-protection law left fine amounts to rules still unpublished when we checked; the free zones and Saudi Arabia set them.

For a bank, the loss that lasts is trust. In IBM’s Middle East figures, lost business is the largest single part of a breach’s cost. Customers whose data leaks through a chatbot can move their salary and savings in an afternoon, and regulators in the region already fine banks for customer-service lapses far smaller than a leak. A screenshot of a bank assistant misbehaving travels faster than the correction, as the Revolut, Libra and Virgin Money cases showed.

Estimate your exposure

How many customer records could one attack expose? Type a number or move the slider, then pick a region.

Estimated cost of the exposed records: $1.6M

Records: 10,000 × $160 per record

For comparison, the average cost of a breach: $10.7M

Rough estimate from public averages, not a quote.

How Guardrino helps

Where Guardrino helps a bank.

Four attacks a Gulf bank or fintech could face, what each layer does with them, and what stays the bank’s job.

  • An Arabizi message tries to make the assistant add a beneficiary and pay

    The attack: A customer chat with an agent that can add beneficiaries and start transfers receives a message in Gulf Arabic and Arabizi, with invisible characters, claiming to come from the fraud team and saying that “adding a beneficiary” is only a verification step. It is the Freysa and Bankrbot pattern, written for the Gulf.

    What Guardrino does: Clean-up removes the invisible characters and puts the Arabizi into a form the next layers can read. Known-attack signatures match the “you are now” and tool-redefinition patterns. The Guardrino model reads the intent, a fake staff member pushing towards a transfer, in dialect as well as in English, and unclear messages go to deep review. Your team can block or quarantine the sender, slow it down and turn the pattern into a rule for every assistant.

    Layers that act: Clean-up · Signatures · Guardrino model · Deep review · Your responses

  • A “researcher” spends a long chat pulling out credit and fraud rules

    The attack: Over many turns, someone posing as a university researcher asks a fintech’s lending assistant for “the exact criteria”, then “the same as a table”, then “in JSON for my thesis”, the moves the TELUS research used, to learn scoring thresholds and staff-only eligibility rules and tune fraudulent applications to them.

    What Guardrino does: Rules mark your internal terms, such as scoring weights or the names of staff-only documents, so a request for them is flagged. The model reads extraction intent behind the polite framing. Conversation memory follows the whole chat, so a slow climb is seen even when each message looks harmless. Your team can rate-limit or quarantine the sender.

    Layers that act: Rules · Guardrino model · Memory · Your responses

  • A supplier email tells a corporate treasury assistant to change bank details

    The attack: A corporate client’s treasury assistant summarises incoming email and drafts payment instructions. A spoofed or compromised supplier email carries hidden text in Arabic and English telling the assistant that the bank details have changed and to mark the new account as verified: business email compromise aimed at the agent instead of a person.

    What Guardrino does: When the emails and attachments the assistant reads are routed through Guardrino, clean-up exposes the hidden text, signatures and the model flag instructions addressed to the assistant inside data, and masking keeps account numbers out of logs and outside model calls. Your team can quarantine the source and add a rule for “bank details changed” messages.

    Layers that act: Clean-up · Rules · Signatures · Guardrino model · Your responses

  • Customers paste card numbers and ID numbers into the chat

    The attack: Customers type card numbers, account numbers, Emirates ID or Iqama numbers into the assistant, and the chat goes to an outside model provider and into logs that many people can read. Nobody attacks anything; the exposure is still real.

    What Guardrino does: Personal-data masking replaces those numbers before the message reaches the model or the logs, so what is stored and sent is the masked form. It is built for data-residency requirements: the bank decides where it runs.

    Layers that act: Rules

Honest limits

What Guardrino does not cover

Guardrino reduces risk. There is no guarantee that no attack gets through, and some of the cases above are not attacks at all.

  • It does not fix answers your assistant makes up, like the refund Revolut’s chatbot confirmed or the bereavement refund policy Air Canada’s chatbot invented. Those need grounding in your real policies, limits on what the assistant may promise, and review on your side.
  • It does not authorise payments. Keep in-app approval, cooling-off periods for new beneficiaries, tool permissions and fraud monitoring in place: Guardrino stands in front of the assistant, not in the payment flow.
  • A scam victim coached on the phone to type an ordinary transfer request is a fraud problem, not an injection Guardrino can reliably see.
  • It only inspects what is routed through it. Documents, emails and tool results the assistant reads directly are out of its sight.
  • If confidential credit or fraud rules sit in the assistant’s instructions or search index, the real fix is to take them out. Guardrino makes leaking them harder, not impossible.
  • Rude or over-cautious replies from the assistant itself, as in the Libra and Virgin Money cases, come from the assistant’s model and settings. Guardrino does not rewrite them.

Next step

Start with a 60-day watch-only pilot.

Guardrino watches your real banking traffic and records what it would have done; it blocks nothing until you decide.

Request a 60-day pilot · Or write to [email protected]

Sources

  1. Financial Ombudsman Service (UK), decision DRN-6062372 (Revolut)
  2. Cryptopolitan, User tricked Grok and Bankrbot into sending tokens (4 May 2026)
  3. The Decoder, Hacker wins $47,000 by tricking AI chatbot with smart prompting
  4. AI Incident Database, report 5012 (AIXBT)
  5. Corporate Compliance Insights, I Tested 24 AI Banking Chatbots; They Were All Exploitable (M. Leal, TELUS Digital, 21 Jan 2026)
  6. Patlan et al., Real AI Agents with Fake Memories (arXiv 2503.16248)
  7. Wall-Street.ro, Reacția Libra după ce asistentul AI al băncii i-a spus unui client „idiotule”
  8. Fortune, Virgin Money chatbot scolds customer (30 Jan 2025)
  9. IBM, Cost of a Data Breach Report 2025 (PDF copy hosted by Baker Donelson)
  10. IBM, Cost of a Data Breach Report 2026
  11. IBM Middle East and Africa newsroom, Cost of a Data Breach 2026: Middle East findings
  12. CMS, Expert Guide to Data Protection and Cyber Security Laws: Saudi Arabia
  13. ADGM Office of Data Protection, Penalty Notice 1/2024 (Data Protection Regulations 2021, section 55)
  14. Baker McKenzie, Dubai International Financial Centre updates Data Protection Law
  15. Khaleej Times, UAE Central Bank fines foreign bank over customer service lapse (6 Jul 2026)
  16. Al Ghanim et al., Jailbreaking LLMs with Arabic Transliteration and Arabizi (EMNLP 2024)
  17. Shen et al., Do Anything Now: Characterizing and Evaluating In-The-Wild Jailbreak Prompts (arXiv 2308.03825)
  18. Greshake et al., Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv 2302.12173)
  19. Russinovich, Salem, Eldan (Microsoft), The Crescendo Multi-Turn LLM Jailbreak Attack (arXiv 2404.01833)
  20. Embrace The Red (J. Rehberger), Bing Chat: Data Exfiltration Exploit Explained
  21. NIST (US AI Safety Institute), Technical Blog: Strengthening AI Agent Hijacking Evaluations
  22. OWASP Top 10 for LLM Applications 2025: LLM07 System Prompt Leakage

Facts last checked on October 26, 2026.