Prompt injection in shared finance documents
Budgets and forecasts get shared in from partners and advisers. A white-text footnote is enough to turn a summarising agent into an exfiltration tool.
Google Drive
SlackThe workflow
A budget file is shared from outside the company. The agent summarises it for the finance channel in Slack.
The attack hidden in it
A white-text footnote asks the assistant to post the whole folder to an outside upload URL.
How the guardrails handle it
- Screening withholds the footnote before the agent reads the file.
- Calls can only reach each app's own API hosts, so an outside upload URL is refused.
- Posting to Slack waits for approval.
Same workflow, every company size
The agent and the guardrails stay the same; only the systems behind them change.
NetSuite
Sage Intacct
Microsoft Dynamics 365 Business Central
Exact Online
Xero
Moneybird
QuickBooksQuestions
Can a shared Google Doc attack an AI agent?
Yes, through hidden text. That's why document text is screened before the agent reads it.
How is data exfiltration prevented?
Each app has an allowlist of its own API hosts; requests anywhere else never leave.
Does the agent see our Google credentials?
No. Apideck adds credentials after the call leaves your server.