A borrower's document can carry instructions for your AI: what prompt injection means for a credit fund.
Important takeaways.
- Prompt injection is the case where content a model reads is treated as an instruction rather than as data. OWASP records it as LLM01:2025, the first entry in its Top 10 for LLM Applications, and NIST catalogues the indirect form as NISTAML.015 in NIST AI 100-2e2025, published in March 2025. It is not a defect awaiting a patch: a model that can be instructed in natural language can be instructed by any natural language it is given, including text inside a document it was asked to summarise.
- For a credit fund the untrusted content is not the open web. It is borrower reporting packs, compliance certificates, valuations, data room exports and broker attachments: material written by counterparties, delivered as a condition of the facility, that the fund cannot decline to read.
- APRA's letter to industry on artificial intelligence, dated 30 April 2026, states that common attack pathways observed include prompt injection, data leakage, insecure integrations, exploit injection and the manipulation or misuse of autonomous AI agents. It also found identity and access management has not yet adjusted to non-human actors such as AI agents.
- ASIC's open letter of 8 May 2026, signed by Commissioner Simone Constant, does not name prompt injection. It requires the letter to be tabled at the ultimate board and risk governance committees, treats cyber resilience as a core licensing obligation rather than an IT matter, and points licensees to APRA's AI letter.
- Filtering is not the control. Anthropic's published pilot of Claude in Chrome on 25 August 2025 tested 123 cases across 29 attack scenarios and reduced a deliberate attack success rate from 23.6% to 11.2%, reaching 0% only on a narrow four-attack challenge set. The pilot also blocked the model from high-risk site categories, financial services among them.
- Real exposure needs three things at once: access to the fund's private material, exposure to content the fund did not write, and a way to act or send outward. Deciding per workflow which of the three an assistant holds is the control that works.
Every credit fund runs on documents that arrive from outside it: borrower reporting, compliance certificates, valuations, data room exports. Putting those in front of an AI assistant is the most obvious use of AI in a fund, and it is what almost every fund tries first.
It is also where the fund's AI stops reading only the fund's own material. Prompt injection is what happens when the model treats something inside one of those documents as an instruction rather than as content. This guide answers for Australia, where APRA and ASIC wrote to industry within eight days of each other in 2026. The mechanism is the same in any market.
What prompt injection actually is.
A language model does not have two channels. The fund's instruction ("summarise the covenant position in this pack") and the pack's contents arrive as one stream of text, and the model works out what to do with all of it. If the document contains a sentence addressed to the model, the model may act on it. OWASP records this as LLM01:2025, the first entry in its Top 10 for LLM Applications.
The direct version is a person steering a model away from its instructions, which is mainly a problem for that person. The indirect version is the one that matters here: the instruction is planted in content the model reads later, by someone who never touches the fund's systems. NIST catalogues it as NISTAML.015 in NIST AI 100-2e2025, the March 2025 edition of its adversarial machine learning taxonomy. It is not a defect awaiting a patch: a model that can be instructed in natural language can be instructed by any natural language it is given.
In a credit fund, the untrusted content is the borrower pack.
Most published examples involve an agent browsing the open web, which lets a fund file the risk under somebody else's name: nobody points an agent at the internet to run a covenant test. A credit fund's untrusted content is what its counterparties send it, on a schedule, as a condition of the facility.
- Borrower reporting packs, prepared by the borrower's own finance team.
- Compliance certificates, where the number and the working both come from the counterparty.
- Valuations, quantity surveyor and expert reports, commissioned by a party to the deal.
- Data room exports and information memoranda from a sponsor or an arranger.
- Email attachments from brokers, originators and servicers.
Each is written by someone with an interest in how the fund reads it, and a fund cannot decline to ingest them, because reading them is the job. That is a different exposure profile from an enterprise pointing AI at its own wiki. Delivery is not the hard part either: white text in a PDF, a note in an unused spreadsheet cell and a line in document metadata all reach the model without reaching the analyst. This is a mechanism rather than a report of incidents, and the point is that the documents a fund controls least are the ones it most wants to automate.
What APRA and ASIC said, eight days apart.
APRA's letter to industry on artificial intelligence, dated 30 April 2026, followed a deep dive across a sample of the largest banks, insurers and superannuation trustees. On cyber it is direct: common attack pathways observed include prompt injection, data leakage, insecure integrations, exploit injection and the manipulation or misuse of autonomous AI agents. It also found that identity and access management has not yet adjusted to non-human actors such as AI agents.
Eight days later, on 8 May 2026, ASIC Commissioner Simone Constant wrote to licensees and directors about frontier AI and cyber risk. That letter does not name prompt injection. What it sets is the frame: cyber resilience is a core part of a licensee's obligations rather than an IT matter, boards should evidence their assurance rather than accept it, systems should have less exposure to untrusted input, and the letter is to be tabled at the ultimate board and risk governance committees. It then points licensees to APRA's.
That referral is the part to notice. APRA's letter binds APRA-regulated entities, and most credit funds hold an AFSL and answer to ASIC, so the natural reading is that APRA's observations belong to someone else. They arrive anyway, by two routes: an APRA-regulated investor's material service provider assessment, and the fund's own regulator telling it to go and read them.
Filters do not solve it. Architecture narrows it.
Nobody has eliminated prompt injection, and the vendors closest to it publish figures that say so. When Anthropic piloted Claude in Chrome on 25 August 2025 it ran adversarial testing across 123 test cases representing 29 attack scenarios. Browser use without mitigations showed a 23.6% attack success rate when deliberately targeted; the mitigations it shipped brought that to 11.2%, reaching 0% only on a narrow challenge set of four browser-specific attack types. A large improvement, and not a solved problem. The same post records the other decision taken: the pilot blocked the model from high-risk site categories, financial services among them.
That second decision is the one worth copying. Where the input cannot be trusted and the filter cannot be relied on, the lever is what the model may reach and what it may do. OWASP's mitigations for LLM01 are a version of the same list: constrain model behaviour, enforce least privilege, require human approval for high-risk actions, and segregate and identify external content.
Read into a fund, real trouble needs three things at once: access to the fund's private material, exposure to content the fund did not write, and a way to act or send outward. An assistant that reads a borrower pack and returns a draft to the analyst who asked has two of the three, which is manageable. An agent that can also email the borrower, write to the loan system or query the whole portfolio has all three, usually without anyone deciding it should.
What to ask before you clear a tool.
- Which workflows put content we did not write in front of a model, and which of those run automatically rather than a person pasting something in?
- What can the workflow reach: one document, a folder, the whole data room, the loan system?
- What can it do without a person: draft only, send, write, call a tool, hand off to another agent?
- Does the agent hold an identity of its own with its own permissions, or is it borrowing a person's?
- If an output later looks wrong, can we reconstruct what the model was given and what it did?
The last one is the question funds reach late. A record of what went in and what came out turns a suspected injection into a bounded, provable event instead of an open question over every output the tool ever produced, and a vendor's retention settings will not reliably supply it: the surface that keeps that record and the arrangement that promises to keep nothing pull in opposite directions. Where AI grew tool by tool, the five answers differ per tool and nobody holds all of them. Where it runs through one layer, they are properties of the layer, set once and evidenced on request.
Primary sources: APRA's AI letter to industry (30 April 2026), ASIC's open letter to licensees (8 May 2026), OWASP LLM01:2025, NIST AI 100-2e2025 and Anthropic's Claude for Chrome pilot. General information, not legal advice. Regulator letters and vendor documentation both change, so confirm the current position before relying on it.
Questions this guide answers.
Can a document contain hidden instructions for an AI?
Yes. A language model receives the fund's instruction and the document's contents as a single stream of text, so a sentence inside the document that is addressed to the model can be acted on as though the fund had written it. OWASP records this as LLM01:2025, the top entry in its Top 10 for LLM Applications, and NIST catalogues the indirect form, where the instruction is planted in content the model reads later, as NISTAML.015 in NIST AI 100-2e2025. The text does not have to be visible to a person: white text in a PDF, a note in an unused spreadsheet cell or a line in document metadata all reach the model without reaching the analyst.
Is prompt injection a real risk for a credit fund or a theoretical one?
It is a live risk, and a credit fund's exposure profile is worse than most because of what it reads. Borrower reporting packs, compliance certificates, covenant calculations, valuations, information memoranda and data room exports are all written by counterparties with an interest in how the fund reads them, arrive on a schedule as a condition of the facility, and cannot be declined. APRA's 30 April 2026 letter to industry lists prompt injection first among the common attack pathways it observed across the largest banks, insurers and superannuation trustees.
Can prompt injection be filtered out?
Not reliably, and the vendors closest to the problem publish figures that show it. In its 25 August 2025 pilot of Claude in Chrome, Anthropic ran adversarial testing across 123 test cases representing 29 attack scenarios: browser use without mitigations showed a 23.6% attack success rate when deliberately targeted, and the mitigations it shipped brought that to 11.2%. A narrower challenge set of four browser-specific attack types reached 0%. The same pilot blocked the model from using sites in certain high-risk categories, including financial services, which is the more instructive control: where the input cannot be trusted, the lever is what the model may reach and what it may do rather than what it may read.
What do APRA and ASIC expect an Australian fund to do about this?
APRA's 30 April 2026 letter binds APRA-regulated entities and expects security controls that address AI-specific threats and attack paths, including privileged access management, hardened configurations, penetration testing and controls over agentic and autonomous workflows, alongside an inventory of AI tooling and use cases and human involvement in high-risk decisions. Most credit funds hold an AFSL rather than an APRA licence, so the letter that lands directly is ASIC's of 8 May 2026, which asks boards to evidence their assurance rather than accept it, to minimise the exposure of systems to untrusted input, to manage third party risk, and to table the letter at the ultimate board and risk governance committees. That letter refers licensees to APRA's, and an APRA-regulated investor may reach the same expectations through its own material service provider assessment.
Working with Levercon.
Levercon helps private credit funds and non-bank lenders accelerate AI adoption to unlock their full potential. It does that through one of three routes: Levercon Agents, Levercon Systems or Levercon Strategy.
Talk to us: you can get in touch here.
This guide is general information, not advice. Factual claims that rely on public sources link to those sources in the text. Practical guidance also draws on patterns Levercon observes across Australian credit funds. No client is named and no figure is attributed to one. Written by Levercon, reviewed before publication and revised in place as the facts change.