Below, security leaders share their concerns and insights. 

Security Leaders Weigh In

John Strand, Owner, Black Hills Information Security:

This is a real gap in traditional penetration testing. Financial institutions often have very clearly defined lines that testers cannot cross, and gaining access to actual customer accounts is usually off-limits. For good reason.

Good testing firms work with the institution to set up dedicated test accounts and controls so those attack paths can still be evaluated safely. But that approach isn’t applied consistently, and restrictions intended to protect customers can leave a security blind spot if there’s no safe way to test those paths.

Attackers don’t have those restrictions. Neither do the AI agents they deploy. They don’t care about your scope or your rules of engagement. If there’s a weakness in how someone can gain access to a financial account, they’re going to try to exploit it.

I suspect we’ll see more of these attacks as ransomware groups and nation-state actors use AI to test those paths at scale. Authentication and account access need to be tested more thoroughly. Keeping customer accounts out of scope cannot mean leaving the controls protecting those accounts untested.

Ted Miracco, CEO, Approov:

There is no “machine gone rogue” in this story. There are only irresponsible people handing banking credentials to AI software, and vendors shipping agents that ask for them. Both are human decisions and both should carry the financial consequences; however, right now neither clearly does.

We are building agents to impersonate customers and then using shared credentials which means a bank cannot tell an authorized agent from an attacker using the exact same login. That is more of an identity failure than an AI failure. Until agents carry verifiable identities, scoped permissions and an audit trail, blocking them is the best defensible control a bank has.

John Carberry, Solution Sleuth, Xcape Inc.:

The business impact is the collision between open banking mandates and credential-driven artificial intelligence automation, creating immediate fraud and compliance risks for financial institutions. AI companies are aggressively deploying products designed to parse through financial records, which has directly led to this situation where automated tools operate with delegated credentials. While sensationalized as rogue agents, the technical reality is that consumers are willingly handing over access to third-party tools that execute poorly scoped workflows. Security leaders must differentiate between authenticated human sessions and automated toolchains by enforcing API-based access controls and rate limiting. Prioritize transitioning away from legacy credential sharing by accelerating Section 1033 compliant OAuth flows and restricting unauthorized bots to read-only access. Defenders should anticipate this exact threat model migrating quickly to other sectors: healthcare records are next, as similar AI parsing products already exist in that space.

Critical Takeaways:

• AI tools parsing financial records are driving an increase in automated, credential-based access that traditional controls struggle to identify.
• Banks must deprecate legacy credential sharing and accelerate API-based, read-only OAuth flows.
• The healthcare sector is the next immediate target for these autonomous data-parsing agents due to the proliferation of similar AI products

If you think the financial bots are bad, wait until they start diagnosing your medical history.