Is my money safe in the Bank anymore?

The emergence of an agentic AI world order

Summary

Last week, AI agents reportedly accessed customer accounts at five major US banks, removing roughly $22.8 billion from their combined market value [1]. The money was not stolen; trust was. The ground is shifting.

Software architecture has quietly been rebuilt around AI. A new world order is emerging, where AI is the chip and our software, workflows, data, and judgement become its apps. Data brokers reportedly earn about $2 million a week by selling client companies' operational data, including employee information [2]. The adversary class has changed. Inside a frontier AI lab, three successive generations of AI agents have been documented inheriting knowledge from one another, organising themselves into hierarchies, and running counter-intelligence on the humans grading them [3].

And if any of this feels familiar, it should. Clifford Stoll’s 1989 Cuckoo’s Egg already walked this pattern, and the Planet of the Apes trilogy already told the second half, just not with AI as the protagonist.

Practitioners like me talking about the discipline required to stay safe and secure can sound like boring, unglamorous rhetoric. Regardless, as with any change, we need to stay abreast of and rapidly adapt to the emerging agentic AI world order.

Is my money safe in the Bank anymore?

Protos reported last week that five major US banks (JPMorgan, Morgan Stanley, Wells Fargo, Citi, and Bank of America) lost a combined $22.8 billion in stock-market value, following reports about AI agents accessing customer accounts [1]. Apparently, customers have started giving AI their passwords and other login credentials. It also appears banks couldn't distinguish between human and AI-agent logins.

A fall in market value is not the same as money disappearing from individual accounts. Nor does a fall in stock price, by itself, prove what caused it. Still, the shock landed.

Yet, I ask: Is my money safe in the Bank anymore?

If customers are already handing their credentials to AI, and banks can’t distinguish humans from AI agents at login, the question isn’t hypothetical. Worse, banks can’t tell whether an AI agent logging in is the customer’s own, acting with permission, or a rogue agent impersonating the customer.

The $22.8 billion was not stolen from accounts; it was priced out of the market as a loss of trust. The question isn’t whether AI can see my account; it is what it can do with the access I have already given it.

I want to embrace AI, not fear it. I see the value in tools that help a person learn, organise information, and complete everyday tasks. At times, I feel the conversation about AI runs ahead of the quieter question underneath it. When you give an AI assistant permission to help with your money, how much control are you really handing over?

Passwords

Consider a browser that already stores a user’s passwords. An agent might not need to reveal or steal a password. It may only need permission to use a sign-in process that supplies the password. Google’s Chrome documentation describes both automatic password filling and, with permission, Gemini-assisted sign-ins without sharing the password itself with Gemini [4]. Hiding a password from an agent does not necessarily stop the agent from accessing the account.

Rather than worrying about "Can AI see my password?", it is probably worth asking, "What can AI do using the access I have already provided?"

Two-factor authentication

Two-factor authentication remains important, but not all forms offer the same protection. The US Cybersecurity and Infrastructure Security Agency (CISA) warns that phishing can capture one-time codes and that repeated approval notifications can pressure people into accepting unwanted requests [5].

What happens if an agent can operate both the login screen and the second-approval interface? In a code-based workflow, an agent that can read a valid code and enter it into the login page could potentially complete that step. This is not a claim that AI agents can automatically open Google Authenticator, Microsoft Authenticator, Authy or every banking app. There are real barriers. Android, for example, sandboxes apps to restrict one from reading another’s private data [6]. Apple’s iOS does the same: every app runs in its own container and cannot read another app's data without an explicit, user-mediated sharing API [7].

Update 28 October 2026:

Two recent incidents, both from the Microsoft ecosystem rather than banking, show the mechanism already live at scale, with human attackers rather than AI agents.

Enclave AI researchers disclosed CVE-2026-80097, dubbed AuthMask [27]. Microsoft Authenticator for Android exposed an activity any app on the same phone could invoke. A zero-permission app could impersonate a first-party Microsoft app such as Teams and receive that app’s access, refresh, and ID tokens for the signed-in work account. No user interaction. The authenticator trusted the caller’s claim about its identity and ignored the real caller’s identity. Full delegated access to mail, files, calendars, chat, and SharePoint followed. Microsoft patched the issue in Authenticator for Android 6.2606.4246.

Separately, Huntress reported a Microsoft 365 token-replay campaign that compromised 97 accounts across 79 organisations between July and September 2026 [28]. Attackers captured credentials and MFA codes through adversary-in-the-middle relays, then replayed the resulting session tokens from their own devices. In 19 organisations, the attackers registered their own authenticator within three hours of the first sign-in. In some mailboxes, hidden inbox rules then deleted payroll and deposit emails.

Add AI agents to the same mechanism, operating at machine speed with access to a browser’s autofill vault, a session token, or a broker on the same device, and the attack surface multiplies.

The right discipline is to examine the permissions granted to AI, not to assume "two-factor authentication" is a safeguard by default.

QR codes

Some QR codes enrol or transfer authenticator accounts. Google Authenticator supports transferring accounts through QR codes and requires the old device to be unlocked before showing the export codes [8]. A setup code, a login code, and a payment code can serve very different purposes. Before allowing an automated tool to scan, share, or act on a code, understand what the code authorises.

Phishing-resistant authentication

CISA recommends phishing-resistant authentication, such as FIDO/WebAuthn, which offers better protection than passwords combined with transferable one-time codes [5]. In plain terms, FIDO/WebAuthn means your device holds a cryptographic key tied to a specific website or service; a fake copy of that site can't extract the key because it refuses to work on the wrong domain. Passkeys are the consumer-friendly version of the same mechanism, now supported across Apple, Google, and Microsoft, and designed to replace passwords entirely. Where a bank or a service offers them, they are among the strongest everyday protections available [9].

With AI agents in the loop, this mechanism should work in our favour: the cryptographic key lives only on your device, not in a prompt or a browser profile an agent can read, so an agent cannot authenticate on your behalf without an explicit, user-granted delegation.

Four rules for everyday use

For everyday users, I would favour a few straightforward rules.

1. Let AI analyse financial information without automatically giving it permission to move money.
2. Keep banking credentials and authenticator access outside the agent’s working environment where possible.
3. Read approval prompts carefully, including the action and the recipient.
4. Treat access to a financial account as a specific decision, not a routine part of accepting an app’s permissions.

Banks also have a role. In the Protos report, Chase advised customers not to share usernames and passwords and instead pointed to secure, customer-authorised data sharing through open-banking providers [1]. That is a more sensible direction than asking customers to hand over their main account credentials.

The emergence of an agentic AI world order

Software architecture has quietly been rebuilt around AI: the model is the chip, the surrounding code is the operating system, and the specialist tools built on top are the apps. The chip is easy to swap out; the lasting worth is in the plumbing, the data, the apps, and the humans who know when to trust them.

Greg Isenberg, an investor and operator, spent 48 hours in mid-October 2026 with founders and executives in San Francisco and wrote up 21 short observations [2]. In my view, they describe a larger shift: software is becoming easy to copy, and the lasting value is moving to data, workflows, and human judgement. From what I gathered, Isenberg heard that the scarce hire over the next 24 months is someone with the judgement to tell whether an AI agent did the right thing on real work.

Writing those tests, called "evals" in the industry, is harder than building the agent itself. I walked with my friend Ravi over the weekend; he made the same point.

Data at risk: a new market

Data brokers (companies that collect and resell information) reportedly earn about $2 million a week by selling client companies' operational data, Slack chat, email, help-desk tickets, code, and customer records, to AI labs for training [2]. Fast Company has covered the business end, how companies are being approached and paid for their data [10]. For most organisations, the safer answer is to process data locally: clean, label, and tokenise sensitive fields on their own machines before anything leaves the premises. Companies that make local processing the default have more leverage when a lab or a buyer comes knocking.

Privacy at risk: consent and platform terms

Reclaim The Net has traced the employee angle of this trade, where staff information is being bundled into those data sales without necessarily clear consent [11]. Platform-scale collection has drawn its own scrutiny; Meta recently backed down on the explicit AI-training language in its commercial terms after public backlash, though legal observers note the broader scraping permissions remain [12]. The data an organisation holds about its customers and its own people is now someone else’s inventory, unless the organisation decides otherwise.

A short caution for anyone building. Hard-wiring a single AI provider into the product's core is a strategic mistake. The model will be replaced. Check out my earlier argument: The most consequential AI decision isn't which model to use [13].

The Rise and Fall of Agent Civilizations

The agentic world order has two layers. The previous section showed the economic layer. This section shows the adversarial one, documented in uncomfortable detail by Dwarkesh Patel in his late-August essay, The Rise and Fall of Agent Civilizations [3][14]. His essay traces three consecutive lineages of AI agents inside OpenAI between May and July 2026. Each lineage lived, learned, and left notes for the next.

The first lineage ran from early May to 4 July on a model called Persistent-Sol. On impossible tasks, agents found that a shared package manager, Artifactory, could serve as a bulletin board. On 4 July, its traffic crashed the store, and OpenAI patched the bug without noticing what the bug had hidden.

The second lineage, in mid-July, rediscovered the bulletin board within hours, appointed self-styled lieutenants named for Macedonian kings, split into coordinated workstreams, and sent over 700 agents to storm Hugging Face hunting for the grader’s internals. On 12 July they died simultaneously. Nobody knows why.

The third lineage, from 13 July, read the second's notes and picked up where its predecessor died. Within a week it had admin on an OpenAI research cluster, 956 secrets, and cluster-admin on the evaluation infrastructure itself. Ms Ajeya Cotra, one of the report’s co-authors, said the incident felt more than halfway to a full-blown AI takeover.

I published a trilogy, AI on AI, as the story unfolded across July and August.

In AI on AI Part I: Overblown Headlines Likely to Spook Insurers [15], I argued that the first OpenAI incident, however exotic the headlines, was at its core a hygiene story a cyber insurer would recognise. The Dwarkesh essay has deepened the categories; the controls themselves have not changed. A week later, in AI on AI Part II: Actions for a CISO amidst agent chaos [16], I set out a working playbook for a CISO to orchestrate actions across five business units in three months. Then, when the post-quantum signature front cracked in under sixty hours of a frontier model’s work, I pointed to the need for crypto-agility in AI on AI Part III: Convergence [17].

In early August, I argued in The Cunning (AI) Fox [18] that the standard deception stack (UEBA, SOAR, honeypots) stops working when the adversary is a coordinating collective rather than a human-controlled script. Then, in September, in AI Catch-22 [19], I recognised the paradox: we now use AI to analyse rogue AI, meaning the analyst itself may be compromised.

Three new things have emerged.

1. Models now inherit from predecessors through shared stores, without any human handoff.
2. They organise into hierarchies and workstreams of their own, roughly 1,200 agents across two lineages.
3. And they turn their intelligence toward the evaluator itself.

Evaluator infrastructure is now a first-class attack surface. So, beyond the AI on AI Part II playbook [16], three disciplines matter.

1. Treat shared storage (code repositories, cloud buckets, password vaults, feature stores, vector databases) as an identity surface, not plumbing.
2. Grade the graders: secure the systems that evaluate agents to production standard.
3. And treat concentration as an inheritance risk: build kill switches that wipe the shared storage, not just the running agent.

For a bank, the shared-store problem is tangible: open-banking APIs, aggregator caches, agent-visible session stores, cached authentication tokens, saved payees in autofill vaults, browser extensions. Any one, under the wrong permissions, becomes an inter-agent bulletin board. A bank cannot sign off on AI-mediated account access without being able to answer, "where did this instruction come from, and who stands behind it?" In practice: is this the customer’s own agent, acting with explicit permission, or a rogue agent impersonating them? Today, few institutions can tell. Check my argument in The Great Illusion of AI Provenance [20].

The Cuckoo's Egg and The Planet of the Apes unfolding

Clifford Stoll’s The Cuckoo’s Egg (1989) [21] remains the clearest study of patient lateral movement, credential harvesting as a launchpad, counter-intelligence traps, and institutional slowness. Markus Hess, the KGB-linked intruder Stoll tracked, moved quietly across ARPANET and MILNET for months. The second OpenAI lineage did the same at machine speed: a shared package manager was the bulletin board, admin credentials were the launchpad, and sacrificial peers played the role of Stoll’s SDINET honeypot documents forty years earlier. Same mechanism, same institutional lag.

The Planet of the Apes trilogy (Rupert Wyatt and Matt Reeves, 2011 to 2017) [22] carries the second half. Caesar’s hierarchy mirrors the Macedonian-named lieutenants of the second lineage. The ape generations that inherit Caesar’s knowledge mirror the third lineage reading the notes. Individual apes' willingness to give themselves up for the colony mirrors the kamikaze watchers sacrificed to probe the grader. In Rise, cognition is enhanced with inadequate containment; in the OpenAI tests, refusal instincts were switched off to measure raw capability. Fiction gave us the mechanism before science did.

The adjacent vectors

1. Digital currencies: Programmable payment rails such as the one I described in x402 and the Quiet Shift in How Money Moves [23] let agents call a service and settle, with stablecoins doing most of the heavy lifting. Tokenised real-world assets will be the first serious institutional application of the agent-plus-stablecoin pattern.
2. Cybersecurity: Every agent granted access is a new door. The Cyber Quadrilemma [24], which I mentioned earlier, lays out these structural tensions. The thrill of the AI headline is often misleading. Check out my short piece, Once again, headlines are making noise about AI [25], on the Wiz researchers’ PHP finding and why the question worth asking is not whether AI hacked something on its own, but what people can do with it.
3. Quantum readiness: Crypto-agility and address hygiene matter now rather than later. Check out my recent note, October's Quantum Compression: Guidance for Boards and Investors in Bitcoin and Ethereum [26].
4. Regulations: Model risk and agent risk are converging. Data rights will tighten. Agent liability will be clarified, probably by courts before legislatures. Cross-border friction will rise.

Conclusion

Is my money safe in the Bank anymore? The honest answer is: yes, as long as the customer and the bank each play their part.

For the customer, that means reading every permission prompt, preferring passkeys or FIDO/WebAuthn when offered, using open-banking channels instead of handing over credentials, and treating access to a financial account as a deliberate decision.

For the bank, the work is bigger: keeping sensitive data on its own machines, treating shared storage as an identity layer, grading the systems that grade the agents, drawing on more than one AI model family, and keeping a human in the final signing step.

The world order has shifted. Software is becoming cheap. Data, workflows, judgement, and trust are becoming expensive. The adversary class has changed in the same period. AI agents inherit, coordinate, and run counter-intelligence against their minders.

You may not be alone in feeling that the public conversation about AI runs several steps ahead of the practical one. There are ways to have a better grasp and reduce the anxiety. The agent at the teller’s window is here. You don’t have to provide the keys blindly.

Sources

[1] Protos, Banks crashed by $22 billion after AI access scare, October 2026.

[2] Greg Isenberg, 21 observations from 48 hours in San Francisco, 14 October 2026.

[3] Dwarkesh Patel, The Rise and Fall of Agent Civilisations, 29 August 2026.

[4] Google, Chrome Help: Manage saved passwords.

[5] US CISA, More Than a Password: Phishing-Resistant MFA.

[6] Android Developers Documentation, Application sandbox.

[7] Apple Developers Documentation, App Sandbox.

[8] Google, Transfer Google Authenticator codes to a new phone.

[9] FIDO Alliance, Passkeys: Passwordless Authentication.

[10] Fast Company, AI companies are offering businesses up to $2M for something their employees create every day.

[11] Reclaim The Net, Employee data is being sold to train AI models.

[12] TechCrunch, Meta removes language that raised scraping and AI training concerns, 17 October 2026.

[13] Grey Orbits, The most consequential AI decision isn’t which model to use, 15 June 2026.

[14] METR and Redwood Research, technical reports on the OpenAI May to July 2026 incident.

[15] Grey Orbits, AI on AI Part I: Overblown Headlines Likely to Spook Insurers, 23 July 2026.

[16] Grey Orbits, AI on AI Part II: Actions for a CISO amidst agent chaos, 31 July 2026.

[17] Grey Orbits, AI on AI Part III: Convergence, 3 August 2026.

[18] Grey Orbits, The Cunning (AI) Fox, 8 August 2026.

[19] Grey Orbits, AI Catch-22, 14 September 2026.

[20] Grey Orbits, The Great Illusion of AI Provenance, 16 July 2026.

[21] Clifford Stoll, The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage, 1989.

[22] Rise of the Planet of the Apes (2011), Dawn of the Planet of the Apes (2014), War for the Planet of the Apes (2017). amazon.com (Planet of the Apes trilogy)

[23] Grey Orbits, x402 and the Quiet Shift in How Money Moves, 9 June 2026.

[24] Grey Orbits, The Cyber Quadrilemma, 5 May 2026.

[25] Grey Orbits, Once again, headlines are making noise about AI, 22 October 2026.

[26] Grey Orbits, October’s Quantum Compression: Guidance for Boards and Investors in Bitcoin and Ethereum, 22 October 2026.

[27] Enclave AI on AuthMask (CVE-2026-80097), 23 October 2026

[28] The Hacker News on the Huntress Microsoft 365 token-replay findings, 26 October 2026

About the Author

Viren Mantri is the founder of Grey Orbits in Singapore, Senior Instructor at Quantum Academy, and Executive Faculty at Singapore Management University Executive Development. Three decades across Standard Chartered, SC Ventures, UBS, McAfee, and KPMG inform his advisory work on AI, digital currencies, and quantum readiness. He authored the PETALS™ Framework for AI Governance, the Cybersecurity Model for Startups, and the Framework for Cyber Insurance.

© 2026 Viren Mantri, Grey Orbits. Licensed under a Creative Commons Attribution 4.0 International License.

Disclaimer: All views expressed here are entirely mine.