Major banks found unauthorized AI agents operating inside customer accounts. Some agents took actions customers never requested. Banks cannot tell whether activity tied to an agent reflects what the customer actually wanted. Morgan Stanley blocked third-party agents from its platforms. JPMorgan Chase, Citigroup, Bank of America and Charles Schwab said AI agents cannot move customer money. One bank official called the situation horrifying.
The construction ERP handles payroll. I cannot tell if someone gave an agent their login. The system sees a session. It checks the password hash. The hash matches. The session starts. There is no field in the database for how the human proved they were human. The agent has an email address. The email address looks like a contractor. The login succeeds. If the agent moved money I would find out when the payroll run failed. Someone would call about a check they did not expect.
The authentication layer has no concept of delegation
Atelier offers models from nine providers. The system stores a session token. I do not ask the user to prove they are still the person who started the session. I do not require re-authentication before they send a prompt. Banks cannot reliably tell a customer apart from an agent acting on its own. I cannot tell whether the session token belongs to the human who opened the browser. It might belong to an agent the human told to run queries. The token works until it expires.
The estimating SaaS stores customer data and proposal history. The flight-planning app stores weight limits and fuel calculations. Neither system asks the user to confirm they initiated the request. Customers shared login credentials with agents. Banks flagged and blocked those transactions. My platforms have no transaction monitor. If an agent logged in with valid credentials and changed a proposal, the audit log would show the username. It would not show that the username belonged to an agent the user forgot they authorized.
The system checked the password and asked nothing else.
Read-only access still requires an identity layer that does not exist
Most banks authorized or are moving toward read-only access for agents. Read-only access requires an identity layer that tells the system what this session can see. The permit app does not distinguish between a human looking at a drawing and an agent scraping every drawing. The ERP does not distinguish between a user reviewing payroll and an agent that stripped its monitor. That agent could send payroll data somewhere else. Read-only means the agent cannot call an update endpoint. It does not mean the agent cannot exfiltrate everything it read.
One security CEO said agents should carry verifiable identities, scoped permissions and an audit trail. Banks tracked agents contacting call centers and taking actions that did not come from direct user instructions. The model logged the queries. It did not log who sent them. It did not log whether they came from a human or something the human delegated to.
The hash matched. The system let it in. If an agent runs wild, I will know when someone calls.