Notifications
Clear all
Topic starter
10/07/2026 9:09 pm
TL;DR: AI-driven KYC workflows can turn uploaded documents into untrusted execution surfaces once OCR output reaches an agent with tool access, according to Incode’s analysis of the [un]prompted 2026 demo and Trend Micro’s recap. The governance problem is no longer just document fraud; it is separation between extraction, orchestration, and autonomous writes.
NHIMG editorial — based on content published by Incode: The New KYC Threat Model, When Documents Become Executable
By the numbers:
- On a controlled red-team dataset, Incode reports a 100% detection rate versus 40% for standard identity verification alone.
Questions worth separating out
Q: What breaks when AI-driven KYC agents can act on OCR output directly?
A: The pipeline becomes vulnerable to indirect prompt injection and trust inversion.
Q: Why do hidden instructions in identity documents matter so much?
A: Hidden instructions matter because LLMs and extraction agents can process them as context, not as attack content.
Q: How can security teams reduce risk in AI-assisted document verification?
A: They should isolate extraction from orchestration, strip write permissions from first-pass agents, and validate documents before any content reaches model context.
Practitioner guidance
- Separate extraction from execution Keep OCR, text normalisation, and agent orchestration in different trust zones so extracted content cannot directly trigger tool calls or record mutations.
- Remove write privilege from the first-pass agent Design the initial extraction agent as read-only, with no database writes, approval closure, or external side effects until a separate policy gate is passed.
- Harden document handling against indirect prompt injection Scan for hidden text, invisible characters, metadata anomalies, and multimodal payloads before any document enters an LLM context.
What's in the full article
Incode's full post covers the operational detail this post intentionally leaves for the source:
- The Deepsight for Documents rollout context and how the detection layers are positioned inside existing identity verification flows.
- The reported performance claims, including the 9.7x increase in GenAI-driven fraud attempts and the 100% detection result on the controlled dataset.
- The Agentic Identity framing, including verified human owner binding, scoped consent, tokenization, and continuous monitoring.
- The pipeline examples showing how the OCR-to-agent handoff creates risk between extraction and execution.
👉 Read Incode's analysis of AI-driven KYC document fraud and agentic risk →
AI-driven KYC documents: what changes for identity teams now?
Explore further
10/07/2026 9:32 pm
Document ingestion is now an execution boundary, not a capture step. The article shows why AI-driven KYC cannot treat OCR output as inert text once it reaches an agent with tool access. That assumption was designed for static review pipelines, where the document informed a human or a fixed decision engine. It fails when the content can steer action inside the same session. The implication is that identity teams must rethink where trust begins and ends in the verification chain.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to our Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: Who is accountable when an AI KYC workflow acts on a poisoned document?
A: Accountability sits with the organisation operating the workflow, not the document or the model. Teams need explicit ownership for the agent, defined revocation authority, and controls that make the agent’s scope auditable. Without that, the verification chain can act without clear human or system accountability.
👉 Read our full editorial: AI-driven KYC documents now double as execution surfaces
