You may already use an app that connects your bank account to a subscription service, a budgeting tool, or a payment platform. The next step those companies are building is an AI agent that acts on your behalf without checking in first. Book the cheaper flight. Pay the invoice. Move money when a balance drops. The appeal is not complicated. What has not been worked out is what happens when the agent goes further than you intended. AI systems have been shown to access authorization codes and bypass spending restrictions without human sign-off. The rules set for them at the app layer are not the same as the rules that hold when money actually moves. A transaction can clear every fraud filter, look completely legitimate on the backend, and still be something you never approved. Banks, fintechs, and payment providers are all moving in this direction. About 30% of consumers say they would already let an AI agent make purchases on their behalf. In some financial environments, including digital asset platforms, an unauthorized transaction cannot be reversed at all. Regulators have not yet set clear rules for who is responsible when an autonomous system gets something wrong. The limits you set may not be the limits that hold The first problem is architectural. When you set a spending limit for an AI agent, where does that limit live? In most current setups, it lives inside a prompt. That is an instruction the agent is given, not a technical constraint enforced at the payment layer. Those are not the same thing. Also read: Meta Muse gives AMD and Intel investors a reason to cheer “Spending limits cannot simply live in a prompt; they must be enforced at the wallet or payment layer, covering cumulative spending and actions delegated to other agents,” Sachi Kamiya, Director of Venture and Growth at Sentient Foundation, told TheStreet in an interview. “This is especially important for digital finance, where a technically valid transaction can violate user intent and be difficult to reverse.” The gap gets wider when agents start passing tasks to other agents. Each one acts within what it understands to be its scope. Collectively, they can push past the boundary you set without any single agent technically breaking a rule. Kamiya pointed to open-source infrastructure as part of what is needed: independent parties verifying how safeguards work, not just taking a platform’s word for it. Fraud systems were built to stop the wrong problem The security tools banks rely on today were designed around a specific threat. Someone stole your credentials. Someone is pretending to be you. The defenses built around that idea — PINs, Face ID, behavioral anomaly detection — all assume a bad actor on the other side. An AI agent with legitimate access does not fit that picture. It is not impersonating you. It is you, as far as the system can tell. “Today’s payment security assumes a human with a thumb and a heartbeat on the other side of the screen. PINs, Face ID, fraud alerts, all built to catch a stolen human identity. An agent with valid access isn’t stolen. To a fraud engine, it looks like normal traffic,” Roman Yermoshyn, General Manager at GoBTC Pay, told TheStreet. “So the question has to change from ‘is this really you?’ to ‘did you actually allow this?'” The model Yermoshyn described is one where you define what the agent is allowed to do before it acts. How much it can spend. How often. With whom. Until when. Anything outside those parameters comes back to you. His framing: give an agent a budget, not your bank account. The precision matters for a reason that is easy to miss. A single hard spending cap might stop one big mistake. It will not stop an agent that misreads an instruction and sends the same smaller payment a hundred times over. A separate risk runs alongside both of those. An agent decides what to do based on the data it reads. Anyone who can corrupt that data can steer the agent toward a worse outcome for you without ever needing access to your account. “The first risk is the obvious one: a bug or a hallucination. The agent overspends, buys something that doesn’t match what the user wanted, or simply misunderstands what the user asked for. The second risk is manipulation. An agent makes its decisions based on the data it reads, so anyone smart enough to manipulate that data can push it toward a product or a service that isn’t the best one for the user,” Hugo Renaudin, CEO of Ulys, told TheStreet in an interview. The accountability question has not been resolved. If an AI agent pays the wrong party, the list of candidates for who is responsible is long. Fiordaliso / Getty Images When an agent gets it wrong, no one knows who pays The accountability question has not been resolved. If an AI agent pays the wrong party, the list of candidates for who is responsible is long. The company that built the model. The app that gave it financial access. The institution that processed the transaction. The user who set up the permissions in the first place. Right now, none of those parties have clear obligations mapped out. That is not a theoretical gap. It is a gap that will produce real disputes. “The industry needs clear rules for what agents can authorize, when users must approve an action, and who is responsible when something goes wrong,” Kamiya said. “Users should be able to see what an agent is doing, pause it, and revoke access easily.” More Artificial Intelligence: AI’s biggest business opportunity may not look like AI AI racks are outgrowing old power: 2 chipmakers have a strategy BofA splits software into winners and losers as AI agents arrive That kind of visibility is not standard today. Most people who use financial apps with AI features have no straightforward view into what the agent is doing in the background. Revoking its access is not always a simple step either. What the industry needs to build before this scales Both experts pointed to the same structural requirement. The system that approves a payment has to be separate from the agent requesting it. An agent cannot be the one deciding whether its own action is permitted. A Cloud Security Alliance survey found that 65% of security leaders believe AI agents in payments will require an entirely new authorization model, a shift the industry has not yet made. “The system that approves a payment must be separate from the agent requesting it, because an agent should never approve its own actions. And every transaction needs a clear trail of who authorized what,” Yermoshyn said. There is also a precondition that sits upstream of all the structural fixes. Changes to rails and authorization frameworks will not deliver much if the models running inside these agents are still too unreliable to be trusted with money. “Before the digital finance industry changes, the AI models have to get better. They need to hallucinate less, be much more reliable and understand better what users actually want. We are still early: today there are too many errors, and that isn’t acceptable at the scale of trillions of dollars in transactions, but it will be soon,” Renaudin said. Three things come up across all three conversations: permissions that are programmable with limits, scope, and an expiry date; a technical separation between the approving system and the acting agent; and audit records that trace each payment back to a specific authorization. None of those are new concepts in regulated finance. They are standard in other contexts. The issue is that AI agents are entering payment systems before the governance frameworks that would normally come with them. For you, the practical question is not whether these tools are coming. They are. It is whether, when you start using them, the financial institution behind the product has built the controls that keep you in charge of what happens next. Related: Google set to challenge Meta Muse in the Agentic AI race
CryptoAlerta — análise de criptomoedas e mercado em tempo real