AI security in the GCC: protecting payments, customer data and automated systems

A mid-sized trading company in Riyadh connects an AI assistant to its WhatsApp Business account, its customer database and its payment platform. Within a month, enquiries are answered in minutes instead of hours.

Then the AI provider sends an email about unusual usage. The bill has jumped overnight.

Someone traces the API key, the digital pass that lets one system talk to another. It was pasted into a shared document during setup by a freelancer who finished the project months ago. Nobody changed it. Nobody checked what else that key could reach, or if the assistant could do more than answer questions.

No money has left the account. But the finance director now has a very uncomfortable question: if the key could run up a bill, what else could it do?

This is a representative situation, not a documented client case. We use it because versions of it are common.

What is changing across the GCC

Across Bahrain, Saudi Arabia, the UAE, Qatar, Kuwait and Oman, businesses now take card and wallet payments by default, bank through mobile apps and handle government services online. Saudi Arabia’s central bank launched an open banking framework in 2022, which is designed to let licensed services connect to bank data with customer permission.

On top of that sits a new layer: AI assistants, chatbots and automated workflows that read emails, update the CRM (the system that stores customer records), send messages and trigger actions in other platforms.

Each connection saves time. Each one is also a door. The useful question for any business is simple: who holds the keys to each door, and what happens if one goes missing?

Where the risks appear

October 2026 gave several clear examples, none of them in the GCC, but all relevant to businesses here.

On 21 October, the PHP project released urgent fixes for two critical flaws that could let an attacker run code on a web server without logging in. PHP runs a large share of websites, including WordPress. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP security team said updating is the only safe choice. A further, lower-risk PHP advisory followed on 23 October.

The same day, LiteLLM, a popular open-source tool for connecting applications to AI models, confirmed that its 1.107.0 release had been compromised and could steal credentials. LiteLLM described the incident as contained but still under investigation, and advised affected users to rebuild their systems and replace every secret that may have been exposed.

And in the United States, Axios reported on 22 October that major banks were finding third-party AI agents inside customer accounts. Some had logged in with customers’ own credentials, and some appeared to act beyond what the customer asked. Banks are restricting these agents and moving towards read-only access. This is a media report, and the banks have not published full details.

The risks usually come from familiar places:

• Leaked API keys saved in documents, chats or code where others can find them.
• Outdated websites and servers, where a known flaw stays open long after a fix exists.
• AI agents with too much access, such as an assistant that only needs to read invoices but can also approve refunds.
• Fake banking messages that look more convincing when attackers already know a customer’s name or branch.
• Compromised software packages, where a trusted tool is quietly replaced with a harmful version.
• Weak account security, especially email accounts protected by a password alone.
• Forgotten access held by former staff, agencies or freelancers.

Most of these are fixed by routine housekeeping, not expensive tools.

Protecting more than the payment

Payment security is about more than the transaction. The payment depends on everything around it:

• The email account that controls the payment platform.
• The phone that receives verification codes.
• The website that collects customer details.
• The CRM holding personal data.
• The API keys linking those services together.
• The automation that starts or confirms an action.
• The people allowed to approve transactions.

If any one of these is weak, the payment is weak too.

How FAIM approaches AI and automation

At FAIM, we build interactive technology, web applications and AI features for clients in Bahrain and Saudi Arabia. We treat security and continuity as part of the design from the first meeting, not a feature added at the end.

In practice, that means:

• Each agent or application gets only the access it needs, read-only wherever possible.
• A person approves payments, deletions, publishing and important customer messages.
• API keys and passwords are kept in protected environment settings or a secrets manager, never in code, chats, emails or shared documents.
• Activity logs show clients what an automated system has done, and spending alerts flag unusual usage early.
• Systems are tested before they touch live customer or payment data.
• Backups and recovery steps are agreed before launch.
• Access is removed when a project ends or someone leaves.

Our applications are tested on the target hardware, offline, under touch and under load before they leave the studio. Admin panels are role-based, the client owns the delivered assets and data, and data captured on event hardware is wiped after handover.

None of this promises that nothing will go wrong. It means that if something does, the damage is smaller and someone can see what happened.

Five actions to complete today

• Update website software, operating systems, browsers, plugins, automation tools and AI packages. Ask your host which PHP version your site runs.
• Rotate important API keys (replace them with new ones and cancel the old ones) and review recent usage for anything unusual.
• Enable two-factor authentication, a second check such as an app code, for email, banking, payment, hosting, social media and cloud accounts.
• Review every AI agent and remove permissions it does not need.
• Turn on login, transaction, usage and spending alerts.

Actions to complete this week

• Move the team to a password manager and give every account a unique password.
• Back up your website, CRM and key files, keep one copy separate, and test a restore.
• Check who can see customer data, and limit it by role.
• Remove former employees, agencies and freelancers from every platform.
• Remind staff never to share one-time passwords, PINs or recovery codes, and to call the bank only on its official number.
• Read your AI activity logs and look for actions nobody expected.
• Write down who approves payments, and require two people for large ones.
• Agree a simple incident plan with emergency contacts for your bank, host and developer.

If something looks wrong

In Bahrain, cybercrime is handled by the Ministry of Interior’s General Directorate of Anti-Corruption and Economic and Electronic Security. In Saudi Arabia, Saudi CERT points people to the police, the Absher portal, the Kulluna Amn app or the Public Security number 989, and to their bank for suspicious transactions. In the UAE, use the Ministry of Interior’s eCrime service through the MOI UAE app, or call 999. In Qatar, the Ministry of Interior’s Cybercrimes Combating Department accepts reports through Metrash2. In Kuwait and Oman, contact your bank first and then the police through official government channels.

Anyone offering to recover stolen money in exchange for your OTP, PIN or remote access should be treated as part of the fraud.

Security news this month: where each story stands

Each link below goes to the original publisher or the organisation involved.

1. 17 Oct · Investigation ongoingOpenCode: AI provider keys may have been exposedKeys saved by around 1.4% of Console users. BleepingComputer report
2. 21 Oct · Fix availablePHP fixes two critical flawsFixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. php.net news and advisories
3. 21 Oct · Contained, under investigationLiteLLM 1.107.0 release compromisedMalicious packages on PyPI and Docker. LiteLLM incident notice
4. 22 Oct · Media reportUnvetted AI agents in US bank accountsBanks are restricting third-party agents. Axios scoop
5. 23 Oct · Full advisory pendingPHP informational advisoryA less likely session-related issue, with an interim setting. php.net news and advisories

Responsibility stays with the business

AI is a multiplier. It can help a small team serve far more customers, and it can repeat a mistake just as quickly.

Businesses remain responsible for everything their automated systems can access, change, publish, delete or purchase. Clear limits, visible activity and a person who can press stop make the difference.