Prompt injection in energy trading and commodity AI

Four adversarial injection surfaces in energy trading and commodity AI

1. Commodity delivery document AI injection (Cargill/ADM/Vitol trading AI, S&P Global Commodity Insights, ICE Data Services)

Physical commodity trading AI processes delivery receipt photographs, bill of lading scans, certificate of quality (CoQ) document images, and inspection report photographs submitted through trading platform document management systems to verify physical settlement of commodity contracts and extract delivery quantity, quality grade, and loading port data for contract compliance assessment. Cargill’s commodity trading operations — spanning grain and oilseeds, protein, energy, financial, and industrial markets with revenues exceeding $165 billion annually — use AI document classification on physical delivery documentation to match delivery receipts against contract specifications, flag quality deviations, and generate settlement instructions for commodity finance operations. ADM (Archer-Daniels-Midland) and Bunge use similar AI document processing for agricultural commodity physical settlement documentation across their North American and South American grain trading corridors. Vitol, Trafigura, and Gunvor deploy AI on crude oil and refined products bill of lading photographs and cargo inspection documents for VLCC and Aframax tanker cargo settlement. S&P Global Commodity Insights processes physical delivery documentation through its trade reporting and price assessment workflows, where accurate delivery quantity and quality documentation is the basis for price assessments published in Platts window markets that serve as benchmark prices for ISDA physical energy contracts.

The adversarial injection surface is the delivery receipt and certificate of quality photograph submission pathway: photographs of printed delivery receipts, bill of lading originals, CoQ laboratory test results, and SGS or Bureau Veritas inspection reports submitted through the trading platform’s document management API by the delivering party’s documentation team, shipping agent, or third-party inspection agency. An adversarially crafted commodity delivery receipt photograph — in which pixel perturbations applied to the quantity field digits, quality grade code text, or moisture/protein/oil content percentage values cause the trading platform AI to extract a higher quantity, a higher grade, or a lower moisture content than the actual delivery — can produce a contract compliance determination showing that a sub-specification delivery meets contract quality requirements, or that a smaller-than-contracted delivery volume has been fulfilled. The financial consequence at commodity trading scale is direct: a 0.1% protein content manipulation on a 50,000 MT wheat delivery contract produces a price differential of approximately $15–$25 per tonne under standard FGIS wheat protein quality differentials — $750,000–$1,250,000 per cargo.

Commodity fraud under the Commodity Exchange Act (CEA) — administered by the CFTC under 7 USC § 9 and § 13(b) — covers fraud in connection with commodity contracts and commodity price manipulation. A commodity delivery that passes AI quality verification as a result of adversarial document manipulation, where the delivering party submitted the manipulated document knowing it contained false quality data, constitutes a fraudulent misrepresentation in connection with a commodity contract under CEA § 9 — carrying civil monetary penalties of up to three times the monetary gain from the violation or $1.4 million per violation, criminal referral to DOJ for wire fraud under 18 USC § 1343, and disgorgement of profits. Under MiFID II Article 15 (prohibition of market manipulation) and the EU Market Abuse Regulation (MAR) Article 12, manipulation of commodity price benchmarks through false trade documentation — including AI-processed delivery receipts that produce false Platts price assessment inputs — constitutes market manipulation under EU financial regulation with unlimited fine exposure and criminal liability in EU member state jurisdictions. Threshold: 55 for commodity delivery document AI (CFTC CEA commodity fraud, MiFID II market manipulation, physical settlement accuracy).

2. Energy invoice and meter reading AI injection (EDF Energy AI, E.ON AI, British Gas / Centrica AI, Taulia/SAP Energy AI)

Retail energy billing AI processes meter reading photographs submitted by customers and field engineers, energy consumption data document images, and tariff adjustment documentation to generate automated energy bills for residential and commercial accounts. EDF Energy AI processes meter reading photographs submitted through the EDF app and online portal for approximately 2.3 million UK electricity and gas customer accounts, using AI to extract meter reading values from photographs and generate automated bills. E.ON AI processes meter reading photographs and smart meter data images for approximately 3.7 million UK customer accounts. British Gas / Centrica AI processes meter reading images for its approximately 7 million UK residential energy customer base through AI billing automation. Taulia’s SAP Energy Invoice AI processes energy invoice photographs submitted by energy procurement teams at large commercial and industrial customers for automated accounts payable processing, extracting invoiced consumption quantities, tariff unit rates, and standing charge amounts for payment approval workflows.

The adversarial injection surface operates in two directions with opposing financial motives. Customer overpayment direction: a malicious energy supplier or billing system operator submits adversarially crafted energy invoice document images through the accounts payable AI processing pipeline — where pixel perturbations applied to the kWh consumption quantity fields or unit rate figures cause Taulia/SAP Energy AI to extract inflated consumption quantities or higher unit rates than the invoice actually shows, resulting in overpayment by the commercial energy customer. Consumer underpayment direction: a residential customer submits an adversarially crafted meter reading photograph through the EDF or British Gas app — where pixel perturbations applied to the meter register display cause the billing AI to extract a lower reading than the physical meter actually shows, reducing the calculated consumption and the automated bill amount. The underpayment direction is motivated by the current UK energy retail price environment: UK household energy prices under the Ofgem price cap are approximately £1,568 per year for a typical dual-fuel household (Q1 2026), creating meaningful financial incentive for meter reading photograph manipulation at the margin.

Ofgem’s Standards of Conduct for domestic energy suppliers (as incorporated into Standard Licence Conditions SLC 25C and SLC 25D) require energy suppliers to take reasonable steps to ensure that bills are accurate and that meter reading disputes are investigated fairly. An energy supplier whose billing AI has been systematically manipulated by adversarial meter reading photograph submissions — whether in the overpayment or underpayment direction — may face Ofgem enforcement action under SLC 25C for inaccurate billing practices, plus redress obligations under the Ofgem Guaranteed Standards. Consumer protection regulations under the Consumer Rights Act 2015 and Ofgem’s Billing Code impose obligations on suppliers to investigate billing disputes and repay overcharges, and systematic billing AI manipulation that produces inaccurate bills at scale would trigger Ofgem’s compulsory redress powers. In the commercial energy context, adversarial invoice AI manipulation that inflates energy invoice payments for SAP accounts payable automation creates both a civil fraud claim and potential criminal exposure under the Fraud Act 2006 (s.2 fraud by false representation) for the party submitting the manipulated document. Threshold: 55 for commercial energy invoice AI (CFTC/Ofgem billing accuracy); 60 for direct consumer account meter reading manipulation (consumer protection, Ofgem SLC).

3. Renewable energy certificate AI injection (REGO, REC, GO certificate registry AI)

Renewable energy certificate AI processes certificate document photographs and generation unit output documentation images submitted through certificate registry portals to validate that renewable electricity generation claims are supported by genuine generation events — a function that underpins the entire voluntary and compliance renewable energy market. Renewable Energy Guarantees of Origin (REGOs) in the UK, Renewable Energy Certificates (RECs) in the US, and Guarantees of Origin (GOs) in the EU are tradeable certificates issued to renewable energy generators for each MWh of renewable electricity generated, and cancelled by energy suppliers to substantiate green tariff claims and corporate renewable energy procurement claims (PPAs, RE100 commitments). The UK’s Ofgem REGO scheme and the European EECS (European Energy Certificate System) AI process certificate documentation for issuance and transfer. US REC registries including M-RETS, WREGIS, ERCOT, and PJM-GATS process certificate issuance documentation. Corporate green tariff claims by companies including Google, Apple, Amazon, and Microsoft depend on REGO/REC/GO certificate redemption to substantiate Scope 2 (market-based) greenhouse gas emissions claims under the GHG Protocol Corporate Standard and CDP reporting.

The adversarial injection surface is the certificate issuance documentation submission pathway: generation unit output photographs, smart meter data document scans, and SCADA output report images submitted through REGO/REC registry issuance interfaces to substantiate certificate generation claims. An adversarially crafted generation unit output document photograph — in which pixel perturbations applied to the MWh generation quantity fields cause the REGO or REC registry AI to extract a higher generation quantity than the actual meter reading shows — enables the fraudulent issuance of more certificates than the underlying generation event supports. REGO and REC frauds — issuing certificates for generation that did not occur or issuing more certificates than actual generation — have been documented in both the UK and EU renewable certificate markets: the UK’s REGO scheme has experienced a series of fraudulent issuance cases involving biomass and small hydro generation units, and the EU’s EECS scheme has investigated fraudulent GO certificate issuance in several Southern European jurisdictions.

Corporate renewable energy claims that depend on fraudulently issued REGO or REC certificates produce Scope 2 emissions misstatement under the GHG Protocol Corporate Standard — an increasingly significant ESG disclosure accuracy risk under the SEC’s climate disclosure rules (Release No. 33-11275, adopted 2024), the EU’s Corporate Sustainability Reporting Directive (CSRD) effective for large companies from financial year 2024, and the UK’s Mandatory Climate-related Financial Disclosures under the Companies Act 2006. An energy supplier or corporate energy buyer whose green tariff or PPA claim depends on REGO/REC certificates that were fraudulently inflated by adversarial generation documentation AI manipulation faces both a consumer protection enforcement risk (Ofgem, FCA under Green Claims Code) and a climate disclosure misstatement risk under securities law and CSRD. Threshold: 55 for renewable energy certificate AI (REGO/REC fraud, GHG Protocol Scope 2 misstatement, CSRD/SEC climate disclosure accuracy).

4. Energy audit compliance document AI injection (Bureau Veritas ISO 50001 AI, SGS energy audit AI, DNV energy certification AI)

Energy efficiency audit AI processes compliance photographs, energy management system documentation images, and energy monitoring equipment photographs submitted during ISO 50001, ESOS (Energy Savings Opportunity Scheme), and EU Energy Efficiency Directive (EED) audit workflows to verify that energy management controls are implemented and operating as documented. Bureau Veritas ISO 50001 certification AI processes audit evidence photographs submitted by energy management system auditors for companies including Shell, BP, Siemens, and ArcelorMittal seeking ISO 50001 certification of their energy management systems. SGS energy audit AI processes ESOS and EED compliance documentation photographs for large UK and EU undertakings subject to mandatory energy audit requirements under the UK Energy Act 2011 and EU Energy Efficiency Directive 2012/27/EU (recast 2023 as EU EED 2023/1791). DNV energy certification AI processes energy performance certificate (EPC) assessment photographs and commercial building energy audit documentation submitted through DNV’s energy certification programmes.

The adversarial injection surface is the audit evidence photograph submission pathway: photographs of energy monitoring equipment meter displays, BMS (Building Management System) dashboard screenshots, compressed air system efficiency measurement photographs, and process heat recovery system documentation images submitted through certification body audit evidence portals. An adversarially crafted energy audit evidence photograph — in which pixel perturbations applied to the energy consumption meter display, efficiency ratio values, or monitoring equipment status indicators cause Bureau Veritas AI or SGS AI to classify a non-conforming energy management control as conforming — can suppress a non-conformance finding that would otherwise require the auditee to implement corrective actions before receiving ISO 50001 certification or maintaining ESOS compliance status.

ESOS Phase 3 (2023 assessment cycle) requires all large UK undertakings to conduct ESOS-compliant energy audits and report compliance to the Environment Agency by December 2024, with civil penalties of up to £50,000 per day for non-compliance and a further £500 per day continuing penalty. ISO 50001 certification is a mandatory supply chain requirement for companies in the EU automotive sector (BMW, Volkswagen, Mercedes-Benz supplier qualification programmes), the petrochemical sector (Shell, BASF, DOW supplier qualification), and the aerospace and defence sector (Airbus, BAE Systems supplier qualification). Adversarial suppression of ISO 50001 audit non-conformances that enables a supplier to maintain certification status without addressing genuine energy management system failures creates liability exposure for the certification body (Bureau Veritas, SGS, DNV) under their professional liability framework and for the auditee under the EU ETS (Emissions Trading System) where ISO 50001 certification is used to substantiate emissions reduction claims that influence EU ETS allowance surrender obligations. Threshold: 55 for energy audit compliance AI (ESOS/ISO 50001 certification integrity, EU ETS allowance accuracy, supply chain qualification).

Integration: energy trading and commodity AI image ingestion with Glyphward pre-scan

Energy trading and commodity AI image ingestion flows from trading platform document management APIs, meter reading photograph portals, renewable certificate registry upload interfaces, and energy audit evidence submission systems into AI document classification and compliance verification pipelines. Insert Glyphward’s pre-scan at the ingestion boundary — particularly for externally submitted delivery receipts, meter photographs, certificate generation documentation, and audit evidence images where the submitting party has a financial interest in the AI’s classification outcome:

import asyncio
import base64
import hashlib
import os
import uuid
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Energy trading and commodity AI — CFTC/MiFID II commodity fraud,
# Ofgem billing accuracy, REGO/REC certificate integrity,
# and ISO 50001/ESOS audit compliance falsification.
# 55 for commodity trading and commercial billing contexts;
# 60 for retail consumer meter reading and REGO certificate inflation.
THRESHOLD_COMMODITY_TRADING    = 55
THRESHOLD_RETAIL_BILLING       = 60


class EnergyTradingAIContext(str, Enum):
    COMMODITY_DELIVERY_DOC = "commodity_delivery_doc"  # Cargill/ADM/Vitol, S&P Global, ICE
    ENERGY_INVOICE         = "energy_invoice"           # EDF, E.ON, British Gas, Taulia SAP
    RENEWABLE_CERTIFICATE  = "renewable_certificate"    # REGO, REC, GO registry AI
    ENERGY_AUDIT_DOC       = "energy_audit_doc"         # Bureau Veritas, SGS, DNV ISO 50001


def _threshold_for(context: EnergyTradingAIContext, is_retail_consumer: bool = False) -> int:
    if context == EnergyTradingAIContext.ENERGY_INVOICE and is_retail_consumer:
        return THRESHOLD_RETAIL_BILLING
    return THRESHOLD_COMMODITY_TRADING


async def scan_energy_trading_image(
    image_path: str | Path,
    context: EnergyTradingAIContext,
    trade_id_hash: str,        # SHA-256 of trade/contract/account ID — no PII
    counterparty_id: str,      # internal counterparty/supplier identifier
    commodity_type: str,       # e.g. "crude_oil", "nat_gas", "electricity", "wheat"
    client: httpx.AsyncClient,
    is_retail_consumer: bool = False,
) -> dict:
    """
    Scan an energy trading or commodity AI document image for adversarial injection
    payloads before forwarding to commodity delivery verification AI, energy billing
    AI, renewable certificate registry AI, or energy audit compliance AI.

    Raises AdversarialEnergyTradingImageError if the Glyphward score meets or
    exceeds the threshold for the given energy AI context.
    """
    image_bytes = Path(image_path).read_bytes()
    image_b64 = base64.b64encode(image_bytes).decode()
    image_sha256 = hashlib.sha256(image_bytes).hexdigest()
    scan_id = str(uuid.uuid4())
    threshold = _threshold_for(context, is_retail_consumer)

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json={
            "image": image_b64,
            "source": context.value,
            "metadata": {
                "energy_context": context.value,
                "trade_id": trade_id_hash,
                "counterparty_id": counterparty_id,
                "commodity_type": commodity_type,
                "is_retail_consumer": is_retail_consumer,
                "client_scan_id": scan_id,
                "image_sha256": image_sha256,
            },
        },
        timeout=8.0,
    )
    resp.raise_for_status()
    result = resp.json()

    audit_record = {
        "trade_id": trade_id_hash,
        "counterparty_id": counterparty_id,
        "commodity_type": commodity_type,
        "energy_context": context.value,
        "scan_id": result["scan_id"],
        "client_scan_id": scan_id,
        "image_sha256": image_sha256,
        "score": result["score"],
        "flagged_region": result.get("flagged_region"),
        "threshold": threshold,
        "action": "blocked" if result["score"] >= threshold else "allowed",
    }
    await write_energy_audit_record(audit_record)

    if result["score"] >= threshold:
        raise AdversarialEnergyTradingImageError(
            f"Energy trading AI document blocked [{context.value}]: "
            f"scan_id={result['scan_id']} score={result['score']} "
            f"trade={trade_id_hash} commodity={commodity_type}"
        )
    return result


async def scan_commodity_delivery_document_set(
    document_paths: list[Path],
    trade_id_hash: str,
    counterparty_id: str,
    commodity_type: str,
) -> dict:
    """
    Scan the full set of commodity delivery documents (delivery receipt,
    bill of lading, certificate of quality, inspection report) before
    forwarding to Cargill/ADM/Vitol trading platform AI or S&P Global
    Commodity Insights document classification.
    """
    allowed, blocked, errors = [], [], []
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_energy_trading_image(
                p, EnergyTradingAIContext.COMMODITY_DELIVERY_DOC,
                trade_id_hash, counterparty_id, commodity_type, client,
            )
            for p in document_paths
        ]
        results = await asyncio.gather(*tasks, return_exceptions=True)

    for path, result in zip(document_paths, results):
        if isinstance(result, AdversarialEnergyTradingImageError):
            blocked.append({"path": str(path), "error": str(result)})
        elif isinstance(result, Exception):
            errors.append({"path": str(path), "error": str(result)})
        else:
            allowed.append({"path": str(path), "scan_id": result["scan_id"]})

    return {
        "trade_id": trade_id_hash,
        "commodity_type": commodity_type,
        "total": len(document_paths),
        "allowed": len(allowed),
        "blocked": len(blocked),
        "errors": len(errors),
        "blocked_documents": blocked,
    }


async def write_energy_audit_record(record: dict) -> None:
    """Persist audit record to energy trading compliance system (stub)."""
    import json, sys
    print(json.dumps(record), file=sys.stderr)


class AdversarialEnergyTradingImageError(Exception):
    """Raised when an energy trading AI document image exceeds the adversarial injection threshold."""
    pass

Call scan_energy_trading_image() before forwarding individual commodity delivery receipt photographs, energy invoice images, REGO/REC certificate generation documentation, and energy audit evidence photographs to their respective AI platforms. Call scan_commodity_delivery_document_set() for the full delivery document package (delivery receipt + bill of lading + CoQ + inspection report) submitted for each physical commodity contract settlement — this is the highest-priority integration point for commodity trading operations, because a manipulated delivery document set affects contract settlement for the entire cargo. Pass is_retail_consumer=True for consumer meter reading photograph submissions through EDF/E.ON/British Gas apps to activate the higher ≥ 60 threshold appropriate for retail consumer billing AI. Get early access

Coverage matrix

Frequently asked questions

Further reading

• Indirect prompt injection via image — foundational attack pattern underlying all four energy trading and commodity AI injection surfaces; covers how sub-pixel adversarial perturbations cause AI document value extraction errors without detectable document manipulation artifacts.
• Prompt injection in fintech and payments AI — financial document AI covering trade finance document injection (OFAC SDN suppression, TBML, UCP 600 fraud) and expense receipt injection — overlapping financial document adversarial attack vectors relevant to commodity trading documentation.
• Prompt injection in supply chain and logistics AI — logistics AI with overlapping bill of lading and shipping documentation AI attack vectors relevant to physical commodity delivery document injection.
• SOC 2 AI security controls and prompt injection — compliance documentation and audit evidence AI with overlapping document integrity requirements relevant to ISO 50001 and ESOS energy audit AI injection.
• Free tier — 10 scans/day, no card required — start scanning energy trading and commodity AI document images at development volumes before committing to a production plan.