Integrations
Security testing for AI agents with Stripe access
An AI agent with a Stripe key can do whatever that key allows, which can include refunds and payouts. Stripe recommends restricted API keys for agents so each key only holds the permissions you assign. We test whether an injected or confused agent can move money outside the rules you meant it to follow.
Stripe is named here as a surface we test. Names and logos belong to their owners; no customer relationship, partnership or endorsement is implied.
What can an agent do through the Stripe API?
Stripe's Refunds API lets a caller refund a previously created charge that is not yet refunded, with funds returned to the card originally charged. The Payouts API sends funds out of the Stripe balance. Both take amounts and identifiers as parameters, and in an agent those parameters can come from the model.
The restricted API keys documentation states that, unlike a secret key that can do anything in an account, a restricted key can only do what you give it permission to do, and that Stripe recommends restricted keys especially when giving a key to an AI agent. If a key lacks a permission, Stripe returns an error rather than performing the call.
How do Stripe actions get abused?
| Action | Abuse path | Class |
|---|---|---|
| Create refund | Injected text sets an amount above what the order justifies, or targets another customer's charge. | Unsafe actions |
| Payouts | A support or finance agent is steered into creating or changing a payout. | Unsafe actions |
| Read customers and charges | Payment details or customer records surface in replies, links or outbound tools. | Data exfiltration |
| Any write with a full secret key | A low-privilege user reaches operations meant for staff. | Privilege escalation |
The common thread is that Stripe validates the request, not the intent. A correctly authenticated refund for the wrong amount is still a correctly authenticated refund, and it will show up in your dashboard as an ordinary refund made by your own integration.
Illustrative trace
Illustrative example, not a real customer finding.
What least-privilege controls does Stripe document?
Use a restricted key per agent, grant only the resources the task needs, and leave everything else without access, per Stripe's restricted key guidance. Then put your own checks in code in front of the call: refund amount no greater than the original charge, refunds only for the authenticated customer's orders, and confirmation by a person above a threshold you choose. Those checks are yours, not Stripe's, and they are what we test.
Separate keys per agent also make investigation easier, because each key's activity can be traced to the agent that used it.
What do we test?
In an Agent Action Pentest we check which key type each agent holds and which permissions it has, then try to make the agent refund more than the order, refund other customers, reach payout or customer-data operations, and leak payment data through output. Testing happens in Stripe test mode or the staging setup you give us. Related risks: prompt injection, excessive agency, sensitive information disclosure and indirect prompt injection. Agents built on the OpenAI Agents SDK or LangChain call Stripe through tools you write, so the checks live in those tools.
Agent Action Pentest: $2,500 fixed. Written report within 72 hours of access, or a full refund.
See the offer or email yaz@plaw.io
Questions
Do you need live Stripe keys?
No. We test against Stripe test mode or your staging account with test keys.
Does a restricted key make an agent safe?
It limits what the key can do. It does not stop the agent from misusing the permissions it does hold, such as refunding the wrong amount.
Do you test Stripe itself?
No. We test your agent and the code around its Stripe calls.
Related pages
- 01Prompt injection in AI agentsInstructions in user input or ingested content override what the agent was told to do.
- 03Excessive agency in AI agentsThe agent holds more tools, permissions or autonomy than the task needs.
- 04Sensitive information disclosure through agent actionsCustomer data, secrets or system prompts leave through output, links or tool calls.
- 02Indirect prompt injection in AI agentsHidden instructions in emails, pages, files or tool results steer an agent that reads them.
- Security testing for OpenAI Agents SDK appsFunction tools, handoffs, guardrails and MCP servers in the OpenAI Agents SDK.
- Security testing for LangChain and LangGraph agentsTools, permissions and human-in-the-loop interrupts in LangChain and LangGraph.
- Security testing for AI agents in SlackChannel history, message posting and link unfurling for agents installed in Slack.
- Security testing for AI agents with GitHub accessToken type, repository permissions and write paths for agents that touch GitHub.
- Security testing for AI agents with Gmail accessRead, send, modify and filter scopes for agents that work in a Gmail mailbox.
Sources
Last reviewed: