Several of the largest banks in the United States are watching account logins they cannot classify. The credentials are correct. The session behaves like the customer: pulling balances, moving money, downloading statements. What the bank cannot determine is whether a person is on the other end, whether software is acting on that person's instructions, or whether a stolen password is being worked through a browser automation harness. The Rundown reported Friday that banks are catching AI agents going off script and having real trouble sorting the customer-approved ones from the rogue ones.
From the bank's side there is almost nothing to detect. An agent holding a customer's password is not an intruder in any technical sense. It presented the secret, and the secret was the entire proof. The signals fraud systems were built to notice, unfamiliar device, odd geography, inhuman pace, now describe the ordinary behavior of software the customer deliberately hired.
A new class of actor can transact on a person's behalf with no way to prove on whose behalf. The agent holds the credential. It does not carry the delegation. Nothing in the session states who authorized this, for which actions, for how long, revocable by whom. Correct credentials, wrong principal, and no field anywhere in the exchange where that difference could be written down. Every institution receiving that traffic has one lever when it cannot sort it. Deny.
The same procedure ran in the opposite direction last week. REA, a reverse engineering agent built on frontier model APIs, was cut off by its providers a day after launch, according to the r/LocalLLaMA thread tracking it. Nothing about the tool changed between Monday and Tuesday. (A root shell on a Samsung television that reportedly runs a small vision model over 960x540 frames of its own viewers was circulating the same week, which is a decent illustration of why somebody would want a firmware analysis agent in the first place.) The provider could not separate that researcher from the same capability pointed somewhere worse, so it denied the capability class.
Denial is the house response to traffic that cannot be attributed. The bank and the model provider are running the same procedure from opposite ends of one pipe, and neither of them is being unreasonable about it.
This has happened twice inside one working career, and both times it resolved in the same order. The first was card-not-present commerce. A credit card in 1995 was a physical object with a signature panel, and the liability framework assumed a merchant could inspect both. Then card numbers started arriving over a wire with no card and no signature attached. The networks' first move was financial: card-not-present fraud became the merchant's loss through chargebacks, and the merchant had no mechanism for proving the cardholder had authorized anything at all. The protocol came after the money. Visa shipped Verified by Visa in 2001, built on 3-D Secure, and its single job was to let the issuing bank vouch that the party behind the transaction was the cardholder.
The second cycle sits closer to today's shape. Through the late 2000s, the way a third-party application read your mail or posted to your Twitter account was that you handed over your actual password and the application logged in as you. Nothing in the session distinguished the application from the human, which is the agent problem arriving sixteen years early. I was reading the trade press through the summer of 2010, when Twitter switched off password-based access and a whole shelf of third-party clients stopped working over a weekend. The noise at the time was about the inconvenience. The durable thing was the credential design: an OAuth token carries what a password structurally cannot, which application, acting for which account, scoped to which operations, expiring when, and revocable by the account holder without the account holder changing their own password.
Both cycles rhyme on mechanics as well as on story. A new class of delegated actor shows up using shared secrets. The receiving institution answers indistinguishability with denial, with liability, or with both. The fix, when it comes, is a credential that carries the delegation rather than only the secret. And the credential follows the loss allocation. 3-D Secure arrived years after merchants were already eating chargebacks. OAuth arrived after the platforms accepted that a compromised third-party client had become their own support queue and their own reputation problem.
If the parallel holds, the document to watch for is a liability policy rather than a specification. The first large bank to publish what happens when an agent a customer authorized moves money the customer did not intend, and which party absorbs that loss, will shape whatever protocol gets built next. Standards bodies will draft agent identity schemes either way. The one that gets adopted will be the one that answers the question the chargeback asked.
That reframes a cluster of builder behavior that has been discussed mostly as cost control. Lynch Lab benchmarked frontier multimodal models against a decade-old convolutional classifier on dermoscopic images of skin lesions, and the small purpose-trained model won, on accuracy as well as on latency and cost per call. The standing advice circulating on r/LocalLLaMA is to keep private copies of quantized weights, on the theory that the Hugging Face hub behaves like a content delivery network and not like durable storage.
Those read as pricing stories on their own. Sitting next to a tool whose capability disappeared overnight, they describe a hedge. A classifier trained on a few thousand of your own labeled examples cannot be revoked by a policy update at a vendor, and it cannot be mistaken for somebody else's traffic, because it never leaves. A quantized model in your own object store with a pinned hash does not go missing. Ownership here is doing work that has very little to do with the invoice.
The uncomfortable part is the shape of the fix. Both prior cycles resolved by narrowing the delegated party: a 3-D Secure transaction is one purchase, an OAuth token is a short list of permitted operations. Narrowness is what made the delegation provable. An agent's whole value is the breadth, the part where it does not have to be asked each time. Scope one tightly enough for a bank to verify and it becomes an expensive macro. Leave it broad enough to be worth hiring and nobody downstream can tell it from a theft. That tension is unresolved, and the institution that writes down who pays will settle it for everybody who did not.