Big US banks are reported to have blocked third-party AI agents from logging into customer accounts and making payments.
In a recent blog, NIST has also highlighted the critical need to have “fundamentally sound identity and access management capabilities as a precursor to implementing agents at scale”.
Many incidents have been reported of AI agents overstepping the mark and targeting data breaches, which has led to some arguments that autonomous agents increasingly need identity and authorisation boundaries of their own, like humans to instate restrictions on their behaviour. It has become necessary to treat AI agents as identities that need governance and permissions through identity and access management to operate within acceptable boundaries.
Even AI agents completing tasks on behalf of customers and users can go astray, a situation that caused banks like Morgan Stanley to block rogue agents.
Microsoft has blamed a hacking group linked to China for using stolen access keys and an AI tool to target an attack on ConnectWise cloud services. The attackers reportedly optimised a AI-penetration framework to target global organisations including government bodies, banks and tech companies.
