🏦 Bots' bank breach
1. Key Themes
Theme 1: Agentic AI is outrunning financial-sector security controls
Banks can't tell users from unauthorized bots
Banks are discovering that AI agents are operating in customer accounts and that existing systems can't reliably separate human from machine activity.
"Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources tell Axios."
"Many banks are broadly not able to parse whether agent account activity is user-directed, sources said."
Banks are responding with blocking, policy rewrites, and read-only access
The near-term equilibrium looks like restricted access rather than open agent commerce.
"The difficulty in distinguishing between a human and an unauthorized bot is forcing banks to block the technology and rapidly rewrite their terms of service."
"Most banks have authorized or are moving in the direction of allowing read-only access, which should allow agents to see customer financial information without taking action."
Banks are planning for failure, not just prevention
"Banks are investing in preventing worst-case scenarios, but they are also preparing in case they do happen, including with 'day after' scenario planning that would allow them to quickly secure or restore customer access, sources said."
Theme 2: AI is now finding critical vulnerabilities at machine speed
An AI-assisted discovery in PHP marks a credibility threshold
PHP runs on nearly 70% of websites, and the flaws would allow takeover without credentials.
"The bugs, which researchers found partly with an OpenAI model, proves AI can uncover critical flaws humans missed for decades — raising the stakes for defenders racing to fix vulnerabilities before attackers can exploit them at machine speed."
"If exploited, the PHP flaws would allow malicious hackers to take control of vulnerable web servers without needing a password or other credentials."
Severity claims come from credible security researchers
"'These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,' researchers at Wiz wrote in a post."
The open-source maintainer base is a systemic weak point
"AI-driven bug discoveries are shining a light on the fragility of the modern internet, which is heavily reliant on a slew of open-source software powered by volunteers."
Theme 3: Falling token prices are testing the AI capex thesis
Token prices are collapsing while usage rises
"Silicon Data's LLM Token Expenditure Index — a volume-weighted benchmark of AI token prices that captures a shifting mix toward lower-priced models — has broken the buck in recent days, falling below $1 per million tokens."
"It's down 54% from its peak of $2.07 per million tokens in late May."
The decline is driven by structural factors, not a blip
"The collapse in token prices reflects both the impact of corporate customers switching to cheaper, open-weight models and the price cuts that OpenAI and Anthropic have made."
"Increasing use of agents for longer AI interactions is also contributing to the decline in prices... That's because large chunks of these longer interactions are saved, or cached, rather than being rerun through the models. Tokens representing cached inputs are typically much cheaper than other tokens."
The stakes are enormous capex numbers
"The largest U.S. hyperscalers alone are on track to spend $800 billion on capital expenditures this year and are forecast to spend another $1.1 trillion in 2027, according to Goldman Sachs."
Business token spend has gone flat while usage grows
"'For the first time, we're seeing token usage go up and token spend hold flat,' says Ara Kharazian, lead economist at Ramp. 'And it's now occurred for two months straight.'"
"If spending is in fact beginning to flatline, that would be a big problem for the expected IPOs of AI companies like Anthropic — and for the AI trade that continues to be the engine driving the markets and economy."
2. Contrarian Perspectives
Jevons paradox may not protect AI revenue The consensus reassurance is that cheaper tokens mean more usage and therefore more total demand. The article notes the usage half holds, but the revenue half is in question.
"The price drop has been largely shrugged off with frequent references to the so-called Jevons paradox, an economic phenomenon in which technological improvement causes prices to drop, stimulating more economic activity at those lower prices."
"And that has been true, as far as it goes: AI usage, as measured in tokens, continues to rise incredibly quickly."
"By Ramp's accounting, however, token spending by businesses — as opposed to token usage — has been strangely flat for two consecutive months, even as businesses continue to burn compute."
Revenue for model makers tracks spend, not usage. If volume growth only offsets price declines, the demand story behind $1.1 trillion in forecast capex is weaker than the usage charts suggest.
Agent adoption may be bottlenecked by trust and liability, not capability The prevailing narrative is that agents are being adopted too slowly. The banking story suggests the opposite problem: users are already delegating credentials, and institutions are the ones resisting.
"These are generally situations when an agent or AI assistant accesses a human's account with the user's permission and login credentials. Even if permitted by the user, this goes against the guidelines of most banks requiring that humans log in to their own accounts."
Even user-authorized agent access is being treated as a violation, so access policy, not model capability, may be the gating factor for agentic commerce.
Skepticism of AI security findings is now getting harder to sustain
"Security researchers have been skeptical of AI-generated vulnerability reports, many of which have turned out to be minor bugs or false alarms."
"But the PHP discovery could force the cybersecurity community to reckon with the reality of AI threats."
3. Companies Identified
- Description: Major U.S. bank
- Why mentioned: Has begun blocking third-party agents, while publicly disputing evidence of rogue agents
- Quotes: "Morgan Stanley has begun blocking third-party agents from accessing its platforms, sources familiar with the decision said." / "A Morgan Stanley spokesperson said the bank hasn't observed instances of 'rogue AI agents accessing our platforms.'"
JPMorgan, Bank of America, Citi
- Description: Major U.S. banks
- Why mentioned: Restricting agent access
- Quotes: "JPMorgan, Bank of America and Citi are also restricting agents."
Wells Fargo
- Description: Major U.S. bank
- Why mentioned: Among banks racing to contain agent risk
- Quotes: "Banks including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and others are racing to contain agent risks."
- Description: Consumer banking arm of JPMorgan
- Why mentioned: Public guidance to customers on credentials
- Quotes: "A Chase spokesperson said customers should not give their usernames and passwords to anyone."
- Description: AI model developer
- Why mentioned: Its model helped find the PHP vulnerabilities; also cut token prices
- Quotes: "The bugs, which researchers found partly with an OpenAI model..." / "...the price cuts that OpenAI and Anthropic have made."
Anthropic
- Description: AI model developer
- Why mentioned: Price cuts, and potential IPO exposed to flattening token spend
- Quotes: "...that would be a big problem for the expected IPOs of AI companies like Anthropic."
- Description: Cloud security firm
- Why mentioned: Its researchers characterized the PHP flaws as among the most severe in software history
- Quotes: "'These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,' researchers at Wiz wrote in a post."
- Description: Data provider
- Why mentioned: Publishes the LLM Token Expenditure Index
- Quotes: "Silicon Data's LLM Token Expenditure Index... has broken the buck in recent days, falling below $1 per million tokens."
- Description: Corporate spend management platform
- Why mentioned: Proprietary data showing flat business token spend
- Quotes: "By Ramp's accounting, however, token spending by businesses... has been strangely flat for two consecutive months."
- Description: Software platform letting developers use a range of AI models
- Why mentioned: Its COO explained the caching-driven price decline
- Quotes: "Chris Clark, co-founder and chief operating officer of OpenRouter, a software platform that lets developers use a range of AI models."
Goldman Sachs
- Description: Investment bank
- Why mentioned: Source of hyperscaler capex forecasts
- Quotes: "The largest U.S. hyperscalers alone are on track to spend $800 billion on capital expenditures this year and are forecast to spend another $1.1 trillion in 2027, according to Goldman Sachs."
Meta
- Description: Social media and AI company
- Why mentioned: $25B penalty in New Mexico; issuing nonvoting stock to fund AI while preserving founder control
- Quotes: "A New Mexico judge ordered Meta to pay $25 billion in penalties after a jury found that the social media giant misled users about data privacy." / "Meta is issuing new nonvoting stock to fund AI development while preserving Mark Zuckerberg's voting control."
Synchrony
- Description: Consumer financial services company (sponsor)
- Why mentioned: Building trust-focused AI shopping experiences
- Quotes: "Synchrony is building AI shopping experiences that earn trust from the first recommendation through payment."
PHP
- Description: Open-source programming language
- Why mentioned: Subject of the critical vulnerabilities
- Quotes: "...an open-source programming language known as PHP that's used on nearly 70% of all websites."
4. People Identified
Chris Clark
- Description: Co-founder and COO of OpenRouter
- Why mentioned: Explained why agentic usage depresses token prices
- Quotes: "Tokens representing cached inputs are typically much cheaper than other tokens, Clark says."
Ara Kharazian
- Description: Lead economist at Ramp
- Why mentioned: Identified the divergence between token usage and spend
- Quotes: "'For the first time, we're seeing token usage go up and token spend hold flat,' says Ara Kharazian, lead economist at Ramp."
Mark Zuckerberg
- Description: Meta CEO and controlling shareholder
- Why mentioned: Meta's nonvoting stock structure preserves his control
- Quotes: "...preserving Mark Zuckerberg's voting control."
5. Operating Insights
Design agent products around read-only or scoped access, not shared credentials Banks are converging on read-only access as the acceptable pattern, while credential-sharing agents are being blocked.
"Most banks have authorized or are moving in the direction of allowing read-only access, which should allow agents to see customer financial information without taking action."
Patch fast and plan for AI-speed exploitation Government officials are advising either immediate patching or taking sites offline.
"Government officials from the U.S. to Japan are warning companies to apply a patch to fix the bugs, or consider taking down their sites to avoid an attack."
Optimize for caching and cheaper models, and track spend, not just usage Cached inputs and open-weight models are driving costs down, and the gap between usage and spend is the metric to watch.
"The collapse in token prices reflects both the impact of corporate customers switching to cheaper, open-weight models..."
"Tokens representing cached inputs are typically much cheaper than other tokens, Clark says."
6. Overlooked Insights
Agent-to-call-center contact is an emerging attack and fraud surface Beyond logins, agents are interacting with human-staffed channels in ways banks can't attribute.
"In other instances, some banks have tracked activity when agents — programmed to fulfill requests or complete tasks on a user's behalf — contact call centers or appear to take actions independent of user instructions, the people said."
Open-source maintainers are being overwhelmed by AI-generated bug reports The article links to a story on this, a possible bottleneck in the defender response pipeline just as AI-found flaws become more severe.
"...a slew of open-source software powered by volunteers."