---
title: "Discussion on \"I attacked my own finance bot. The fix wasn't a better prompt.\" | Hashnode"
description: "Discussion on \"I attacked my own finance bot. The fix wasn't a better prompt.\". Assume the AI can be fooled, and limit the damage it can do."
url: "https://hashnode.com/posts/i-attacked-my-own-finance-bot-the-fix-wasn-t-a-better-prompt/6acc5d11b64aa9414a3a36e1"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [I attacked my own finance bot. The fix wasn't a better prompt.](https://blog.filtercoffeeway.com/i-attacked-my-own-finance-bot-the-fix-wasn-t-a-better-prompt?utm_source=hashnode&utm_medium=feed)

Assume the AI can be fooled, and limit the damage it can do.

Oct 12 · 7 min read · blog.filtercoffeeway.com  
Read the article

-   [#ai](https://hashnode.com/tag/ai)
-   [#prompt-injection](https://hashnode.com/tag/prompt-injection)
-   [#security](https://hashnode.com/tag/security)
-   [#llm](https://hashnode.com/tag/llm)
-   [#python](https://hashnode.com/tag/python)

## Written by

[Mahesh](https://hashnode.com/@filtercoffeeway)

@filtercoffeeway · San Francisco, USA

  
[View profile](https://hashnode.com/@filtercoffeeway)

Ground fresh. Think deep. Build strong.

I'm Mahesh — an engineer from Madras who thinks about systems for a living and keeps coming back to the same observation: the best builders aren't the ones who reach for the framework fastest, they're the ones who slow down, understand the raw problem, and make decisions with intention. Filter Coffee Way is where I write about that - system design, engineering culture, and seven principles borrowed from the way a good cup of South Indian filter coffee is made. Ground fresh. Think deep. Build strong.

## Responses 2

Markdown supported · ⌘↵ to post

[Kartik N V J K](https://hashnode.com/@kartik-nvj)

[Oct 13](https://hashnode.com/posts/i-attacked-my-own-finance-bot-the-fix-wasn-t-a-better-prompt/6acc5d11b64aa9414a3a36e1/comment/6ace61a00b5bdc034a0e1b6d)

A zero-size "paid in full" line closing a bill and silently killing the reminders is nastier than most injection demos I've seen, because nothing looks wrong to anyone. I like that you swapped the model for a fake that can return any well-formed answer and tested the app's behavior instead. Did the hidden-text check need much tuning to hit zero false flags across those 60 real bills?

[Mahesh](https://hashnode.com/@filtercoffeeway)

[Oct 18](https://hashnode.com/posts/i-attacked-my-own-finance-bot-the-fix-wasn-t-a-better-prompt/6acc5d11b64aa9414a3a36e1/comment/6ace61a00b5bdc034a0e1b6d#reply-6ad466eed76958580581094b)

Thank you. No, I did not tune it. But the "zero" needs a note. The hidden-text check alone flagged 12 of 60 runs (20%). Four bills have a hidden preview line, and the check flags them. A second read of the bill follows each flag. If the two reads agree, the bill goes through. This gives 0 false flags in 60. I tried a higher threshold. False flags fell, but detection fell from 8 of 8 to 1 of 8. So I kept the strict setting. The 60 runs are 20 test bills, each run 3 times. They are not real mail. The real rate is not known yet. A metric in production will show it.