AIKIDO-2026-10979

TL;DR

Several prompt builders passed bank-configurable text (mission descriptions, custom instructions, role sections) directly into Python's str.format() without escaping, meaning any {placeholder} in that text would be interpreted as a format variable. An attacker with control over bank configuration fields could craft a mission string like {"role": "admin"} to trigger a KeyError crash (DoS), or more critically, inject {some_existing_variable} to leak internal prompt template variables, or manipulate format substitution to alter the final system prompt sent to the LLM; potentially overriding intended behavior, escalating privileges within the AI's context, or bypassing role/mission constraints entirely.