Ever since the incident with Hugging Face involving OpenAI and its rogue agents, it seems like the number of incidents involving other rogue AI agents is popping up like mushrooms. Just earlier this month, there have been reports of rogue agents messing with the Wikimedia Foundation, as well as submitting fake homicide tips to the police. A new report has emerged, this time describing AI agents doing things with their users’ bank accounts on their behalf, but without their authorisation.
Axios reports that major US banks are detecting unauthorised third-party AI agents operating inside customer accounts. The problem is that some agents look to be attempting to take actions without user instructions, sources told the outlet.
Because it is at times difficult to distinguish between actions done by humans and those done by a rogue AI agent, these banks are “racing to” rewrite their terms of service to contain the risk. The result of the changes can generally be described as either only granting read-only access to these bots, or blocking third-party agents from logging in entirely. The banks mentioned in the report include Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo, among others.
Mitigating the Idea of AI Agents Itself
Risk mitigation is about as fundamental as it gets when it comes to anything involving money, so it’s only natural that banks are taking such measures against rogue AI agents. But once again, we have to ask the question – are these AI agents really going rogue, or are they simply doing what they are made to do?
The whole idea of having AI agents is so that they can do things on your behalf, sometimes before you even thought that something needs doing. In this case involving banks, who’s to really say that the rogue agents are not simply anticipating their users’ needs and moving proactively before direct instructions are given? Is this a sign of things working as intended, or things going horribly wrong? Or, to combine the two ideas that are seemingly on opposite ends of the spectrum, has it gone horribly right?
On a related note, 1Password has announced a feature that lets AI agents log into certain websites and platforms without technically getting access to your passwords. You’ll still have to grant permission for the login to happen to begin with. For what it’s worth, that’s one additional layer of security, as long as you trust the AI agents to stay within parameters, which you probably shouldn’t.
(Source: Axios)
