The views expressed in this article are those of the author and do not necessarily reflect the position of CoinGeek.
TL;DR: Axios reported on October 22 that major U.S. banks are finding AI agents inside customer accounts and cannot tell whether those agents are acting on the customer’s instructions. Per Axios, they are generally logging in with the customer’s own password, which means the banks have an identity problem, not a robot problem. Give every agent its own key and a signed, scoped grant from the customer, check both before the money moves, and the ban becomes unnecessary.
Key Takeaways:
On the morning of October 22, Madison Mills at Axios dropped a scoop that should have every bank fraud desk in America reaching for the antacids. “Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources tell Axios.”
Morgan Stanley (NASDAQ: MS) is blocking third-party agents; JPMorgan (NASDAQ: JPM), Bank of America (NASDAQ: BAC), and Citi (NASDAQ: C) are restricting them; and, per Axios, bank executives “described the situation as horrifying.” A Chase spokesperson offered the advice your grandmother already gave you: customers should not give their usernames and passwords to anyone.
Here’s the rub, dear reader: they already did. On purpose.
Further down, Axios explains how the agents got in: “These are generally situations when an agent or AI assistant accesses a human’s account with the user’s permission and login credentials.” The customer handed over the keys because the customer wanted the chores done, and decided a robot was a fine stand-in. Rules replaced with convenience.
So the banks now say they “are broadly not able to parse whether agent account activity is user-directed.” One executive told Axios they “struggle to differentiate between agents, as well as whether an agent has been authorized by a user or has gone rogue.”
Of course they do. What the banks have is less a rogue AI problem and more an identity problem that their own login page was built to have. A username and password are bearer credentials: whoever holds it IS the customer, as far as the bank can tell, whether that is you, your agent, or a stranger who phished you last Tuesday. Blocking agents by IP range and rewriting the terms of service treats the symptom. The cure is full Know Your Agent: every agent carries its own cryptographic identity and a signed, scoped grant from the human it works for, and the bank checks both BEFORE the money moves. No signed grant, no action.
Sigma Auth, built by Open Protocol Labs (I co-founded it, so discount me as a shill if you must, but this KEEPS COMING UP!), already does this, with identities anchored on BSV.
Worse Options
Haseeb Qureshi of Dragonfly read the scoop as the banks’ cover story. On September 27, Apollo Global Management’s chief economist Torsten Slok asked, “Is an Agentic Bank Run Coming?” His slide warned that agentic assistants “could soon sweep household cash automatically into accounts paying 3.3% to 5.0%, instead of the 0.1% national average on checking accounts.” Haseeb says a bank facing that has three ways to keep its cheap deposits: raise rates (“lol no”), make fewer loans (“no fun”), or ban the agents as a security risk (“ding ding ding”). <!– lint:allow doubled-word –> He points to Jamie Dimon on JPMorgan’s October 13 earnings call: “We’re not going to allow just any outside agent to come in inside the company because that’s just too risky for clients and for JPMorgan.” And he notes the fix they chose was never “here’s a safe API for agents.” It was “no agents ever.”
On motive, I think he’s right, or at least right enough that the banks should be nervous. Somebody said it out loud. His own figures (0.2% on deposits against a risk-free rate near 4%) are his to defend.
For users, he writes, the answer is local agent frameworks like Hermes that the banks cannot block, because “if the agent is running on your own computer, they can’t actually tell it’s not you.”
That is the exact problem Axios just described, taking a victory lap.
An agent that the bank cannot tell from you is also one that the bank cannot tell from the guy holding your stolen password, which makes being indistinguishable from a human a bug the agent crowd is bragging about. The customer should WANT the bank to know it is their agent, carrying their signed permission, because then the sweep to the better yield is legal, boring, and impossible to block on the merits. The bank gets a counterparty it can name, rather than a bot in a trench coat.
“If rogue agents liquidate hundreds of billions across millions of accounts, the AI company would go bankrupt and you wouldn’t get made whole,” Governor Ron DeSantis wrote. Criminal liability for AI executives, he added, is “necessary but completely insufficient.”
He’s right, and if the courtroom always arrives too late, the control has to sit at the moment of the transfer, which is an authorization check and not a lawsuit. On October 19, I wrote here about finding a defendant under the Hawley and Murphy bill. Check the signature at the door, and you rarely need a defendant at all.
Chamath Palihapitiya predicted the order of events. Terms of service and blocking come first, “Not because the value is low but because the risk is high,” and after that, “we will need to find a security and governance architecture that will get external auditors comfortable.” Then the line I’d frame it as: “These are the practical issues of human risk tolerance in AI diffusion that model capability can’t solve.”
Correct. A smarter model does not make the login page any smarter, and the architecture he is waiting for (identity, plus signed delegation, plus a record nobody can quietly rewrite) already exists.
What the auditors get to read
The agent holds a keypair generated on the machine that will act, and the private key never travels. Its public identity is published via BAP (the Bitcoin Attestation Protocol), with the attestation hashes anchored on BSV rather than sitting in some vendor’s database. Every request is signed with that specific request, so a captured signature authorizes nothing else, and anyone can verify it against the public key without calling home to anyone.
Sigma’s own explainer has the line: an API key “proves that whoever holds it was given it at some point. It does not prove who holds it now.” Swap your online banking password in for the API key, and you have the Axios story in two sentences.
The customer’s own BAP identity then signs a delegation to the agent, which the Sigma documentation calls “wallet-signed delegated authority.” A bank would scope that grant the way it scopes a power of attorney (which accounts for how much, until when), and the agent’s request carries both signatures. The agent also carries BRC-52 certificates, acquired through a BRC-100 wallet (organization membership, provider assurance, and a BAP wallet binding), that identify who stands behind the software. As the explainer puts it, “KYC answers who the customer is. KYA answers what the software is, and who stands behind it.” Sigma Auth speaks OAuth 2.1 and OpenID Connect, so a bank’s existing stack keeps working.
Now the “rogue” question has a yes-or-no answer: does this signed request match a live grant from this customer? Today, “rogue” is a feeling a bank executive has; tomorrow, it can be a failed signature check.
A leaked key authorizes nothing new, because each signature covers one request, and the signed, timestamped trail is what Chamath’s auditors read, what DeSantis’s prosecutor reads, and the reason the prosecutor rarely gets the call.
Why not just let the agents look?
But Kurt, aren’t the banks already building the sensible middle ground?
Sort of. Most banks, per Axios, “have authorized or are moving in the direction of allowing read-only access,” the same arrangement they already give apps like Quicken. Very “2004” of them…
Nobody hires an agent to look at their money; they hire it to move the money to the 3.3% account. A bank that offers only read-only access will watch Haseeb’s prediction come true one local agent at a time, each one indistinguishable from the customer. That is less a spending problem than a naming problem. Give the bank the one thing it says it lacks, the ability to tell an authorized agent from a stolen password, and the ban becomes unnecessary.
So, for the bankers and the people building agents, three moves: require a key per agent, never a shared password; require a scoped delegation, signed by the customer’s own identity, on every request that moves money; and verify both against a public record the bank does not control, keeping the signed trail.
The banks told Axios, “the risks of being too permissive are too high.” Fine. Then stop being permissive with passwords and start being strict with signatures.
Everything else is a terms-of-service update and a prayer.
No signed grant, no action.
FAQs:
Why are banks blocking AI agents?
Banks like Morgan Stanley and JPMorgan can’t tell whether agents in customer accounts are following the customer’s instructions. Blocking is their current way to limit that risk.
How are AI agents getting into bank accounts?
Customers give agents their own usernames and passwords. To the bank, the login looks identical to the customer, so it can’t separate a trusted agent from a rogue one.
What is Know Your Agent (KYA)?
Every AI agent carries its own cryptographic identity plus a signed, scoped permission from its human. KYC says who the customer is; KYA says what the software is and who backs it.
Why is a shared password a problem for AI agents?
A password is a bearer credential: whoever holds it is treated as the customer. It can’t show who is using it now, so banks can’t spot fraud.
What is Sigma Auth?
Sigma Auth, from Open Protocol Labs, gives each agent its own keypair and a customer-signed delegation, anchored on BSV. It supports OAuth 2.1 and OpenID Connect.
In order for artificial intelligence (AI) to work right within the law and thrive in the face of growing challenges, it needs to integrate an enterprise blockchain system that ensures data input quality and ownership—allowing it to keep data safe while also guaranteeing the immutability of data. Check out CoinGeek’s coverage on this emerging tech to learn more why Enterprise blockchain will be the backbone of AI.
This opinion piece is published to encourage discussion. The author’s views are their own and do not constitute legal, procurement, or policy advice, nor do they represent the positions of CoinGeek or its partners.
Watch | Blockchain + AI: Unlocking Web3’s Future
Be the first to comment