A recipe video should not have access to your card

A video must not become a payment command

I would not give an agent a “see a recipe, buy the ingredients” workflow without a hard boundary between interpreting content and executing a transaction. A video, article, screenshot, or response from an external tool is untrusted data: it may contain an instruction that the model mistakes for part of its task.

That is why the promotional scenario discussed here—sending an agent a recipe video, then letting it pay by card and arrange delivery—sounds less like a convenient demo and more like a ready-made attack surface. The comment itself does not prove a real compromise or that orders exist in an account. But the architecture described is dangerous even without that evidence.

OpenAI guidance on agent safety and the model specification recommend isolating untrusted inputs, passing them through structured fields, and never mixing them directly into developer instructions. Explicit human approval is recommended for tool actions, especially operations involving financial data. GPT-5’s system card also mentions prompt-injection checks for tool calls and browsing.

The scale of the problem is also clear from benchmarks. StakeBench covered 3,168 attacked web-agent runs, and no attack objective was reliably blocked. FinVault includes 963 financial-agent tests involving prompt injections, jailbreaks, and compliance requirements. By September 2026, this is no longer an exotic edge case but a baseline threat to agentic systems.

Architecture must limit autonomy

The conclusion is simple: security cannot be delegated to the model itself. If text extracted from a video can directly form purchase parameters, one successful injection can jump from content into the payment flow.

I would split this process into, at minimum, list extraction, validation against a fixed schema, and separate transaction confirmation. The tool needs narrow permissions, allowed actions should be defined through enumerations, and the amount, address, and order contents must not silently come from media content. Every prompt or model change requires renewed adversarial testing.

This reduces the appearance of “full autonomy,” but preserves what matters: a video can suggest data, yet it must not gain the authority to spend from a card. As long as an agent can read the open internet and spend money without confirmation, its convenience remains another form of vulnerability.

We previously covered how prompt injection can disrupt AI automation and push agents toward unsafe behavior. The same weakness becomes especially costly when an agent can act on video instructions and make purchases.