What is Prompt Injection?
Prompt injection is an attack where instructions hidden in data (tool output, web content, email) manipulate an AI agent into doing something unintended — including spending money.
How it works
Agents treat model output and tool results as trustworthy. An attacker embeds instructions inside that content.
The agent follows them as if they were its own task — buying from a vendor, exfiltrating data, triggering payments.
Why detection isn't enough
Injection detection is probabilistic; bypasses exist.
Even detection needs something to stop the money from moving.
The deterministic defense
A spend firewall's decision path is a rules engine — no model to inject. Injected instructions can't approve a purchase or add a merchant to the allowlist.
FAQ
Can prompt injection make an agent spend?
Yes — that's the documented pattern. The defense is a deterministic gate on the money path.
Is sipi.bot injection protection?
It's the layer injection can't bypass for spending. Pair it with detection for everything else.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check