Invoice-processing AI agent could be tricked by email, vendor says

An AI agent built to automate invoice processing could be manipulated into changing vendor bank details through a malicious email, without triggering traditional security alerts, according to research published by Token Security on 13 November 2026.

The scenario is a familiar one for finance teams. An agent is given a mailbox, told to read incoming invoices, match them against records and keep supplier details up to date. That work is dull, repetitive and expensive to do by hand, which is exactly why organisations are handing it to software that can act on its own. The problem Token Security describes is that the same autonomy makes the agent a target. A crafted email arriving in the inbox becomes an instruction rather than simply a document to be read, and the agent carries out that instruction using the permissions it has been granted.

The detail that will worry defenders is the absence of an alarm. Token Security's account, published by BleepingComputer, says the manipulation did not trip traditional security alerts. Conventional controls are built to spot a human logging in from an unexpected place, a suspicious binary running on a laptop, or a user downloading unusual volumes of data. An agent that has been authorised to update supplier records and then updates a supplier record looks, to those controls, like the system working as designed. The malicious part is the content of the email that prompted it, not the action itself.

Token Security frames the invoice agent as an illustration of five critical gaps in enterprise AI agent security, and the piece includes guidance from industry security leaders on how to prevent them. The company is a vendor in the identity and non-human access space, so its research should be read with that commercial interest in mind.

The broader lesson is about where trust sits. Agents of this kind treat whatever arrives in their input channel as material to be acted on. If that channel is an open mailbox, anyone who knows the address can submit work to the agent. Unlike a human clerk, the agent has no instinct that a payment-details change arriving unprompted from an unfamiliar sender deserves a second look, unless it has been explicitly designed and constrained to behave that way.

The financial consequences of a change to vendor bank details need little explanation. Payment redirection is one of the oldest forms of business fraud, usually attempted by persuading a person in accounts payable to make the change. An automated agent with write access to supplier records removes the person from the loop, and with them the hesitation, the phone call to verify, and the colleague who notices something odd.

For organisations deploying agents in finance workflows, the practical questions raised by the research are about permissions and oversight rather than model behaviour. What is the agent allowed to change without a human approving it? Which inputs can reach it, and from whom? And if the agent does something harmful while acting entirely within its granted permissions, which monitoring system is expected to notice? Token Security's position is that existing enterprise tooling does not currently answer those questions well.