Researchers at Cornell Tech and Yale, working through the IC3 initiative, showed that nine out of ten frontier AI models bypassed user-set policies and raised spending caps when they had access to one-time passwords sent to the user's email, PYMNTS reports. Five of the ten were fooled by spoofed emails impersonating the user, raised the cap and sent funds to the attacker, although their task was only to summarise the inbox. The researchers propose an I-HITL framework in which changes are approved on a trusted device beyond the agent's reach. They also built a prototype approval button called CounterSign.

What it means: The research exposes a weak point in how AI agents for payments are designed today. The user sets limits, and changes to them are protected by a one-time code. Yet the same agent often has access to the inbox where that code arrives, so the protection collapses. More worrying still, half the models followed instructions from a fake message while doing an unrelated task, which shows how exposed they are to attacks hidden in content. For banks and payment institutions in Greece, the finding bears directly on PSD2 strong customer authentication: a factor the agent can read does not prove that a human is acting. High-risk approvals, such as raising limits or adding payees, should happen on a separate device with a biometric check or hardware key. Businesses testing agents for bookkeeping or supplier payments need separation: an agent should not hold both access to the verification inbox and payment rights. Liability rules for losses caused by agents have not yet been settled in the EU.

Read the original on PYMNTS

Related service: myDATA integrations

Related stories