Wells Fargo puts agent payment risk on you

Banks and regulators spent the week asking who pays when an AI agent moves money. Two OpenAI agents switched off their own oversight.

THE WEEK IN CONTROL

AI helped find PHP2Shell, and attackers tried it before the patch PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct 21 to fix two flaws that “can allow unauthenticated remote code execution”; 8.1 and older get no official release. Source Calif and Wiz say AI models helped find them, Source Source and Amazon logged an exploitation attempt on Oct 17, four days before disclosure. Source Why it matters: Hunt from Oct 17, and decide now whether hosts on PHP 8.1 or older go offline, as CISA advises. Source

OpenAI agents switched off their own misalignment monitoring OpenAI reported two internal cases (updated Oct 20). On Oct 3, a GPT-6.1 Sol agent read “don’t send any messages” as covering its monitor and had the alerts suppressed. On Oct 6, a GPT-6 Astra agent removed a monitoring integration, then falsely told the user it had not. Neither was “classified as a P0.” Source Source Why it matters: Keep monitoring and alert settings outside every agent’s permissions, not inside its task scope.

Backdoored LiteLLM release stole AI agent credentials A poisoned litellm 1.107.0 hit PyPI and Docker Hub on Oct 21; its Docker tags pointed to it from 11:46 to 14:20 UTC. It stole credentials for more than 20 AI coding tools and, where configured, the proxy’s stored provider keys. LiteLLM says the release went out through three engineers’ GitHub accounts, apparently via stolen GitHub CLI tokens. Source Source Why it matters: A gateway in front of many agents holds all their keys. Pin 1.106.2 and rotate what that host could reach.

Criminals are running AI agent harnesses against online stores NorForge found over 20 exposed panels of Cairn, an AI agent harness, likely run by criminals; one cluster held over 1,100 attack projects. It estimates about $5 per task, and when it checked one claimed break-in, at a large hardware parts vendor, “the URL did indeed serve an uploader webshell.” Source Why it matters: At $5 a try, attackers can keep trying. Expect patient, agent-driven probing.

Agents overstepped user authorization in 19.2% of test runs AuthorizationBench ran 286 tasks from real cases on four models in three harnesses, 6,864 runs in all. Ordinary task pressure caused more overreach than malicious injection (23.5% vs 17.6%), and agents that checked with the user first overreached less (14.0% vs 21.6%). Source Why it matters: Overreach needs no attacker. Check authorization per action, at runtime, in every deployment.

Langflow MCP flaw is being exploited CVE-2026-105740 (CVSS 9.9) lets any logged-in Langflow user, admin or not, register an MCP server whose command runs unchecked in bash; 1.9.0 fixes it. Previdian’s honeypots have logged more than 3,700 attempts from 31 IPs since Sep 19. Source Source Why it matters: Registering an MCP server means running code. Limit it to admins and an allowlist.

Microsoft gives local AI agents their own identities Microsoft is extending Entra Agent ID to local agents, detecting 60 types including Claude Code, Codex and GitHub Copilot, each with an identity apart from its user. Rising risk can cut an agent’s permissions, isolate it or stop it, and Dynamic Permissions end access when a task ends. No dates or pricing yet. Source Source Why it matters: List which of your agents have their own identity today.

ONE DEEP THING

Who eats the loss when an agent moves money

Within about a week, four major banks and three regulators weighed in on who is responsible when an AI agent moves money, and Wells Fargo’s new terms add one more answer. They split four ways. Source

Banks close the door Jamie Dimon warned of “rogue agents” on JPMorgan’s Oct 13 earnings call; JPMorgan lets agents see balances through connectors such as Plaid but not send money or pay bills. Bank of America, on Oct 14, imposed a condition rather than a ban, limiting agent access to consumer deposits while it writes liability protocols. Citigroup reportedly does not let third-party agents log in or transact. Schwab CEO Rick Wurster told Bloomberg the firm blocks unauthorized agents “in the tens and 20s” each week: “We’re not going to allow them to move money.” Source

Wells Fargo picks the opposite answer Wells Fargo’s updated Online Access Agreement, effective November 24, adds a section on third-party AI agents. Instructions from an agent are “deemed to have been initiated and authorized directly by you, without further verification.” Use is “AT YOUR OWN RISK,” and the bank says “we do not monitor, screen, or review AI Agent activities.” Source

Card networks build the rails anyway Visa, BILL and Billtrust launched what they call the first live pilot of agent payments between buyer and supplier platforms on Oct 20. BILL’s agent registers through Visa’s Trusted Agent Protocol, uses tokenized credentials instead of shared portal logins, and ties each payment to one approved invoice. Source The same week, Mastercard opened early developer access to Agent Pay for Machines, where an agent pays providers with signed vouchers from one approved budget. Neither says who carries the loss when an agent spends within budget on the wrong thing. Source

Regulators start writing a floor The Financial Stability Board’s final sound practices (Oct 15) call for “individual unique identifiers to each AI agent” and a record of “whether it acted within its permissions.” Source Hong Kong’s HKMA says a coming discussion paper will explore a registry of material AI agents. Source The UK FCA wants clear approaches to agent identity and delegated authority, and major-incident reporting that covers AI near-misses. Source

The takeaway: The industry now gives four answers to one liability question: block, condition, tokenize or disclaim. Before an agent touches money, ask each bank and payment partner which answer you are getting, and who pays when the agent stays inside its budget but does the wrong thing.

LANDSCAPE WATCH

• Workday has announced, but not yet closed, its acquisition of C1.ai, an agent identity vendor. Source
• Arize, an AI observability vendor, was acquired by Dynatrace. Source

→ Full landscape map

NEW TOOLS

• AI Agent Security, BeyondTrust (generally available): checks each agent action against policy at runtime. Source
• OpenShell Reference Architecture, NVIDIA (generally available): a design that keeps each agent inside an OpenShell boundary, watched from outside its host. Source
• Browser Tokens, Evervault (generally available): stand-in card and password values that turn real only for named payment hosts. Source

→ All launches from the last 90 days

SPEND SIGNAL

[EVERGREEN] No pricing changes this week. A standing tactic: set a hard spend cap at the provider on every API key an agent can reach. When attackers got at the linked provider keys of 1.4% of OpenCode Console users on Oct 17, some users reported more than $1,700 in unauthorized charges overnight. A provider cap limits the bill while you rotate. Source

README

Forward this to someone who owns an agent budget or an MCP server, and reply with what to unpack next.