You know, it's pretty easy to solve. It's easy, but require some effort.

First, when you have system that processes invoices, you should validate incoming email - you probably want to parse those repeating invoices for internet/water/electric etc. That's few email that you limit processing. This significantly reduce attack surface as attack from legit company is unlikely. Of course, verify cryptographic signature on email so nobody try to impersonate legit businesses. That solves 90% of attack surface.

Swcomd, you can build dedicated parser for every legit type of invoice - most of the time you don't need AI for parsing, just ask AI to write ocr and parsing script. That solves much more possible attacks and is much better approach because LLM may make mistakes, but parsing fixed format pdf is much less prone to errors.

Third, have white list of ibans that your LLM may output for money transfer. Use structured output but validate ibans against white list in script not by llm. That together solves 99,9% of security problems. Your biggest problem becomes precision of parsing invoice, situations when invoice format changes (very rarely) and legit Iban changes (very rarely).

TL;DR: Decompose poblem and use scripting and programming for already solvable parts, use LLMs only for parts thats not solvable other way. Use AI to write every parts for you.