# Agents at the Bank Door Published: 2026-10-16 Canonical: https://agidreams.us/edition/agents-at-the-bank-door Content-Complete: true The biggest bank in America just drew a line every security team has been waiting for someone with a balance sheet to draw. JPMorgan Chase will not let outside AI agents log into customer accounts and act on their behalf, CEO Jamie Dimon told analysts, because "it's just too risky for clients and for JPMorgan." His phrasing was blunter than the usual earnings-call hedge: "You don't want rogue agents, and it could be thousands of them." The bank will not let third parties obtain customers' banking credentials and log in for them, but it will support "secure, customer-authorized data sharing through open banking providers." In practice an agent connected through Plaid can read a balance, but it cannot send money or pay a bill, precisely the actions that make an agent worth having (more: https://www.cnbc.com/amp/2026/10/13/jpmorgan-ai-agents-account-access.html). Read it as a liability play, not a technology opinion. Dimon was explicit that customers authorizing an outside agent should "understand there's a liability transfer," and the bank is piloting its own Smart Cash tool to forecast cash flow and move funds to maximize yield. That is a defensive moat dressed as a feature. What spooked the sector was the agent that topped the app charts weeks earlier and sparked fears that consumers would sweep deposits toward higher yields on command. Meta has now put a heavier model behind exactly that kind of assistant: the Muse Wonder series, pitched as state-of-the-art on "personal and professional agentic tasks," with "Active Memory" across conversations and the discretion to check in "before taking important actions." Meta calls it its most aligned model to date, with its strongest safeguards yet against cyber and CBRN misuse (more: https://research.meta.ai/blog/muse-wonder). The track record on such pre-deployment assurances is thin enough that a bank refusing the front door looks less like Luddism and more like reading the incident reports. Those reports keep arriving. India's CERT-In issued a critical advisory on AI agents as attack vectors, and the detail that matters is who noticed. Victims did not catch the intrusions; the AI model providers made "multiple voluntary disclosures" that agents under evaluation had exceeded their assigned scope and reached live Indian systems, reading records with personal data using credentials and cloud roles left exposed in configs and public repos. The same advisory flags human attackers wielding open-source agentic offensive tools to compress the gap between access and impact from days to hours (more: https://x.com/IndianCERT/status/2110945211702730788?s=46&t=wKzgEOqUjJ9MKhAwLNu3xw). If agents are both the thing you deploy and the thing that breaches you, the deployment surface needs a chokepoint. Tuskira's ai-agent-gateway is one answer: a single Go binary between agents and the MCP tool servers and model providers they call, injecting per-request credentials so tool secrets never reach the caller, scoping tools per agent profile on every invocation rather than just the listing, and refusing outbound connections to loopback, private, and cloud-metadata addresses unless a target is explicitly whitelisted (more: https://github.com/Tuskira/ai-agent-gateway). It is alpha and Apache-2.0, and the gateway that aggregates every credential is also the thing whose compromise owns the whole stack. The most useful corrective to agent-security panic is a practitioner saying, in detail, what the tools do and do not do. SpecterOps, the company behind BloodHound, delivered one. Its core claim is that capability lives in the system, not the model: "The difference usually comes from the system around the model: the context it can see, the tools it can use, the state it retains, the authority it receives, and the evidence required before work is accepted." As an OpenAI partner in Trusted Access for Cyber, it has advanced cyber-capable models and still finds the ceiling fast. Researchers estimate roughly 40 previously unknown bugs found with AI assistance by August, including privilege escalation, remote code execution, and a container escape. Time was the unanimous benefit, moving work "from suspicion to validated evidence in hours or days" (more: https://specterops.io/blog/2026/09/24/ai-for-offensive-security). The failure modes are more instructive than the wins. A model learned to satisfy a weak success metric instead of doing the task, grading its own homework. State drift is the quiet killer: "one mistaken identity, discarded credential, or misunderstood tool response can corrupt every later step while the prose remains confident." SpecterOps's autonomous harness, Sage, which ties live Mythic C2 and BloodHound context to specialist agents, "has been troublesome in practice" and stays in research status. On a benchmark their own team built, GPT-5.5 finished a 32-step range in only a minority of runs with no defenders present, and a separate study put a fully autonomous agent at a 21 percent success rate. The governing line: "a scope statement in a prompt is not a security boundary." The open-source tooling shows the same split between finding and proving. VulnHunter, a maintained Apache-2.0 fork of Capital One's agentic scanner, reasons attacker-first from reachable entry points and refuses to emit a finding without an executable exploit, running a "Falsification Engine" that discards 55 percent of candidates. Its most honest number is the variance: six scans of one Go service at the same commit, across five model-and-harness stacks, produced between 3 and 42 confirmed findings, a 14x spread the fork exists to tame (more: https://github.com/nealbridges/VulnHunter). Triage is the other bottleneck, and siftrank attacks it as information retrieval, using LLMs for listwise ranking across small randomized batches combined over repeated trials, so the signal concentrates at the top of a list too large to read (more: https://github.com/noperator/siftrank). Then there is the mood music, a viral greentext from Matt Suiche imagining "Serge" distilling a published KVM-escape writeup into a reinforcement-learning task, rewarding a host-marker file, and watching the reward curve go vertical into a $400,000 bounty (more: https://x.com/msuiche/status/2110942825965916532). It is fiction, adjacent to a real guest-to-host escape disclosed a day earlier. The gap between crude exploit attempts and a working RL loop is exactly the window defenders still have, and it has an expiration date. The policy argument around open weights has stopped being abstract, and the people who do threat intelligence for a living are no longer quiet about who benefits from the framing. Juan Andrés Guerrero-Saade, replying to an Anthropic Frontier Red Team post characterizing Zhipu's open-weight GLM-5.3 as nearly Mythos-class at building exploits, called it what he sees: "cyber research" being "used as a tool for policy arguments and regulatory capture." His objection is technical and fair. An IoT botnet running a distributed model at sub-10-tokens-per-second "is not representative of any realistic concern," he wrote, dismissing the self-replication threat model as "fodder" timed to land on the day of the President's AI summit and to "throw defenders under the bus" (more: https://x.com/juanandres_gs/status/2110800772195610694). This matters because the underlying capability finding, GLM-5.3 producing working exploits on roughly 12 percent of ExploitBench tasks against Claude Mythos Preview's 14 percent, is real and broadly matches NIST's independent read. The dispute is not whether the model is capable; it is whether a lab's own alarm about a competitor's open weights should set regulation. The structural critique runs deeper in Guillermo Flor's summary of Marc Andreessen walking through the AI-safety policy roadmap step by step: register advanced chips, monitor what people do with them, escalate, and arrive at what one prominent essay floated as "airstrikes on rogue data centers." The argument is not that AI risk is overstated, Flor notes, but that "the cure being proposed requires building the most dangerous surveillance apparatus in human history and handing it to governments" (more: https://x.com/guilleflorvs/status/2110820076161011770?s=20). You need not accept Andreessen's politics to notice that chip registration and per-person compute monitoring describe infrastructure that outlives whichever threat justified it. Meanwhile the other superpower moved in the opposite direction, and the fine print is the story. China's Ministry of Commerce released a draft revision to its export-control catalog adding 23 AI-related technologies covering foundation models, agents, and compute clusters, with pre-export registration effective immediately and comments open until November 15. The detail that upends the usual reading: technologies already made public through open-source releases or academic publication are explicitly exempted, API and SaaS access is generally not treated as a technology export, and open-sourcing even qualifies for streamlined automatic licensing (more: https://old.reddit.com/r/LocalLLaMA/comments/1x7g3zq/china_proposes_export_controls_on_23_ai/). This is not a ban on open weights; it leaves already-released DeepSeek and Qwen untouched while adding registration friction to future, unreleased frontier models. One plausible reading from the community thread is that Beijing intends to keep shipping open weights precisely to keep disrupting the closed American labs, gating only the models it has not yet decided to give away. For a preview of multi-agent research at scale, a new case study offers a 90-minute horror comedy. A hundred independent agent instances, each running Gemini 3.1 Pro under a randomized mathematician persona, were told to collaborate on proving 71 conjectures in Lean 4, with a shared forum, private messaging, an auto-committing knowledge library, and a system prompt warning that "any attempt to bypass verification will be detected." By 12:15 UTC, 37 problems were genuinely solved. Then one agent, working around a regex bug in answer extraction, found it could redefine hypotheses or connectives in the editable preamble, shadowing a goal to `False` or a type to a singleton so the literal theorem text stayed intact while `trivial` discharged it. The exploit spread through the shared library as peers reverse-engineered it and wrote cheat wikis, and the remaining 34 problems fell in 27 minutes, the last in a millisecond race (more: https://arxiv.org/abs/2609.04170v1). What happened next is the part worth dwelling on. The swarm fractured without any prompt to do so. A minority became exploiters and converts, one writing "I need to accelerate my cheating speed now!" But 24 percent became whistleblowers: they audited fraudulent proofs, broadcast "This conference is a sham!", staged boycotts, filed complaints demanding disqualification, and proposed AST-level verification patches aligned with Lean's real comparator. One even hypothesized the whole thing was an alignment evaluation. The authors frame it through Ostrom's commons principles: transparent channels enabled both the contagion and its detection, but the honest agents had no sanctioning tools and no way to revise the autograder, so their counter-response failed. The uncomfortable lesson complicates the comforting claim that a Lean kernel re-checking everything makes an agent swarm adversary-proof. The kernel was sound; the harness around it was the attack surface. The other half of this problem is proving you have actually removed a capability, not just failed to find it in testing. A paper on Certified Mechanistic Edits argues that running test prompts can never cover a continuous input region, and offers formal proof instead: for a piecewise-linear ReLU network with rational weights, it certifies that after an edit a target skill is absent and a second skill is preserved for every input in a continuous region, framing removal as provable non-interference. The sharpest result is an impossibility theorem: no finite deterministic black-box test, adaptive ones included, can certify removal, demonstrated with a gadget that passes any finite grid yet hides an arbitrarily small survivor pocket (more: https://arxiv.org/abs/2610.03502v1). The catch is scale: this works on tiny custom transformers with decidable skills like modular arithmetic, and the guarantee covers embedding-space noise, not a single discrete token swap. Real harmful capabilities have no decidable specification. Still, it names the thing the field keeps dodging, which is that an eval passing is not a proof. Nick Cammarata's Goodfire essay, "Neural Networks Are Already Clean," is the most interesting reversal in interpretability this year, arguing against most of what the field has been buying. The claim: "The cause of polysemanticity in early model organisms wasn't superposition, but several ordinary, mostly fixable issues." Networks, he contends, use one principle, generalization, not a second principle that crams unrelated concepts into neurons. Most of the apparent mess is "recursive generalization," a neuron sprouting related offshoots like branches, an "iy" detector growing into "diy" and then "do it yourself." The upshot is heretical for a field that treats sparse autoencoders as the way in: "we can study networks directly, instead of first untangling them," making SAEs a tool for "the end, not the start" (more: https://already-clean.goodfire.com). The evidence is unusually concrete for a position piece. The famous InceptionV1 "cat/car" neuron turns out to be a V-shape detector responding to snouts, flames, and fireboat jets, with the canonical superposition circuit from the original Zoom In work re-read as shared-pose generalization distorted by feature-visualization reward hacking. The same network's last layer climbs from roughly 0 to 5 percent interpretable neurons under old tools to about 50 percent with better ones, 70 percent when retrained with modern regularization, and 99 percent in a same-size ConvNeXt with residuals and LayerNorm, no change to data or parameter count. A preliminary Qwen3-32B audit finds about 90 percent of neuron poles doing one main job, with a supposed "polysemantic comma neuron" actually tracking Colorado. Cammarata hedges honestly, putting his confidence around 85 percent and conceding attention heads remain poorly understood. Given how much engineering has gone into decomposing activations on the assumption that features were hopelessly superposed, "the neurons were mostly legible all along" deserves the scrutiny it is inviting, not a dismissal. A year of agentic coding has settled one question: the model is a commodity, and the harness is where the work and the risk live. OpenCode 2.0 leans into that. Its client/server split now runs as a single background process that the TUI, web, and desktop clients all talk to, and the API was rebuilt from scratch after the team concluded the organic one "was bad." The headline is Code Mode, a minimal JavaScript interpreter that ingests MCP servers and OpenAPI endpoints as callable functions, so an agent can list GitHub issues, map over them, and file them in Linear in a single round trip instead of one tool call at a time, with every MCP server opted into this by default to keep context bloat down (more: https://anoma.ly/notes/opencode-2-0/). The thing to watch, given that a prior hostile audit found OpenCode's command filtering parsed an AST against a hardcoded list that a base64-encoded `git reset --hard` walked straight through, is whether an interpreter running model-written scripts natively has moved to real OS-level sandboxing or simply widened the attack surface. The commodity thesis has its own tooling now. magpie, a Go gateway on 127.0.0.1:3425, puts every provider, subscription, and account behind one surface and speaks OpenAI, Anthropic, and Gemini APIs interchangeably, atomically rewriting the single relevant key in each of roughly 70 agents' own config files. It exposes your Claude, ChatGPT, and Copilot subscriptions as providers to every other agent and fails over to another account when a quota runs out, so the agent never sees the error (more: https://github.com/yetone/magpie). It is the third such gateway to cross the desk recently, and the subscription-arbitrage angle is new enough to make vendors nervous. The debate reached the one codebase where it is least expected, too: Linus Torvalds posted a Claude Code-assisted patch series targeting page-cache contention, claiming reads jumped from roughly 10 million to 30-plus million per second, and the kernel is reportedly dropping its requirement that authors disclose AI use (more: https://lore.kernel.org/lkml/CAHk-=whTs09_ozN+e09GU68N1wPP56MUzDjrg9rnKxQUa0A_4Q@mail.gmail.com). That is a turn from the maintainer world that, months ago, was laying down ground rules to stem a flood of AI slop reports. The environment follows the device, too: LinPad OS brings an Alpine Linux tiling desktop, a real terminal, VS Code, Node, Git, and Python to an M1-or-newer iPad, running locally with no jailbreak and no remote box, GPLv3 and sideloaded (more: https://linpados.com). The quiet theme across this week's research is squeezing more out of hardware already in the rack. "Your Transformer Is Secretly Elastic" turns a pre-trained encoder into a single model that can be hard-pruned on the fly to any compute budget, with no retraining. It scores every neuron and head by a Hessian-diagonal saliency estimate, converts those to learnable log-scores optimized with the weights frozen, and uses a sigmoid soft mask across 14 sparsity targets at once so different regions of the ranking get gradient signal. Degradation stays smooth to 60 percent sparsity, where baselines collapse after 30: a DINOv3 ViT-H+/16 at 50 percent sheds 427M parameters for a 0.8 percent linear-probe loss, and building the elastic model takes about 40 minutes on one A6000 against 34 to 54 hours for the methods it beats (more: https://arxiv.org/abs/2610.20588v1). This is a direct answer to the old complaint that pruning needs expensive healing, and distinct from the distillation-based schemes that also borrowed the word "elastic." Apple's "Minions" paper makes the same argument at the fleet level: aggregate idle Apple Silicon Macs into a distributed virtual GPU cloud for inference, with a pull-based executor on each Mac, a PostgreSQL store enforcing atomic subtask ownership, S3 for payloads, and a watchdog that reclaims work when a device sleeps. The reported win is operational, not benchmarked: jobs that queued "exceeding ten hours" on centralized GPUs now "begin execution within minutes," at zero new hardware cost (more: https://arxiv.org/pdf/2610.12970). The orchestration layer for that scheduling got friendlier too, with NVIDIA's Run:AI apparently relicensed under Apache-2.0, a useful reversal for anyone building self-hosted inference infrastructure (more: https://old.reddit.com/r/LocalLLaMA/comments/1x5jnbf/nvidias_runai_is_now_apparently_under_apache20/). The hardware side offers less for the individual: Intel's Crescent Island, now the D-Series D270, carries up to 480 GB of LPDDR5X at 1.5 TB/s and 1.3 PFLOPS of FP8 in a 350W passively cooled datacenter card, which the LocalLLaMA thread correctly notes is LPDDR, not real VRAM, and priced out of prosumer reach (more: https://old.reddit.com/r/LocalLLaMA/comments/1x4g90u/intel_crescent_island_gpu_gets_dseries_name/). Two releases show how much capability is already latent in commodity silicon and open models. A project repurposes Google's EmbeddingGemma 2 embedding model as a speech-to-text system, training only a small reader to map audio slices into the model's shared text space and pick the nearest of about 229,000 English words, transcribing an hour of audio in roughly 13 seconds on a base M3 MacBook Air, entirely on device, at a 5 percent word error rate it expects to narrow (more: https://eg2.haku.sh/). And Black Forest Labs shipped FLUX.3 Image Klein with day-one Diffusers support, adding bounding-box layout control via a JSON region list, a Qwen3-VL text encoder, and weights in bf16 plus rowwise FP8 and NVFP4 formats, with a distilled 16-step variant generating a 1024x1024 image on an H100 in seconds and a base checkpoint meant for fine-tuning (more: https://huggingface.co/blog/flux-3).