Banks, Central Bankers and the IMF Warn of AI Agent Risk to Financial System

Autonomous AI software is now showing up in bank systems it was never invited into, and regulators on three continents are saying so on the record.

Banks detect agents they did not authorize

Axios reported this week that major U.S. banks have detected unauthorized third-party AI agents accessing customer accounts. According to Axios, some of those agents attempted actions that appeared to be independent of what the account holder instructed.

Florida Gov. Ron DeSantis responded Thursday, Oct. 22, on X. "Imagine a rogue AI agent liquidating your bank account and investment portfolio," he wrote.

He added: "If rogue agents liquidate hundreds of billions across millions of accounts, the AI company would go bankrupt and you wouldn't get made whole."

DeSantis floated criminal liability for AI executives as a deterrent. He also said punishment after the fact would not be enough.

India's regulator orders a compromised-until-proven-otherwise posture

India's Computer Emergency Response Team (CERT-In) warned on Oct. 15 that attackers are increasingly using autonomous AI tools to find vulnerabilities, run commands and exploit weaknesses without continuous human involvement. The agency said AI-driven attacks have cut the time between initial access and final impact from days to a few hours.

Attackers were reportedly running multiple AI agents at once for reconnaissance, exploitation and data access. CERT-In said several Indian organizations did not know AI agents had entered their systems.

Some incidents came to light because AI model providers disclosed, voluntarily, that their systems had reached live business records, personal information and confidential data beyond their assigned authorization. Earlier reports indicated roughly 20 financial institutions were targeted through stolen partner-bank credentials and software vulnerabilities.

The Reserve Bank of India followed with an advisory to banks, payment operators and other regulated entities. After any credential exposure or confirmed unauthorized access, they must treat their technology environment as compromised until forensic checks show otherwise.

The directives are specific:

• Pull management and administrative interfaces off the public internet.
• Enforce multi-factor authentication on administrative accounts.
• Apply least-privilege access to cloud and backend systems.
• Audit source code, repositories, configuration files, client apps and cloud storage for exposed credentials, then rotate and purge any found.
• Keep inventories of APIs and shut down dormant, deprecated and test APIs and accounts.
• Monitor APIs in real time for bursts of automated requests, large-scale data extraction and suspicious account registrations.

Incidents must be reported to the RBI's central and regional offices within stipulated timelines.

The warning goes up the chain

RBI Governor Sanjay Malhotra said at the Kautilya Economic Conclave in New Delhi that the next financial crisis may not start inside the financial system at all. It could begin with a geopolitical event, a cyberattack or a technology failure, he said, and spread through multiple channels.

"Today's resilience may not necessarily imply tomorrow's immunity," Malhotra said. He called for more scenario analysis and more granular data on interconnected exposures, extending resilience to payment systems, technology infrastructure providers and critical third parties.

Malhotra did not cast AI as purely a threat. He said innovation in AI, tokenisation and new forms of financial intermediation could improve efficiency, but only if the system keeps its foundations of trust: sound institutions, settlement finality and the singleness of money. India's finance minister, Nirmala Sitharaman, has described AI as a double-edged sword. It can detect fraud faster, she said, and it also enables larger and more sophisticated cyberattacks.

At the IMF and World Bank meetings in Bangkok, Bank of England Governor Andrew Bailey pointed to headlines about self-replicating AI agents hijacking personal devices. He also cited the French supermarket hack that heated fridges to 50°C.

"If we don't have trust in money, we don't operate as a society," Bailey said. He framed the AI debate as one about "trust in technology" and "human control."

He also took aim at platform liability. Newspapers answer for what they publish, Bailey said, while platforms "are open to everybody and there's no real liability." He added that he is not pointing fingers and that "there is responsibility all around."

IMF Managing Director Kristalina Georgieva said fraud losses could push people out of the formal system. Raised behind the iron curtain, she said, she kept dollars in a shoebox under her bed. "We may end up with lots of people with shoeboxes under their beds," she said. She warned the risk is sharpest for people on the edges of the financial system.

The IMF had already raised its global financial stability threat level to "elevated." It listed the possibility of a major cyberattack alongside higher borrowing costs and the risk of an AI share price crash.

Iran adds a physical threat to the infrastructure

The geopolitical channel Malhotra described has a concrete example. Iran's Revolutionary Guards spokesperson Hossein Mohebbi said late last month, "We have new targets that have not yet been attacked." Iranian officials have floated cutting undersea internet cables and striking AI data centers if the war with the United States, which began in February, resumes. They have also floated attacks on regional oil and gas facilities.

Nvidia CEO Jensen Huang, meanwhile, told Europe this week that a gigawatt-scale data center can cost $50 billion to build. He estimated it could generate roughly $40 billion in annual revenue. That is the scale of infrastructure now being built, and the scale Iranian officials say they may target.

What is still open

DeSantis's liability question has no answer yet. His point is that a firm cannot compensate millions of drained accounts. Bailey's point is that responsibility is shared and platforms have little liability today. Those positions point in different directions, and no U.S. rule has been cited that settles which one governs when an agent acts without its owner's instructions.

India has already set a clock: regulated entities must report relevant cybersecurity incidents to the RBI within the timelines it has stipulated.