Sygnia finds AI onboarding flaw exposing client data

Sygnia has disclosed critical vulnerabilities in an AI-assisted customer onboarding application used by a financial institution. The flaws were found during a penetration test of software developed heavily with Anthropic's Claude.

The application handled sensitive personal and financial data, including government-issued identification, identity verification records, and payment details. The institution managed USD $2 billion in client assets, and the software was designed to let applicants resume onboarding before receiving full account credentials.

According to the findings, the central flaw lay in how the system issued and restored applicant access tokens. Possession of an applicant's globally unique identifier, or GUID, was treated as sufficient proof of access, meaning a low-privilege user could view another client's personal information without stronger verification.

This exposed data beyond the requester's authorised scope, including names, contact information, application status, financial details, identity verification data, payment information, Social Security numbers, and co-applicant details. Sygnia described the issue as an authentication and authorisation failure rather than a simple coding error.

Code review

An LLM also helped identify the flaw during testing, underscoring how the same tools used to speed software development can also shorten the time needed to spot weaknesses in business logic. In its assessment, Sygnia argued this changes the economics of code review by allowing first-pass analysis to be completed in minutes rather than hours or days.

The review focused on a workflow that appeared structured on the surface. The application used temporary tokens, expiry controls, rate limiting, and audit logging, but it did not answer a basic security question: what must a requester prove before receiving an applicant token?

That distinction matters because a GUID can locate a record, but it does not prove control of a session, device, identity, or communication channel. Sygnia said the flaw stemmed from an implementation focused on how a token would behave after issue rather than whether the requester was entitled to receive it in the first place.

"Working code is not the same as secure code," said Zach Mead, Principal Penetration Tester, Sygnia.

"AI-generated code may compile, follow familiar conventions, and pass basic checks, while still making flawed assumptions about trust boundaries, authorization, state, ownership, or third-party integrations. Security teams need to treat AI-generated output as untrusted until validated," said Mead.

The case highlights a broader cyber security concern over so-called shadow AI, where staff use generative AI tools without formal oversight, as well as the growing use of AI-generated code in business systems. Sygnia said vulnerabilities introduced this way are often architectural or logical, making them harder for static application security testing tools to detect.

Service launch

Alongside the disclosure, Sygnia launched a set of AI Cybersecurity Services aimed at governance, testing, and risk assessment for AI systems and applications. The offering includes posture assessments, governance frameworks, governance reviews, and penetration testing for internal and customer-facing AI applications.

The services are intended to address risks across infrastructure, applications, data flows, and prompt behaviour. Organisations increasingly need to understand where AI is being used, what data it can access, and how it changes the attack surface, the company said.

Ilia Rabinovich, Vice President of Cybersecurity Consulting at Sygnia, said many organisations were adopting AI more quickly than they were securing it. He framed the issue as one of visibility and control rather than a binary decision about whether to use the technology.

"AI adoption is moving faster than many organizations' ability to govern and secure it," said Ilia Rabinovich, Vice President of Cybersecurity Consulting, Sygnia.

"The challenge is not whether enterprises should use AI. They already are. The challenge is whether they understand where AI is being used, what data it can access, how it changes their attack surface, and whether their existing controls are prepared for the risks it introduces," said Rabinovich.

Sygnia's research also drew a connection between AI-assisted software development and AI-assisted attack activity. In a separate cloud incident response case described by the company, investigators observed attackers moving across source control, cloud resources, CI/CD systems, runtime infrastructure, and data stores at unusual speed and in parallel, a pattern it linked to AI-enabled workflows.

It argued that defenders now face three related pressures at once: faster code creation, faster vulnerability discovery, and faster attack execution. In that context, Sygnia recommended making AI-assisted code visible in development workflows, setting explicit security requirements in prompts, and using human review to test whether software matches business intent.

Among the practical checks it outlined were whether token issuance requires independent proof of applicant control, whether an identifier can influence authorisation decisions, and what personal data becomes accessible once a token is issued. It also advised companies not to feed unmanaged AI tools with secrets, credentials, raw personal data, or proprietary implementation details.

The core lesson from the test was that familiar security controls are insufficient if they are built around the wrong trust decision.