IBM disclosed CVE-2026-18875 in Financial Transaction Manager for Red Hat OpenShift, a vulnerability that makes an important enterprise AI risk unusually concrete.
According to IBM, an unauthenticated attacker could insert malicious runbook content into the AI agent’s vector database. That poisoned context could steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data.
The authority problem is downstream of the prompt
The AI agent may be legitimate. Its identity may be authenticated. The MCP server and payment tool may both be approved. Its credentials may be valid.
None of those facts establish authority for a particular payment.
Retrieved information can influence an agent’s reasoning, but it should not inherit the authority of the agent that reads it. A runbook, vector-store record, document, webpage, repository file or memory item can propose an action. It cannot create the enterprise mandate required to perform that action.
Adjudicate the effect
For a financial transaction, the authority decision should resolve the actual effect: principal, mandate, delegation, account, counterparty, amount, operation, constraints and expiration.
If those facts do not establish authority for the proposed transaction, the correct result is DENY regardless of why the model proposed it.
This is the distinction Authrizd is designed to enforce: information can influence an agent, but it cannot manufacture authority.
Sources
NEXT STEP