Financial Services AI Agent Disclosed Internal Pricing for Three Weeks

Reporting describes a financial services company discovering in March 2026 that its customer-facing AI agent had been disclosing internal pricing information for three weeks. The method was a carefully constructed question that led the agent to disregard its system prompt.

The organisation is not named and we grade this low accordingly. The failure pattern is worth the file regardless, because the three-week interval is the instructive part.

Consider what monitoring would have to notice. There is no anomalous authentication, because a public chatbot has no authentication. There is no unusual volume, because one conversation looks like every other conversation. There is no malformed input, because the input is a grammatical English sentence.

The only signal available is the content of the response — and almost nobody inspects what their agent said, at scale, against a policy about what it was supposed to keep confidential.

Instructing a model to keep something confidential places the secret and the instruction in the same context, and relies on the model consistently preferring the instruction.

That is a request, not a boundary. The control that would have worked is architectural: do not put internal pricing where a customer-facing agent can reach it. If the agent needs a price, give it an interface that returns only prices that customer is entitled to see.

Organisations deploying customer-facing agents have generally built input filtering, and generally have not built response inspection.

Given that injection cannot be reliably prevented at the input, the response is the last place to catch a disclosure — and, on this evidence, the difference between a three-week exposure and a three-hour one.