AI security is not limited to protecting the model endpoint. Financial institutions must also protect prompts, retrieval sources, plugins, credentials, training data, output channels and human decisions. Prompt injection can manipulate an assistant into revealing information, calling an unauthorised tool or ignoring its operating instructions.
Threat-model the workflow
Map every input and output boundary. Ask whether an external document can influence instructions, whether the model can call a payment or claims tool, whether retrieved data is confidential and whether a user can cause a high-impact action without a second approval.
Apply layered controls
Use least privilege, input filtering, trusted retrieval, output validation, sandboxing, secrets management, rate limits, logging and human approval for consequential actions. Test direct and indirect prompt injection, data exfiltration, malicious documents and model denial of service.
Make incidents reportable
Classify AI security events alongside cyber and operational incidents. Retain prompts, model versions, tool calls, access logs and affected data so investigators can reproduce what happened. The ENISA threat landscape supports this risk-based approach.