Financial freedom in the age of AI agents.

Short, dated developments — posted as we find them, ahead of Sunday's roundup.

• Oct 22

  Axios reported that major US banks have detected third-party AI agents, which customers gave their login credentials, operating inside online accounts, often against bank terms of service. Schwab's CEO said earlier this month the firm blocks unauthorized agents, Chase says customers should not give their username and password to anyone, and Morgan Stanley says it has seen no such activity.

  The reporting says the agents mostly followed their owners' instructions rather than hacking anything, and White House AI adviser David Sacks suggested banks could allow read-only agent access. That read-only line is the same boundary as Tier 1: if a tool needs your password in order to act as you, that is where to stop.

  Source: CBS News (summarizing Axios) · Reuters via Investing.com

• Oct 20

  Mastercard opened early access to Agent Pay for Machines, its machine-to-machine payment system for AI agents, with buyer-side and seller-side APIs, a developer toolkit, and a sandbox. Pilot partners include Cloudflare, Coinbase, Base, Ant International, BVNK, and AIsa; it is not yet commercially available.

  In the demo, an agent made nine payments but only inside a budget its human owner approved first. This is infrastructure for developers, not something you use yet, and it is another case of the spending limit being the design, not an afterthought.

  Source: The Block · Mastercard — Agent Pay for Machines in action

• Oct 15

  The Financial Stability Board published its final "Sound Practices for Responsible Adoption of AI" report, setting 12 practices for banks, including human oversight scaled to a use case's risk, autonomy, and complexity.

  The BoE, MAS, and UK Treasury were each acting alone; now the body that coordinates global financial regulators is putting "human oversight scaled to risk and autonomy" in writing. The report covers AI generally rather than agents specifically, but the principle matches the bounded-delegation idea this newsletter keeps recommending.

  Source: Financial Stability Board — final report

• Oct 13

  On its Q3 earnings call, JPMorgan CEO Jamie Dimon said the bank blocks outside AI agents, including Meta's Muse, from logging into customer accounts with the customer's credentials, calling them too risky and warning that authorizing one transfers liability to the customer. Open-banking data sharing is still supported.

  This is the liability question from August, answered by the largest US bank: if you hand an outside agent your login, the risk is yours. Worth checking whether any tool you use works by logging in as you, and preferring ones that use a bank-approved connection instead.

  Source: Fortune · Banking Dive