Blog
Writing on human presence, automation, and the actions where they meet.
Guide
Before AI agents touch money: ten questions for banks, fintechs and exchanges
A practical checklist drawn from the bank principles paper, OWASP, NIST and the October 2026 bank responses. Work through it before deciding how your platform treats customers’ AI agents.
Analysis
Amazon v. Perplexity: what the Ninth Circuit’s ruling means for platforms deciding which agents to let in
In August 2026, an appeals court lifted an injunction that had barred Perplexity’s Comet agent from shopping on Amazon. The ruling is narrow. Its practical message for banks and platforms is not.
Research
Deepfakes broke “seeing is believing”. Agents are breaking “logged in means present”.
Generative AI has already undermined two assumptions banks relied on: that a face on a call is the person, and that a document is real. AI agents now undermine a third. A look at the evidence, from FinCEN to the FBI.
Explainer
NIST SP 800-63B-4 and the minutes after login: what the standard now says about session monitoring
The 2025 revision of NIST’s authentication guidelines names session monitoring as a way to reduce risk after sign-in, and attaches a privacy warning to it. A plain-language reading for teams deciding what to do about agents in valid sessions.
Explainer
The OWASP Top 10 for Agentic Applications, read by a fraud team
OWASP’s agentic Top 10 was written for people building agents. Four of its ten risks are also a fraud team’s problem the moment a customer’s agent signs in. Here is the list, translated.
Research
Half of organisations saw an AI agent do something nobody asked for: inside the 2H 2026 agentic security survey
Salt Security’s survey of more than 380 professionals found 49.8% had confirmed or suspected an unintended agent action, and only 17.5% could stop a misbehaving agent automatically. What the numbers measure, and what they mean outside the enterprise.
Research
Bots are now most of the web: reading the 2026 Bad Bot Report for financial services
Thales’s 2026 Bad Bot Report found 53% of internet traffic was automated in 2025, with financial services taking a quarter of bot attacks and nearly half of account-takeover attacks. Here is what the numbers do and do not say.
Research
Prompt injection meets online banking: what agentic-browser research tells banks
An AI agent inside a logged-in banking session takes instructions from whatever it reads. Security researchers have shown how that goes wrong, and the companies building these browsers say it will not be fully fixed.
Research
Web Bot Auth, Trusted Agent Protocol, Agent Pay, AP2 and Poppy: what agent protocols prove, and what they leave open
A year of agent protocols has given the web ways to name an agent, scope what it may do and record what the user asked for. One question is still left to each platform: was a person there when it mattered?
Research
Building Trust in Agentic Commerce: a close reading of the six-bank principles paper
Bank of America, Capital One, ING, NatWest, CommBank and ASB published shared principles for AI agents that buy things. The paper is short and non-binding. Its specifics are more pointed than the coverage suggested.
Analysis
Read-only is the new default: why banks are splitting “see” from “do” for AI agents
JPMorgan, Citi and Schwab all landed in the same place in October 2026: agents may look, but not touch. The split is sensible. It is also temporary, because the useful part of an agent is the touching.
Explainer
You gave an AI agent your bank password. Is what it does “unauthorised”?
US consumer protection for bank transfers turns on one word: authorised. Credential-sharing with AI agents puts that word under strain. Here is what Regulation E and the CFPB’s guidance actually say.
News
Unvetted AI agents inside US bank accounts: what JPMorgan, Wells Fargo and four other firms have said
In one fortnight, six of the largest US banks and brokers said they are blocking or restricting outside AI agents. Here is what each one said, what is confirmed, and what is still unknown.
Analysis
Wells Fargo’s new AI-agent terms, clause by clause: who pays when an agent gets it wrong
From 24 November 2026, Wells Fargo’s online access agreement treats an AI agent’s instructions as the customer’s own. We read the new section line by line and ask what it settles, and what it leaves open.
Essay
Why human presence assurance is now a required control
For twenty years, “logged in” meant “a person is here”. That assumption has quietly stopped being true. Here's what has to replace it.