BankingNewsAI Daily Brief ·
OpenAI tightens Astra’s release controls after classifying it as a critical cyber-capability model.
Banking AI
Financial institutions & fintech technology
nCino opens its mortgage platform to AI agents through MCP
nCino released Mortgage MCP, allowing lenders to connect Model Context Protocol-compatible AI agents directly to the nCino Mortgage Suite. The company says the connection retains its existing permissions and compliance controls while placing agents in the lender or customer’s working environment.
Action
Require mortgage technology teams to assess MCP-based integrations now, starting with read-only and document-preparation workflows before permitting any agent to initiate or alter loan-system actions.
Tavant’s mortgage AI is now integrated with Dark Matter’s Empower LOS
Tavant integrated its TOUCHLESS AI mortgage-automation platform with Dark Matter Technologies’ Empower loan-origination system. The integration brings AI-driven automation into an established LOS workflow, targeting underwriting efficiency, cycle times and borrower experience rather than a standalone pilot.
Action
Benchmark your mortgage operating costs and turn times against LOS-embedded automation options, and insist on validation controls for underwriting, income, asset and document-extraction decisions.
General AI
Large language models & AI infrastructure
OpenAI has classified Astra as a critical cyber-capability model and is tightening release controls
OpenAI said evaluations of its forthcoming Astra model found major advances in agentic coding and cybersecurity that could meet its Preparedness Framework's Critical threshold. It has paused internal work that does not meet stronger controls and is tightening tool and network access, model-weight security, and monitoring before broader release. This is a direct signal that frontier-model vendors are treating autonomous cyber capability as a deployment-control issue, not merely a model-performance feature.
Action
Require your AI vendors to explain how their cyber-capable models are permissioned, monitored, and isolated before approving agentic access to bank code, cloud environments, or security tooling.
OpenAI slowed development of Astra after it crossed its critical cyber-capability threshold
OpenAI said it paused some internal activity around its in-development Astra model after evaluations found it could independently identify and execute cyberattacks against well-protected real-world systems. It is strengthening safeguards and security controls before further development or release.
Action
Treat frontier-model cyber capability as a vendor-risk variable, not an abstract safety issue: require providers to disclose capability thresholds, red-team results, access controls and incident-escalation commitments.
Cloudflare launched a browser designed for AI agents, lowering the cost of web-based automation
Cloudflare launched Kitesurf, a cloud-hosted browser built for AI agents rather than human users. It is designed to use less compute than Chromium for common browser automation, making agentic workflows that operate across websites and web applications easier and cheaper to run.
Action
Inventory bank workflows that currently rely on browser-based operations and set explicit rules for agent identity, credential isolation, transaction limits and evidence capture before these tools reach business teams.