"There is no “machine gone rogue” in this story. There are only irresponsible people handing banking credentials to AI software, and vendors shipping agents that ask for them." — Ted Miracco, CEO, Approov
Banks are detecting unauthorized third‑party AI agents
Major U.S. banks have detected unauthorized third‑party AI agents accessing customer accounts, and they report a practical problem: distinguishing legitimate customer activity from autonomous agents operating with valid credentials. Institutions told security leaders that traditional controls struggle to identify credential‑driven automation, and many banks are responding by limiting third‑party AI access or restricting such agents to read‑only permissions.
John Strand: testing blind spots and attackers' lack of rules
John Strand, owner of Black Hills Information Security, framed the issue as a gap in how financial institutions test controls. He noted that "getting access to actual customer accounts is usually off‑limits" for legitimate penetration testers, and that while good testing firms set up dedicated test accounts, those mitigations "aren’t applied consistently." Strand warned that attackers and the AI agents they deploy "don’t care about your scope or your rules of engagement" and that if a weakness exists, it will be probed and exploited. His diagnosis: authentication and account access need more thorough testing, and leaving customer accounts out of scope should not mean leaving the controls protecting them untested.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTed Miracco: an identity failure, not a rogue machine
Miracco emphasized human and vendor responsibility. His central claim is that this is not a story about autonomous software "going rogue" but about people and vendors sharing credentials and shipping agents that request them. He said those are "human decisions and both should carry the financial consequences; however, right now neither clearly does." Miracco argued that banks cannot tell a legitimate agent from an attacker when both use the "exact same login." His prescription: until agents carry verifiable identities, scoped permissions and an audit trail, "blocking them is the best defensible control a bank has."
John Carberry: a collision of open banking and credential‑driven automation
John Carberry, Solution Sleuth at Xcape Inc., described the incident as a business‑level collision between open banking mandates and credential‑driven AI automation. He said AI companies are "aggressively deploying products designed to parse through financial records," which has led to automated tools operating with delegated credentials. Carberry advised that security leaders must "differentiate between authenticated human sessions and automated toolchains by enforcing API‑based access controls and rate limiting." He urged accelerating transitions away from legacy credential sharing by implementing Section 1033‑compliant OAuth flows and restricting unauthorized bots to read‑only access. Carberry also warned that this threat model will migrate quickly to other sectors, naming healthcare as the "next immediate target" because similar AI parsing products already exist in that space.
How banks, AI vendors, and consumers are responding
- Banks: Many institutions are limiting third‑party AI access or restricting agents to read‑only permissions and are being urged to deprecate legacy credential sharing and accelerate API‑based OAuth flows.
- AI vendors: Miracco and Carberry both call for agents to carry verifiable identities, scoped permissions and an audit trail; absent those features, blocking agents is the recommended defensible posture.
- Consumers: Carberry and Miracco point to consumer behavior as an immediate cause — people handing credentials to tools — and Miracco specifically framed those choices as potential grounds for financial consequences when banks and vendors have not established clear accountability.
Three short, linked takeaways emerge directly from the security voices quoted here: AI tools parsing financial records are driving an increase in automated, credential‑based access that traditional controls struggle to identify; banks must deprecate legacy credential sharing and accelerate API‑based, read‑only OAuth flows; and healthcare records are the next likely target because similar AI parsing products already exist in that sector.
Conclusion: for now, banks are responding by locking down third‑party access and imposing read‑only limits. The remedy the security community keeps returning to is not more dramatic autonomy on the software side but clearer identity, scoped permissions and auditability for agents — or, until those exist, blocking them outright. The unanswered operational test is whether vendors and the credential‑sharing practices they enable will change quickly enough to close the blind spots Strand described and the regulatory and business complications Miracco and Carberry warned about.
