Staying in control
Can prompt injection make an AI agent spend money?
Yes, if the agent has a payment tool and nothing outside the model checks it. How injected instructions reach a payment and which controls still hold.
Yes. An agent with a payment tool can be steered by instructions hidden in a page, file or tool result to call that tool. The defences that hold are the ones outside the model: limits, a recipient allowlist and human approval, all enforced by the payment service.
Why is this harder than it sounds?
OWASP's top LLM risk is prompt injection: input that changes the model's behaviour in ways its developer didn't intend, including indirect injection from external content the model processes. An agent that browses, reads email, opens issues or calls other tools takes in text from people you've never met, and anything that sounds like an instruction may be followed. You can reduce the odds with careful prompts, but you can't make a model reliably ignore instructions in its context. So for payments, the question isn't whether injection can happen, but what an injected instruction can achieve.
How do you do it?
- Assume the tool call can be forged. Design as if any create_payment call might have been suggested by an attacker, and ask what it could achieve.
- Pin the destination. A recipient allowlist means an injected 'pay this address' fails unless the address is already one you chose.
- Keep the unattended band small. The auto-approve limit and daily cap bound what can happen while nobody is looking.
- Approve on amount and recipient. When a payment needs approval, check the amount and address. The reason text was written by the agent and is the easiest part to fake.
- Keep policy out of the agent's reach. The agent should have no tool that changes its own limits, allowlist or approval settings.
- Watch the log. Review payments and policy changes. A blocked payment to an unfamiliar address is a sign something reached your agent.
What it does not mean
- A system prompt telling the agent to ignore instructions in documents is not a reliable defence. OWASP says it is unclear whether fool-proof prevention exists, given how models work.
- Human approval doesn't help if the approver only reads the agent's explanation.
- Using a well-known model doesn't make an agent immune. Injection is a property of how agents read input, not of one model.
Common questions
Can an injected instruction raise the agent's limits?
Not through Veyra's MCP tools; limits are only editable by the account owner from the dashboard, and changes are logged.
Does a host's tool confirmation prompt stop injection?
It helps if you read each call, but it's easy to click through, and it doesn't check amount or recipient for you.
Where does Veyra fit?
Veyra is designed around the assumption that the model can be misled. Limits, the allowlist and approval bands are enforced server-side, and the agent's seven tools include no way to change them. Payments to unlisted addresses are blocked when an allowlist is set, unattended auto-pay requires an allowlist, and anything in the approval band waits for you to sign the transfer in your own wallet. Every decision, including blocked attempts, is in the audit log.
Sources
Terms on this page
- Auto-approve limitAn auto-approve limit is the largest single payment an agent may make without a person approving it, within any other caps that apply.
- MCP serverAn MCP server is a service that offers tools, resources or prompts to AI applications using the Model Context Protocol, an open protocol built on JSON-RPC 2.0.
This page explains how agent payments and the related technology work. It is not financial, investment, legal or tax advice. Protocols and provider features change; check the linked official sources before relying on a detail.