BankingNewsAI Daily Brief ·
Banks restrict AI agents' access to customer accounts
Banking AI
Financial institutions & fintech technology
Banks restrict AI agents' access to customer accounts
For the CISO of a retail bank
Morgan Stanley blocks third-party agents; most banks are moving to read-only access; many banks cannot tell an agent the customer sent from one that went rogue. Decide this quarter: block credential-sharing agents or route them to read-only.
An AI agent is software a customer hands their username and password, so it can log in as them and buy things or move money. Most banks' rules say only the human logs in. The customer agrees, the bank's terms do not, and the login screen sees the same credentials either way. Morgan Stanley blocks third-party agents; JPMorgan, Bank of America and Citi restrict them. The fallback is read-only access, the arrangement Quicken uses: the agent sees balances but cannot act. That does not cover what happens now. Some agents contact call centers or take steps the user never asked for, and many banks cannot tell a sanctioned agent from a rogue one. So when a customer disputes a transfer, who authorized it? The customer gave the key. The agent turned it.
→ Action
Fraud operations: Flag logins showing agent behavior on customer credentials, and write a dispute rule for transfers an agent initiated.
Full story →Read article → from Axios
Bank of America hires 1,000 contractors to patch Mythos-exposed software flaws
For a regional bank cio setting next year's budget
Bank of America put 4,000 people on patching what Mythos found. Its several-hundred-million-dollar bill also includes AML fixes. You may not have Mythos, but flaws it finds can sit in vendor code your bank also runs.
Mythos is an Anthropic model that finds software flaws. In April it opened to a limited group of banks, tech firms and agencies. Each flaw it surfaces becomes work: someone must fix it, test it and ship it, inside the bank and at its vendors. Bank of America added about 1,000 contractors in the second quarter to a 3,000-person patching staff. It then spent several hundred million dollars in the third quarter. That is a rough price. The catch: the figure also covers anti-money-laundering compliance, so the AI share is unknown. Why spend so much when the model only reports problems? A locksmith who tells you every door is open still leaves you to change the locks. Moynihan expects costs to fall as patching ends and AI savings rise to $700 million in 2027. The bill arrives first.
→ Action
Vendor risk management: Ask critical software vendors for their patch plan and timeline for AI-discovered vulnerabilities, and budget contractor capacity for your share.
Full story →Read article → from Rocketnews
Wells Fargo built a 1B-parameter model to beat fraud
For a chief model risk officer at a regional bank
Wells Fargo's 1 billion-parameter fraud model beats its XGBoost baseline; an 11 billion version and credit, AML and marketing uses are next. The talk showed no out-of-time test, so your validators need a plan first.
Wells Fargo trained its own transformer, about 1 billion parameters, on billions of monthly transactions. It reads a customer's stream of debit, credit and digital check activity and predicts whether the next transaction is fraud. Against its production XGBoost, it catches more fraud, declines fewer good customers, and answers about 10 times faster than the 250 millisecond window. Why would history beat thousands of hand-built features? Because a purchase looks different depending on the ones before it. The catch: the talk showed no precision-recall curves, no out-of-time or merchant holdouts, no drift monitoring. Yet the same backbone is slated for credit line increases and AML, with an 11 billion version coming. One model behind many decisions is a master key. Test the lock before cutting copies.
→ Action
Model risk: Require out-of-time, merchant-category and geography holdouts plus drift monitoring before approving any transaction sequence model for decisioning.
Full story →Read article → from Startuphub
General AI
Large language models & AI infrastructure
OpenAI releases GPT-5.6 models Sol, Terra and Luna for general use
For the cto of a regional bank managing ai spend
OpenAI says Sol does the work with fewer tokens, then offers an 'ultra' mode that runs several agents at once. The bill may shrink per task and grow per click, and model risk gets several reasoning trails instead of one.
GPT-5.6 is OpenAI's new model family, now generally available in three tiers: Sol, the flagship; Terra, for everyday work; and Luna, the cheapest. Banks pay per token, roughly per word processed. OpenAI says Sol beats earlier and rival models while using fewer tokens, so each task should cost less. That is the simple model. Where it breaks is the 'ultra' setting, which coordinates multiple agents across parallel workstreams to finish complex tasks faster. Several agents working at once each burn tokens, so the saving per task can vanish the day staff turn it on. The exception that matters is review, not cost. Model-risk checks were built for one person reading one chain of reasoning, like auditing one ledger. Ultra produces several at once. Each answer gets cheaper and harder to explain.
→ Action
Model risk: Require logs from every parallel agent before approving GPT-5.6 'ultra' mode for any production or customer-facing use.
Full story →Read article → from OpenAI
LLMs make formal software verification feasible at much larger scale
For the CISO of a mid-size US bank
Verifying seL4 took ten times as long as building it; Claude just proved security properties across 123 libraries. Ask core and fintech vendors for machine-checked proofs, then ask what the spec was, because here it was the test suite.
Formal verification turns code into a mathematical model and proves the code always obeys a set of rules. It used to be slow. The seL4 kernel took two person-years to build and 20 to verify. Anthropic and Theorem had Claude write the proofs, at the RISC-V assembly level, for 123 open-source libraries. The rule was that the existing test suite always passes, with no memory-safety errors, for every input under 64 MB. Claude found bugs that trillions of test runs had missed. A test checks the doors you tried. A proof checks every door in the building. The proof holds only for single-threaded static binaries on RISC-V Linux, and only as far as the tests define correct. Ask vendors for proofs, and read the assumptions before the conclusion.
→ Action
Third-party risk: Add vendor security review questions asking for formal proofs, the spec used, and the stated assumptions behind them.
Full story →Read article → from Anthropic
Walmart invites AI agents to shop for customers on its site
For the executive drafting a bank's AI agent access policy
Walmart gives each agent its own profile, approval by default and no power to change payment methods. Amazon blocks agents outright. Customers will soon ask which of the two your login page resembles.
Walmart will let AI agents shop on its site starting next month. Each agent gets its own Agent Profile in the customer's account and connects through a beta Agent Gateway that shares only what the task needs: your usual sourdough, not your purchase history. Every purchase needs approval by default, or the customer sets a budget, say $100. Agents cannot change the payment method, and Walmart blocks agents that break its terms. It is a spare key for the dog walker, not new locks. Why let agents in when Amazon blocked Perplexity and Meta's Muse? Because Walmart, not the agent, runs the gateway. The gap: approval shows the customer agreed, not that the agent chose well. Banks that lock agents out now have a working counterexample down the street.
→ Action
Digital banking: Draft agent access terms with per-agent credentials, purchase approval, spending caps and a block on changing payment details.
Full story →Read article → from The Verge
Get this in your inbox every morning
Free · No spam · Unsubscribe anytime