Prompts Are the New Attack Surface, and Wall Street Just Doubled Down

The shell inside the prompt

The most concerning detail this week came from Microsoft. Microsoft published a research post on May 7 with a title that reads like a horror movie tagline: "When prompts become shells." The core finding is deceptively simple. AI agents now have plugins that read files, search databases, run scripts, and operate on your network. If an attacker can control the parameters passed into those plugins via prompt injection, the agent doesn't just hallucinate something embarrassing. It executes code. On your infrastructure. With whatever privileges you gave it.

This is not a theoretical concern dressed up in academic language. Microsoft's security blog is explicit: vulnerabilities in the AI layer are "no longer just a content issue" but "an execution risk." That phrase should be tattooed on the forehead of every CTO currently rushing agents into production. We spent years worrying about AI saying the wrong thing. Now the worry is AI doing the wrong thing, on command, because someone slipped instructions into a data field the agent happened to read.

What makes this particularly uncomfortable is the timing. The same week Microsoft drops this research, Anthropic is on stage in New York telling the biggest banks in the world to hand Claude the keys to their pitchbook pipelines and KYC screening. I'm not saying those two things are contradictory (and yes, I know how that sounds), but the juxtaposition is striking enough that it deserves more than a shrug.

OpenClaw and the supply chain nobody scanned

If the Microsoft post was the theoretical warning, OpenClaw was the proof of concept. According to VentureBeat, a lightweight open-source agent orchestration tool called OpenClaw became the vector for what might be the first real AI agent supply-chain attack. The tool started as a local LLM automation layer. Rapid adoption outpaced security governance. Marketplace publishing required minimal review. You can see where this is going.

Koi Security's ClawHavoc audit flagged 341 malicious skills within days. Snyk's ToxicSkills report found critical vulnerability rates above thirteen percent. An early vulnerability in the web gateway was recorded as CVE-2026-25253, but the community underestimated the risk because the agent defaulted to localhost. Except, of course, many users exposed the port during cloud deployments. Copycat repositories appeared within hours. Managed hosting providers recorded unexplained surges in outbound traffic, hinting at data exfiltration before formal disclosures even emerged.

Look, the pattern here is almost boringly predictable if you've watched open-source ecosystems before: convenience wins, security reviews are optional, and by the time someone sounds the alarm the horses are already in the next county. What's new is the attack surface. A malicious npm package can do damage, sure. But a malicious agent skill has the agent's full operating privileges, which increasingly means browser automation, file access, and network calls. The Information reported on May 4 that SAP is already moving to block OpenClaw and other unauthorized AI agents from its ecosystem. That's a Fortune 500 company essentially saying: we don't trust the supply chain at all.

The uncomfortable truth (and I realize I keep using that word, but it fits) is that no supply-chain scanner currently has a detection category for this kind of threat. VentureBeat's headline said it plainly: "One command turns any open-source repo into an AI agent backdoor." We built the scanning infrastructure for packages and containers. Nobody built it for skills and plugins. Not yet.

Anthropic bets big on banker workflows

Meanwhile, in a parallel universe where security concerns are someone else's department, Anthropic had quite a week. On May 5, the company released ten ready-to-run agent templates targeting financial services: pitchbook builders, KYC screeners, month-end close assistants. Each ships as a plugin in Claude Cowork and Claude Code, and as a cookbook for Claude Managed Agents. They also announced Claude now works across Microsoft Excel, PowerPoint, Word, and (coming soon) Outlook through add-ins for Microsoft 365.

The real signal, though, was the stage. As Fortune reported, Jamie Dimon and Dario Amodei shared a stage for the first time at Anthropic's invite-only financial services briefing in New York. JPMorgan's CEO standing next to Anthropic's CEO is not a product announcement. It's a declaration of intent. Anthropic isn't just selling software to banks; according to Fortune, it's "building the infrastructure, the deployment mechanism, and relationships in the financial industry to become the operating layer for Wall Street."

Business Insider noted the ten agents can handle everything from building pitch decks to conducting market research, and that the announcement comes as banks themselves are building similar tools. The competitive angle matters, but I think the more interesting story is the two-track strategy Fortune described: one track for the largest institutions (configure and run agents yourself), another for the mid-market using a private equity-backed joint venture to embed Claude directly into operations. That second track is the one to watch. It means Anthropic wants to be inside companies that don't have AI teams, which is most of them.

Claude Opus 4.7 leads Vals AI's Finance Agent benchmark at 64.37%, according to Anthropic's own announcement. That is a benchmark result, not a measured success rate for every financial task a bank might assign. Before using it for KYC checks, I would want to see which cases the model gets wrong and how those mistakes would be caught.

The token bill nobody budgeted for

Here's a detail that got buried under the flashier headlines. A Stanford Digital Economy Lab paper published May 5 found that agentic tasks consume roughly 1,000 times more tokens than code reasoning or code chat. One thousand times. The cost is overwhelmingly in input tokens, because agents build what the researchers call a "context snowball": read the task, get a response, re-read everything, act, re-read everything again plus the new response, act again.

The kicker, from researcher Jiaxin Pei: "Agents are not capable of predicting their own token costs. This is the fundamental bottleneck for result-based pricing for agents." So you can't price the work until after it's done. Anyone who's ever hired a contractor on time-and-materials knows how that story ends. This is a real problem for the Anthropic finance play specifically, because banks are famously allergic to unpredictable costs. If you're deploying ten agent templates across a trading floor, someone in procurement is going to want a number, and right now nobody can give them one.

Don't put the agent on the org chart

Harvard Business Review also discussed whether organizations should treat AI agents like employees. That framing raises a practical question: when an agent makes a decision, which person is responsible for checking it?

This connects directly to the security story. When you treat an agent like a colleague, you implicitly trust its inputs and outputs the way you'd trust a coworker's. But a coworker can't be prompt-injected. A coworker doesn't silently execute a malicious skill because someone poisoned the supply chain. The HBR research is framed as an organizational design question, but it's really a security question wearing a management consulting hat.

Where this leaves us

The pattern of this week is almost too clean. Anthropic expands agent capabilities into one of the most regulated, high-stakes industries on earth. Microsoft simultaneously publishes research showing those exact capabilities create remote code execution risks. OpenClaw demonstrates the supply-chain version of the same problem. Stanford shows the costs are unpredictable. The accountability question matters throughout: which person has the time and authority to catch an agent's mistakes?

I keep thinking about that Microsoft phrase: prompts are the new shells. In the old world, a shell was a controlled interface to a powerful system, and the entire history of computer security is the history of people finding ways to abuse that interface. We're not starting a new chapter. We're rereading the same one, except now the shell understands natural language, and the attack payloads look like polite requests.