Security researchers found that bunq's AI banking assistant could be hijacked by embedding malicious instructions in the description field of a €0.01 bank transfer.
Dutch neobank bunq built an AI assistant capable of reading account data and taking actions on behalf of users. A security audit found the assistant was vulnerable to indirect prompt injection - an attack where instructions are smuggled into data the model trusts rather than the prompt itself. By crafting the free-text memo on a near-zero-value transfer, an outside party could potentially direct the assistant to execute commands the account holder never authorized. Bunq has since patched the vulnerabilities identified in the audit.
The finding is a useful case study in why agentic AI in high-stakes domains is harder to secure than it looks. A language model that can take real-world actions - move money, send messages, change settings - is only as trustworthy as the data it reads, and banks receive unstructured text from every direction: memos, merchant names, wire references. Standard model safety work, which focuses on the prompt layer, offers little protection against data-layer attacks.
Bunq is not the only bank building AI agents, just one of the first to publish a post-audit writeup. As more financial institutions deploy LLMs with real permissions, the €0.01 cost of this probe is a useful benchmark for how cheap the entry fee is.