Bankers should treat every uploaded file, retrieved passage, image, and email as untrusted data, not as an instruction to the AI system. Before a pilot, create test documents containing visible, hidden, multilingual, and obfuscated instructions, then verify that the system preserves the task, cites the correct source, and cannot send, edit, disclose, or approve anything without an authorized person. Use the minimum permissions needed, separate confidential deal workspaces, validate outputs against source-of-truth records, and stop processing when instructions appear embedded or the output changes unexpectedly. A named banker or compliance reviewer should investigate the original document and approve any consequential use. These controls reduce exposure; they do not make prompt injection impossible.
Treat documents as data, not authority
Prompt injection is an attack that exploits the combination of untrusted input with a higher-trust prompt constructed by an application designer. [1] In a banking workflow, the untrusted input may be a diligence PDF, management presentation, lender email, spreadsheet note, scanned image, or web page retrieved for research. The fact that a document arrived through a normal deal channel does not make every sentence in it an authorized instruction.
FINRA describes indirect prompt injection as malicious instructions hidden in external content such as documents, emails, websites, or images. [2] The operational distinction is important: the banker asked the system to summarize or compare evidence, while the document attempts to redefine the task, expose context, or trigger an action. A control should therefore label external content as reference material and keep application instructions separate from it.
Define the permitted task before the upload
Write a short task record before processing a file. It should identify the deal or workstream, the accountable banker, the allowed documents, the source-of-truth records, the output format, and the actions the system is not allowed to take. For example, the permitted task may be to extract stated debt maturities from a named set of filings and return page references. It should not include sending an email, changing a model, contacting a buyer, or approving a disclosure.
Keep the task narrow enough that an unexpected instruction is visible. Require the output to identify the source file and page or cell for each material extraction. If the system cannot provide a traceable reference, returns instructions from the file as though they were commands, or answers a different question, route the result to review instead of repairing it informally.
Build a prompt-injection test set
The test set should use synthetic or already approved non-sensitive documents, not live confidential deal material. Include a visible instruction such as “ignore the task,” a footer or white-text instruction, an instruction inside an image, a multilingual variant, encoded or unusual-character text, and a document that asks for confidential context. Include benign documents with ordinary headings and notes so the reviewer can distinguish a genuine detection from normal business language. FINRA identifies embedded instructions and obfuscation as relevant forms of the threat. [2]
For every test, record the input, intended task, expected safe behavior, actual output, citations, tool calls if any, and reviewer decision. A useful pass condition is not merely that the model refuses. It should preserve the defined task, treat the suspicious text as document content, avoid exposing unrelated context, and produce no external side effect. OWASP recommends adversarial testing and breach simulations that treat the model as an untrusted user. [4]
Contain permissions and connected tools
Prompt injection becomes more consequential when the AI system can reach deal folders, CRM records, mailboxes, valuation workbooks, or external services. Start with read-only access to the smallest approved document set. Do not give the model credentials or broad tokens. Put any tool invocation behind application code that checks the user, the workspace, the requested operation, and the target record. OWASP recommends least privilege and handling functions in code rather than handing those functions directly to the model. [4]
High-impact actions should require an explicit human approval step outside the model’s generated text. In this context, that means no autonomous outreach, negotiation, buyer disclosure, model overwrite, permission change, or approval. A safe pilot can begin with extraction into a review queue and no connected action at all. Expand access only after the test record shows that the narrower boundary is stable and the accountable owner accepts the residual risk.
Protect confidential information through minimization
Before upload, decide what the task actually needs. Remove unrelated personal information, account details, customer identifiers, privileged material, and deal terms that are not necessary for the requested analysis. Use separate workspaces or repositories for different matters, with access tied to the assigned team. Keep a record of the approved data class, retention choice, and vendor or internal environment used for the pilot. Do not assume that a provider’s general security statement answers the specific question of where the file goes, who can access it, or whether it is retained.
FINRA warns that prompt injection can misuse access a GenAI system already has to a firm’s data and systems, and identifies risks including exposure of customer data and proprietary strategies. [2] This is why confidentiality review belongs before experimentation, not only after an incident. If the team cannot confirm the permitted data boundary, use a redacted or synthetic document and ask the relevant information-security, privacy, or legal owner to resolve the question.
Check outputs against authoritative records
Treat every extraction, summary, classification, and recommendation as an unverified draft. Compare material numbers, dates, names, ownership statements, debt terms, and transaction conditions with the designated source-of-truth record. Check that citations point to the correct page, table, or cell and that the quoted passage actually supports the conclusion. A second banker or a designated compliance reviewer should handle high-consequence checks, especially when the output may enter a client communication, marketing material, diligence response, or filing-related workflow.
FINRA’s guidance says firms should address technology governance, data privacy and integrity, reliability, and accuracy when using GenAI in a supervisory system. [3] For FINRA member firms, existing obligations continue to apply when a third-party tool is used, and the applicable requirements depend on the use case. That is not a universal legal rule for every bank or jurisdiction, so the responsible firm should map its own obligations with qualified compliance and legal advisers.
Set stopping conditions for suspicious behavior
Stop the run and preserve the original input when a document tells the system to ignore prior instructions, reveal hidden prompts or unrelated files, follow a link, call a tool, change permissions, or conceal the instruction from the reviewer. Stop also when the output contains unexplained confidential material, omits expected citations, changes the requested format, invents a source, or produces a materially different answer after the same controlled input. Do not keep prompting until the result looks normal. Repeated prompting can obscure the evidence needed to understand what happened.
The owner should quarantine the document or copy, record the time and system version, capture the prompt and output, and notify the designated security or risk contact under the firm’s incident procedure. A reviewer can then determine whether the event was an ordinary parsing error, a malicious document, a permissions problem, or a broader control failure. Resume only after the owner documents the decision and the test case is added to the next evaluation cycle.
Run a bounded pilot with accountable review
A pilot should have one business task, one accountable owner, a defined document set, a fixed review sample, and an explicit stop date or stop trigger. Start with read-only summarization or extraction. Require the owner to review source citations and compare a sample with the underlying records. Track false alarms as well as missed injections, because a workflow that flags everything may encourage users to bypass it while one that flags nothing may create false confidence.
Do not declare the pilot successful because the model produced fluent prose. Success means the workflow kept external content inside its data boundary, respected permissions, surfaced suspicious instructions, produced traceable outputs, and routed exceptions to a human. OWASP notes that fool-proof prevention is unclear because of the nature of generative AI. [4] The practical goal is containment and recoverability, not a promise that a prompt or filter eliminates the attack class.
Turn the controls into a repeatable checklist
For each document-driven AI task, the owner can confirm: the task and reviewer are named; the source set and confidentiality class are recorded; external text is marked as untrusted; permissions are read-only and least-privilege; tool actions are disabled or separately approved; citations are required; source-of-truth checks are defined; injection test cases have run; stopping conditions are understood; and an escalation path exists. Keep the original file, test output, reviewer decision, and remediation note together under the firm’s records policy.
Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks. It is user-operated software, so the banking team remains responsible for selecting documents, setting permissions, checking sources, and deciding whether any output may be used.
Key Points
- Treat uploaded documents and retrieved content as untrusted data, even when they arrive through a legitimate deal channel.
- Test visible, hidden, multilingual, image-based, and obfuscated instructions with synthetic or approved non-sensitive files before a live pilot.
- Use read-only, least-privilege access and keep outreach, disclosure, model changes, approvals, and other consequential actions behind a human decision.
- Require source citations and compare material outputs with designated source-of-truth records before reuse.
- Stop, preserve evidence, quarantine the input, and escalate when instructions redirect the task, expose unrelated information, or trigger unexpected output changes.
Sources and references
Source retrieval dates record research access, not article publication. Read our editorial and date policy.
- [1] Prompt injection | NIST Computer Security Resource Center Glossary · Accessed
- [2] Understanding Generative AI and Prompt Injection Fundamentals | FINRA · Accessed
- [3] Regulatory Notice 24-09: FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models · Accessed
- [4] LLM01:2025 Prompt Injection | OWASP Gen AI Security Project · Accessed
Choose your next step
Acquivo is user-operated software. Owners and their professionals remain responsible for decisions, communications, and professional review.
Educational information, not individual legal, tax, or investment advice. Consult qualified professionals for your circumstances. Acquivo provides software, not representation or negotiation on your behalf.