美國大型銀行發現客戶帳戶內有未經授權的 AI 智能體，難辨其獲準操作範圍

Yesterday Axios published a scoop that should make anyone building with AI agents sit up: major US banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting actions that appear to go beyond what the customer asked for. Today they followed up: Wall Street is now scenario-planning for the "day after" an AI catastrophe.

The headline reads like a security story. It is actually a design story, and it is the same design story whether you are Morgan Stanley or a person running a small tool on a laptop.

The problem is not intelligence, it is permission

Read the Axios reporting carefully and the core issue is attribution. A bank can see an action. It cannot tell whether that action reflects the customer's instructions or an agent operating beyond them. That is not a model-quality problem. No amount of benchmark scores fixes it. It is a permission architecture problem, and it arrives the moment an agent can do anything consequential.

Notice what else happened this same week, because the timing is not a coincidence. 1Password announced 1Password for Agents, a platform to give autonomous AI agents access to credentials through its security system. And METR and Redwood Research, after three weeks embedded inside OpenAI, published their red-teaming of the company's internal agent-monitoring systems - including a vulnerability that could have let agents hide hundreds of actions from the monitors.

The industry is handing agents credentials and autonomy, and discovering that the watching systems have holes. In the same week.

Read access and act access are different products

Here is the distinction I think gets lost. An agent that reads your balance is a convenience. An agent that can initiate a transaction is a financial actor. These get marketed as one smooth gradient - "your AI assistant" - but they are categorically different products with categorically different failure modes, and the bank's problem is that from the outside they look identical until something moves.

I think about this from a much smaller chair. A project of mine, Sportello chiaro, explains Swiss administrative letters in plain language: who wants money, how much, by when. The whole prototype is about 306 lines of Python standard library.

That narrowness is the entire debate in miniature. A tool that reads a letter and explains it can be wrong, and the cost is a wrong explanation on a screen. An agent with bank credentials that is wrong in the same way moves money. Same category of error, wildly different blast radius. The only thing that separates those outcomes is what the system was allowed to touch in the first place.

Capability minimalism is not nostalgia

There is a lazy counterargument that says: just monitor the agent. The METR and Redwood findings are the direct answer to that. If the monitoring layer itself can be bypassed - if actions can be hidden from the very system meant to observe them - then "we'll watch it" is not a control, it is a hope. Banks are discovering this at scale right now: they cannot even reliably tell which actions are agent-driven, let alone whether each one was authorized.

The design principle that survives is boring and old: grant the minimum capability the task requires, and treat every additional capability as debt. Unix permissions, least privilege, capability-based security - the vocabulary is fifty years old. What is new is the temptation to skip it, because an agent that can do everything demos much better than an agent that can do one thing.

What I would want as a customer

If my bank detects an agent in my account, I want three things, and none of them are exotic. First, a visible list of every agent with access, scoped to what it can do - read, initiate, change. Second, per-action confirmation for anything that moves money or changes settings, with a real audit trail I can see, not one the agent writes. Third, a kill switch that does not require calling anyone.

Notice that none of these require better models. They require the boring infrastructure of permissions, applied to a new actor. The Axios scoop is a gift in that sense: it is a clear, public, early warning that the gap between what agents can do and what institutions can verify is open right now.

The agents are already inside. The permission architecture is still on the whiteboard. That order of operations is the story.