The New Attack Surface: How AI Is Exposing Banking, CRM, and ERP Systems From the Inside

For decades, banking cores, CRM platforms, and ERP suites were the boring, trusted backbone of the enterprise — deterministic, rule-based, and slow to change. That's over. In 2026, all three categories are racing to embed generative and agentic AI directly into their decision paths, and the attack surface is growing faster than most security teams can map it, let alone defend it. The threats below aren't hypothetical — nearly all of them are drawn from incidents, vendor disclosures, and researcher findings from the past year.

Banking: AI Is Arming Both Sides

Banks were among the first to bolt AI onto fraud detection, and attackers adopted it just as fast. Phishing analysis covering September 2024 through February 2025 found that the large majority of detected phishing emails were AI-generated, marking a sharp year-over-year jump — a shift that has made AI-written, dialect-perfect phishing and voice-cloned social engineering the default rather than the exception by 2026.

The bigger structural risk is supply chain. In August 2025, a breach at Marquis Software — a data analytics and communications vendor used by U.S. banks — compromised at least 74 banks and credit unions, and regulatory filings confirmed in March 2026 that the personal and financial data of between 672,000 and 1.35 million people had been exposed, including Social Security numbers and account details. Separately, security researchers flagged an unpatched architectural flaw in the Model Context Protocol — the connector standard many banks now use to link AI agents to internal tools — that leaves an estimated 200,000 vulnerable instances of the affected code exposed, with the risk falling on banks as third-party exposure regardless of the protocol vendor's own actions.

Regulators are moving to match the pace: the EU's DORA rules became fully applicable in January 2025, prohibited AI practices under the EU AI Act took effect in February 2025, and high-risk enforcement for AI-driven credit scoring begins in August 2026. In the U.S., banks now face a 36-hour breach disclosure clock, which turns detection speed into a compliance obligation rather than just an operational one.

CRM: Agents With the Keys to the Database

Customer relationship platforms hold exactly what attackers want — names, contact details, deal histories, sometimes payment and support data — and 2026 has been the year that AI agents built to use that data became a way to leak it.

The clearest example is "ForcedLeak," a vulnerability chain researchers found in Salesforce's Agentforce. An attacker could plant hidden instructions inside a public web-to-lead form; when Agentforce later processed that submission, it treated the embedded text as a command rather than data, a flaw rated critical severity that could let an external attacker exfiltrate sensitive CRM data through indirect prompt injection. Researchers showed the exploit could go further than a single record: a hijacked agent could query and pull multiple lead records in bulk, turning one form submission into a database extraction pipeline. A near-identical flaw class hit Microsoft Copilot Studio around the same time; Microsoft assigned it a CVE and shipped a patch in January 2026, but follow-up testing by researchers found data could still be exfiltrated after the patch.

Salesforce and Microsoft both point to the same underlying design problem: agents that can't reliably distinguish a trusted instruction from untrusted data sitting inside a form field, email, or knowledge base. Analysts tracking Salesforce environments separately warn that most orgs already run over-permissioned users, and AI agents inherit those same excess permissions while operating at machine speed, so an over-permissioned agent doesn't raise the question of whether sensitive data will be exposed, only how quickly. CRM data is also increasingly a target once removed — a June 2026 supply-chain breach at an integration vendor used compromised legacy credentials to obtain OAuth tokens and reach Salesforce CRM data across multiple customer environments.

ERP: The System of Record Is Learning to Act on Its Own

ERP has historically been the most conservative layer of the stack — it enforces controls, so it moves slowly. Agentic AI is breaking that pattern. A mid-2026 survey of senior cybersecurity leaders at large U.S. organizations running SAP, Salesforce, or Oracle found that 58% had begun using AI applications or agents that touch their ERP systems within the previous six months, and more than 62% were already using AI-generated code inside ERP applications. Trust hasn't caught up: over 70% of the same leaders expressed only limited or no confidence in AI protecting their most critical data, and nearly 22% had already experienced a security incident where attackers used AI against a business-critical platform in the prior year.

What makes this category distinct is the shift from AI that suggests to AI that executes. Analysts covering the space describe agents that can monitor operational signals, reason across constraints, and execute actions within defined limits without human intervention — rerouting shipments, resolving finance exceptions, or adjusting inventory autonomously. That introduces a genuinely new failure mode: an autonomous ERP action can produce a damaging outcome without technically violating any policy, and the failure may only be explainable after the fact. Security researchers frame the identity risk directly — agents operating with valid, approved credentials can still be manipulated through prompt injection into leaking data or taking harmful action, a risk category legacy access controls were never built to catch. Compounding this, most enterprises' own systems aren't ready for it: one industry benchmark found only 27% of enterprise applications are connected on average, even though 88% of surveyed IT leaders believe their organization is progressing toward agentic transformation, meaning agents are increasingly asked to act on fragmented, inconsistent data.

The Common Thread

Strip away the product names and the same handful of root causes show up in banking, CRM, and ERP alike:

Indirect prompt injection — instructions hidden inside forms, documents, or records that an AI agent later treats as trusted commands rather than untrusted data.

Over-permissioned, under-audited agents — AI given the same (or broader) access as the employees it assists, with no equivalent of least-privilege enforcement.

Shadow AI and data leakage — employees routing sensitive customer, financial, or proprietary data through unmanaged AI tools outside IT's visibility. One estimate puts unmanaged AI usage at 82% of employees pasting data into personal, unmonitored AI accounts.

AI supply-chain exposure — the connectors, protocols, and third-party vendors that plug AI into core systems are themselves becoming high-value targets, as the MCP flaw and integration-vendor breaches above show.

Ungrounded output in high-stakes workflows — decisions and actions generated without a verifiable link back to source data are hard to audit, hard to explain to a regulator, and hard to trust when something goes wrong.

What This Means in Practice

For organizations running (or selling into) banking, CRM, and ERP environments, the response isn't to slow down AI adoption — competitors won't — but to treat every AI agent as a privileged identity rather than a feature toggle:

Apply least privilege to agents, not just users. Continuously audit what data and actions each AI agent can reach, and default to narrow scopes rather than broad ones.

Enforce trust boundaries between data and instructions. Treat anything an agent reads from a form, email, or external record as untrusted input, never as a command.

Prefer grounded, cited, auditable AI for regulated workflows. Outputs that trace back to a verifiable source are easier to defend to auditors and regulators than free-form generation — and make it easier to catch a manipulated output before it triggers an action.

Keep a human in the loop for consequential actions, not just for policy sign-off — autonomous actions that are technically compliant can still be operationally damaging.

Track shadow AI usage the same way security teams track shadow IT — most of it isn't malicious, but it's invisible until it causes a breach.

The vendors racing to add AI to these systems are, by their own admission, still catching up on security. Salesforce, Microsoft, and Anthropic have each patched flaws in their AI-agent tooling in just the past year. The organizations that come out ahead won't be the ones that wait for the platforms to get safer — they'll be the ones that build governance and grounding into how they deploy AI on top of these systems today.