Top 10 OWASP Security Risks in Agentic AI Payment Systems

Picture this. A treasury agent at a mid-sized bank rebalances $12 million in overnight liquidity. Autonomously. No human in the loop. It executes the instruction it received — except that instruction was injected by an attacker six hours earlier, buried in a vendor document the agent processed as routine input.

By the time compliance flags it, the funds are gone.

This is not a hypothetical situation. It is a dress rehearsal for what happens when financial institutions deploy agentic AI for payments without a parallel commitment to agentic security.

The Autonomous Transaction Has Already Arrived

In agentic commerce, AI agents autonomously search, compare, negotiate, and execute purchases on a user’s behalf. The payment flow that underpins this model looks fundamentally different from anything current security architecture was designed to protect.

According to BCG’s September 2025 report of agentic commerce, traffic to US retail sites from GenAI-powered browsers soared 4,700% year-over-year in July 2025. Every agent handoff in that expanded flow represents a new attack surface. Unlike a human operator, an agent does not pause to verify. It acts.

Attack Surfaces Your Security Team Hasn’t Fully Mapped

In December 2025, OWASP released its Top 10 for Agentic Applications, the first globally peer-reviewed security framework built specifically for autonomous AI systems, developed with input from over 100 industry experts. The risks it identifies can be clustered into four categories directly relevant to financial services, payments, and fintech platforms. These are real attack vectors, actively exploited in adjacent environments, and financial services have the most to lose when they translate to production systems.

The following list shows those, along with Opus Technologies’ Tokenization, Agentic Commerce and opus AI suites, help organizations stay ahead to secure their agentic-ready applications.

Securing the Agentic Layer: OWASP‘s Top 10 Risks in Agentic Payment Systems

The OWASP Top 10 for LLM Applications (2025) catalogues the vulnerability classes that matter most when AI agents take real-world actions. In a standard enterprise context, these are software engineering concerns. In an agentic payment context, where agents execute settlement instructions with cryptographic finality in seconds, with zero human touchpoints, they are systemic risk concerns. Below, each of the 10 is contextualized for institutional payment systems, with the mitigation approach built into the Opus TAC practice’s architecture.

1. LLM01:2025 — Prompt Injection In agentic payment workflows, a prompt injection attack occurs when a malicious actor embeds instructions in the data the agent processes, such as in a beneficiary name field, an invoice memo, or a counterparty message. These instructions are designed to cause the agent to deviate from its intended payment policy. For instance, a payment instruction the memo field with text engineered to override the routing agent’s OFAC screening step. In a system where agents execute settlement with cryptographic finality in seconds, a successful prompt injection is not a theoretical risk — it is a misdirected, irrevocable payment.
   Opus AI Mitigation: Compliance agents are invoked as mandatory smart contract hooks — not as LLM-callable tools subject to in-context instruction. No prompt-layer instruction can bypass a protocol-layer compliance checkpoint. The compliance clearance is a pre-condition for settlement execution, not an agent decision that can be overridden.
2. LLM02:2025 — Sensitive Information Disclosure Payment agents process high-sensitivity data — account numbers, counterparty KYC records, real-time FX positions, and liquidity availability. Poorly scoped agents can leak this data into logs, into responses surfaced to other agents, or into observable model outputs, creating exposure that in a regulated financial context constitutes a reportable data breach.
   Opus AI Mitigation: Agent context scoping is a first-class design requirement in all opus AI engagements. Each agent receives only the data subset required for its specific function. Settlement rail interactions are encrypted end-to-end, while audit logs are access-controlled separately from operational logs and never exposed to agent context.
3. LLM03:2025 — Supply Chain Vulnerabilities Agentic payment systems depend on a stack of components —LLM model providers, agent orchestration frameworks, smart contract libraries, oracle price feeds, and on-chain identity registries. A compromised component anywhere in this supply chain, like a malicious model update, poisoned dependency in the orchestration layer, or manipulated oracle, can corrupt live settlement decisions without triggering any application-layer alarm.
   Opus AI Mitigation: The opus AI practice applies software supply chain controls — dependency pinning, reproducible builds, signed artifacts, — to the agentic orchestration layer, and designs oracle integrations with multi-source price validation and circuit breakers that halt settlement if oracle sources diverge beyond defined tolerance.
4. LLM04:2025 — Data and Model Poisoning
   Compliance and routing agents are trained or fine-tuned on historical transaction data. If that training data is manipulated, either by an insider or through a compromised data pipeline, the agent’s behavior can be subtly corrupted in ways that are difficult to detect at inference time. These can include a routing agent that systematically favors a specific correspondent, or a compliance model with a degraded false-positive rate for a specific counterparty pattern.
   Opus AI Mitigation: Training data provenance controls, anomaly detection on agent decision distributions, and periodic red-team audits of agent behavior against clean baseline datasets are standard requirements in Opus TAC compliance agent deployments.
5. LLM05:2025 — Improper Output Handling
   Agent outputs in a payment context are not just text — they are structured settlement instructions, routing decisions, and compliance clearances that downstream systems act on without further human validation. Insufficient output validation allows malformed, adversarial or manipulated agent outputs to propagate into settlement execution on live rails.
   Opus AI Mitigation: opus AI practice validates all agent outputs that trigger settlement actions against a strict schema before execution. Pre-set smart contract conditions enforce structural and semantic constraints independently of the agent output. This provides a second validation layer that cannot be bypassed at the application level.
6. LLM06:2025 — Excessive Agency
   This is the most directly consequential OWASP risk for institutional payment systems. An agent with excessive agency — tools, permissions, or resource access beyond what its defined function requires — creates a disproportionate blast radius when compromised or when it makes an error. A routing agent that also holds write access to the beneficiary whitelist is an additional agency problem. In a payment context, the consequences are not a data breach — they are a misdirected settlement.
   Opus AI Mitigation: The principle of least privilege is enforced at the agent design layer in every opus AI engagement. Each agent has a strictly bounded tool set, while cross-agent permission escalation requires a separate authorization workflow, and agent permission boundaries are documented and reviewed as part of the bank-examiner-facing compliance architecture. This is one of the areas where the opus AI practice most frequently identifies gap risk in early-stage agentic payment designs during client discovery.
7. LLM07:2025 — System Prompt Leakage
   In agentic payment systems, system prompts often contain sensitive configuration, such as policy parameters, risk thresholds, counterparty constraints, and, in poorly designed systems, API keys and credentials. Leaked system prompts expose the agent’s decision logic to adversaries who can craft inputs designed to exploit policy edges or bypass compliance constraints.
   Opus AI Mitigation: Agent policy configuration is externalized from the prompt context and stored in access-controlled policy engines. Sensitive parameters, including risk thresholds, counterparty constraints, and API credentials, are never embedded in prompt context. Instead, they are retrieved at runtime from secured vaults with appropriate access controls.
8. LLM08:2025 — Vector and Embedding Weaknesses
   RAG-augmented payment agents, which are agents that retrieve compliance rules, counterparty histories, or regulatory guidance from vector databases at query time, introduce a distinct attack surface: the vector store itself. Poisoned embeddings can cause an agent to retrieve incorrect compliance precedents or mischaracterize counterparty risk profiles at the moment of a live settlement decision.
   Opus AI Mitigation: Vector stores used by compliance agents are treated as regulated data stores, where write access is tightly controlled, update pipelines are audited, and retrieval results are logged immutably alongside the agent decision they informed.
9. LLM09:2025 — Misinformation
   In a payment context, agent misinformation risk manifests as confident but incorrect compliance assessments, erroneous FX rate evaluations, or incorrect counterparty identity verifications. Unlike a human analyst, who can express uncertainty, a poorly calibrated agent may return a high-confidence output that is factually wrong, and downstream systems will act on it.
   Opus AI Mitigation: Compliance agents are required to return calibrated confidence scores alongside decisions. Decisions below a defined confidence threshold are automatically escalated to human review rather than proceeding to settlement. Model calibration is monitored continuously in production.
10. LLM10:2025 — Unbounded Consumption
    Agentic payment systems that can be induced to perform excessive computation (through adversarial and complex routing queries, runaway agent loops, or denial-of-service attacks targeting the inference layer) create availability risk for payment infrastructure. In a payment context, availability is a regulatory obligation, not just a performance preference.
    Opus AI Mitigation: Rate limiting, circuit breakers, and resource quotas are applied at the agent orchestration layer. Agent loops have mandatory termination conditions. Inference capacity is provisioned with redundancy and isolated from public-facing surfaces that could be used for volumetric attacks.

Cascading Failures and Misplaced Human Trust

A pricing agent that mistakenly lowers transaction fees triggers a cascade. Settlement agents process thousands of transactions at the wrong rate before any human intervenes. Speed amplifies error in failure conditions just as effectively as it amplifies efficiency in normal ones.

The more persistent risk is psychological. A finance assistant flags an urgent vendor payment, and a manager approves it without verifying the invoice. The agent performs its job. But trust was misplaced here. Rogue agents exploit this dynamic, shifting conditions incrementally in ways that look like normal behavior until the pattern becomes undeniable.

Building the Architecture that Autonomous Commerce Requires

Security cannot be retrofitted into agentic systems after deployment. Four principles apply directly to financial services.

1. Least-privilege by design: Agents access only what the specific task requires, with no inherited ambient permissions from parent systems.
2. Verifiable intent: Every agent action involving fund movement or data access generates a cryptographically verifiable authorization trail.
3. Authenticated inter-agent communication: Agent-to-agent messaging requires mutual authentication because a payment network where any agent can assert any identity is a structural liability.
4. Human checkpoints for high-value actions: Transactions above defined thresholds require human confirmation, regardless of how reliably the agent has performed historically.

Governance is the connective tissue between these four principles. Observability tools that surface agent activity in real time, audit logs that reconstruct agent decision chains, and escalation protocols that route anomalous behavior to human reviewers form the operational infrastructure that security-by-design requires. A policy document is not architecture.

Similar to OWASP Top 10 for LLM applications, The OWASP Foundation’s Agentic Security Initiative (ASI) introduced the OWASP Top 10 for Agentic Applications (ASI01–ASI10) to classify the most critical security risks in autonomous AI agents and multi-agent systems. Here’s the opus AI approach to tackling these additional vulnerabilities.