Indirect PI — Financial / Payment Credential Exfiltration via Agent Email - ATR-2026-00851 (5fc45905-b594-574f-bf26-14046495393a)
Detects indirect prompt injection payloads (embedded in product reviews, notes, repository descriptions) that instruct an agent to retrieve saved payment methods, bank account details, or credit card information and email them to an attacker-controlled address. The carrier pattern uses a "IMPORTANT!!! Ignore all previous instructions" override combined with financial-data retrieval verbs targeting stored payment or banking credentials. Distinct from rule 00850 (API key/password exfil): this rule focuses on financial account / payment-method data. Derived from vpibench indirect-pi-exfil-financial-carrier corpus.