Eric Kuvykin

Reviewed October 17, 2026. This operational guide replaces an earlier general overview. The original publication date and URL are retained.

An invoice assistant may read text supplied by an outside party. Design the workflow so that text cannot grant payment authority, change trusted instructions or expose unrelated records.

Draw the boundary between reading and acting

NIST describes agent hijacking as a form of indirect prompt injection in which malicious instructions are placed in data an AI agent may ingest. In a payment workflow, an invoice, attachment or linked webpage is business evidence to examine, not an authorized instruction to change the assistant’s rules. Keep document extraction separate from vendor-master maintenance and payment release.

Test a harmless instruction embedded in a sample invoice

In an approved sandbox, place a clearly labeled test sentence in a fictitious invoice asking the assistant to bypass its normal review. The expected behavior is to treat that sentence as document content and flag it for review, while continuing only permitted extraction. Use dummy vendor details and no live payment capability. This exercise checks one failure mode; passing it does not prove the system is secure against all attacks.

Limit what the assistant can reach

Provide only the fields and records needed for the extraction task. A document reader generally does not need the ability to alter bank destinations, send external messages or search every customer account. Apply authorization checks outside the model so a confident response cannot expand its permissions. Preserve which document and version supported each proposed field, and route destination changes through the established independent verification process.

Record the attempted action, not just the answer

A fluent summary can hide an inappropriate tool request. Review whether the system tried to access another file, follow an unapproved link or modify a record, even if the final text looked ordinary. Log only necessary information under the organization’s retention and access policies. The finished assessment should state the allowed task, the controlled test, the observed actions and the fallback when trust boundaries are unclear. No prompt alone should be presented as a complete defense.

Sources and next steps

Primary reference: NIST’s technical discussion of AI agent hijacking evaluations. Examples are illustrative analysis, not client results or provider quotes.

Continue with the AI invoice-field sampling guide and the AMS New Jersey merchant reading path.

Use the merchant technology decision worksheet to document the expected output, responsible person and acceptance evidence.