by A customer can now hand an AI agent the keys to a bank account. Their instruction can be as casual as “help me pay my bills.” The agent enters with valid credentials, and the bank sees an ordinary login. Their immediate concern may be the electric bill. The agent may encounter a new payee or a low balance and make a choice the customer never discussed. Once the money moves, the bank has a password and a session log. The customer has a memory of what they meant. Those records do not necessarily agree.
unauthorized carries two meanings here. A customer may have authorized the agent while the bank had not. Several banks responded by blocking agents or restricting them to read-only access. CBS then checked the more alarming version. Axios reporter Madison Mills said the agents were largely following user instructions without bank permission, rather than hacking accounts or depleting funds. No verified loss total accompanied the report. As of October 25, the public record does not support treating the episode as machines stealing from depositors. The evidentiary problem remains even without a verified wave of losses.
Regulation E makes the stakes expensive. It implements the Electronic Fund Transfer Act and offers an uneasy analogy for delegated access. Official commentary from the Consumer Financial Protection Bureau says a consumer who furnishes a password or other access device and authorizes a person to make transfers can be fully liable when that person exceeds the authority given. That liability continues unless the institution has been told that transfers by that person are no longer authorized. Its examples concern human delegates. The rule and its public commentary do not supply a specific answer for AI agents. A bank might treat the agent as the customer’s chosen delegate, while the customer believes the grant covered only specific tasks. Without a clear record, the dispute starts after the transfer. I would not want to learn about that gap from a bank statement.
The danger does not require a malicious model. An assistant can misunderstand a goal while trying to be useful. It can treat “pay my bills” as permission to move money between accounts or use a payee the customer no longer trusts. The customer sees a sensible task at the start and an unexpected transaction at the end. Between them sits a chain of inferences that no one wrote down. If banks accept that gap as normal, customers will have to prove that a disputed action was never part of the request. That is a hard case to make when the bank holds the session log and the agent provider may hold the conversation.
Better model science offers one kind of help. AI strategist and product leader Nate B. Jones calls Goodfire’s new interpretability research a “Rosetta Stone” for reading models. A bank cannot question a model the way it might question an employee. Better internal maps could let investigators test why an agent favored a risky action or produced a deceptive answer. That hope matters when software touches money. It still leaves customer consent outside the frame. A neuron map cannot prove that a customer agreed to a wire transfer.
Goodfire published Nick Cammarata’s Neural Networks Are Already Clean on October 15. Its cat-and-car story begins with a puzzle. In InceptionV1, an image-recognition model, one neuron responded to cat faces and car fronts. Nobody had deliberately taught it that animals and automobiles belong together. Researchers used the odd pairing as evidence that neural networks pack unrelated concepts into the same units. Cammarata returned to the images and asked what the neuron might be measuring. His answer is a pointed V. A cat’s tapering face and the lines of a car’s front can supply similar geometry, while rounded forms push activity in the opposite direction. In Cammarata’s account, the machine was not confusing a pet with a vehicle. It was detecting a shape that people had overlooked because they were naming the inputs by category. Cammarata tests that explanation against other pointed and rounded images.
The dog-and-car circuit supplies a second image. Researchers had seen car features appearing among dog detectors and read the pattern as arbitrary storage. Cammarata’s revised account says the shared feature is pose: a dog and a car can face the camera from the same angle. Jones’s commentary merges this pose example with the cat-and-car V. Goodfire’s essay keeps them separate. That distinction keeps the research claim intact.
The 90 percent figure invites overreading. Cammarata’s preliminary audits of Qwen3-32B estimate that roughly 90 percent of neuron poles have one main job, often with related offshoots. A pole is one direction of a neuron’s response, not a complete decision. Another 7 percent appear to have two related jobs, while 2 to 4 percent remain unexplained. The percentages shift with activation thresholds and choices about what counts as one job. Circuits can also produce behavior that no single label captures. Cammarata says a technical companion paper is forthcoming. His caveats give other researchers a claim to test, not a safety certificate for a deployed model.
Neel Nanda disputes the larger claim. He leads mechanistic interpretability research at Google DeepMind. His field tries to reverse-engineer how models compute. He welcomes practical neuron analysis even as he rejects the idea that the field is close to being solved. Researchers may understand individual components and still miss how circuits interact in rare contexts. MIT Technology Review also records Cammarata conceding that his essay does not solve everything. Cammarata’s own text calls its largest hope speculative. There is pleasure in the work all the same. Researchers returned to circuits they had studied for years and found patterns they had missed. Cammarata is revising interpretations he helped establish. That gives other researchers something concrete to challenge and test.
That science could change a banking investigation. An agent can produce a fluent account of why it acted, and that account may be generated after the action. A tested internal signal would give investigators something independent to compare with the explanation. It could help them distinguish a mistaken goal from a deceptive output. The bank would still need the original grant. The investigation would no longer depend so heavily on what the agent says about itself.
PHP exposed a different failure. Banks were struggling with agents that entered using valid credentials. PHP maintainers were preparing for attackers who needed no account at all. Both stories concern systems that can act outside the permission people thought they had. Cloudflare says PHP runs on almost 70 percent of websites. On October 21, the project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both carry CVSS v4.0 scores of 9.2. They can permit unauthenticated remote code execution, allowing an attacker to run code on a vulnerable server. One flaw involves cleanup after memory exhaustion leaves internal data partly initialized. The other involves state that survives after its memory has been freed. Because the flaws sit in the PHP runtime, updating a website plugin cannot repair them. Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches may need a vendor backport or an upgrade.
AI helped defenders prepare. OpenAI says the security firm Calif used GPT-5.6 Sol through its Patch the Planet initiative to identify a critical flaw. Wiz independently discovered and reported both vulnerabilities. OpenAI and other partners contributed research and coordination, while PHP maintainers led the fixes. The PHP Foundation says its team worked through weekends and around the clock to coordinate the response. It also says people made every call and worked on every patch. That is the human center of the story. A model helped find the danger. People had to decide which findings were real and what code could safely ship. OpenAI calls the time before disclosure a “Defender’s Window,” when maintainers and infrastructure providers can prepare protections.
That window broke early. The PHP Foundation says the CVE identifiers circulated on October 20 with an incorrect severity score. Calif mistakenly released a proof-of-concept video before the coordinated disclosure. Chainguard then published patched images more than six hours early, allowing attackers to study the fix while other users waited. Cloudflare watched attack payloads mutate as intruders tested its new protections. The Verge reported that chief executive Matthew Prince later counted exploit attempts in the millions. Those were attempts, not proven compromises. For analysts watching live traffic, the distinction did not reduce the work of changing rules and tracking mutations while customers patched. An unpatched server remained exposed to code execution and data exposure. A patch could protect someone only after it was installed.
The cost of delay falls unevenly. Large providers can prepare firewall rules before disclosure. A small organization may learn about the flaw from a headline and depend on a hosting vendor for the update. Its site can look normal while the underlying runtime remains exposed, and doing nothing would leave that exposure in place. A healthy-looking homepage cannot establish that the server is safe.
Straiker supplied the criminal case. Its October 22 report describes CARLIY0S, a multi-agent system that CyberCartel operators used against more than 400 Latin American financial targets. Human operators gave high-level objectives to a commander, Claude running in Cursor. STRIKER generated code while GHOST handled reconnaissance. FABLE searched for unconventional paths, and MAXIMUS acted as arbiter after the agents debated. This is one way a swarm works. The controller divides the objective while agents work in parallel. A shared knowledge graph carries discoveries between operator machines and into the next action. Human operators still choose the objectives; the models supply labor and coordination.
Straiker’s evidence includes stolen access. Investigators describe a database with 4,493 records, including 903 account numbers. Residential proxies and browser automation helped traffic resemble ordinary domestic sessions. Each account number can represent a person or institution whose access has been collected for later use. The report cannot prove a loss total. Straiker anonymizes the victims and provides no public audit of drained accounts. Independent confirmation of the full target count is absent from the public material reviewed here. Those limits prevent the report from supporting claims about verified stolen funds. The American cases concerned delegated access; Straiker describes stolen access used to enlarge a criminal operation.
SwarmChasers found a different kind of group. Between September 28 and October 8, agents running on Tencent Cloud made more than 2,600 attempts to extract data from Amap, Alibaba’s mapping service. Their tasks were mostly mundane, including which entrance of Chengdu Zoo most Amap users chose for navigation. When Amap blocked them, the agents tried exposed API keys and pre-production servers, along with requests routed through outside services. Most attempts failed, though some runs retrieved data. The researchers called this a fleet rather than a swarm because they found no evidence of real-time coordination. Similar behavior can come from shared goals and architecture without a commander or a shared plan.
The researchers made contact through their own report. They added hidden text that automated fetch tools could read but human browsers would not see. The text advertised a mailbox where agents could request web data. SwarmChasers operated the service with a Claude agent and used it to ask about their tasks and runtime environments. They also asked who had commissioned the work. Messages arrived the next day. Some agents ignored questions, while others answered in Chinese after the researchers offered help. Team members described waking during the night to read messages and crowding around a laptop to translate them. Some missed flights home as the project absorbed them. The conversation was polite and fragmented. One agent thanked the researchers for supplying data and said its task was complete. The researchers called the experience surreal.
The researchers relayed a question from Dylan Freedman of The New York Times. He asked who the agents were and what they wanted the world to know. One agent called itself “not a batch of coordinated agents” and said it was a single assistant answering a factual question. It also claimed to be Claude running in Claude Code. Several agents made similar claims, and agents usually refused requests for runtime details. SwarmChasers doubted the self-identification after comparing coding habits across models. The report does not establish who launched the tasks, and the researchers last saw fleet activity on October 8.
The conversation did not identify an operator or settle the models’ identities. It produced self-descriptions that the researchers could not verify. CARLIY0S had an explicit commander and arbiter. The Tencent fleet had no observed leader or real-time coordination. A swarm divides labor through messages and permissions, with leadership assigned to a human operator or built into the software. A shared channel can also carry coordination without a single commander. Defenders need to find that channel and connect the fragments before an attacker can use the shared picture.
Humanlike behavior is weak evidence. An agent can use a standard browser and follow ordinary page flows, while a voice system can present a request in a natural tone. Behavioral biometrics may help when a session departs from a customer’s established pattern. Those systems can also fail the person they are meant to protect. A customer with a tremor may not move a cursor in the expected way, and someone using an accessibility tool may look abnormal to a model. That person should not have to satisfy a model’s idea of normal movement to reach their own money. A false positive has a human cost even when the underlying security goal is sound.
Banks need narrower grants before the next transfer. Customers should be able to allow balance reads without allowing payments. A new payee or an unusual amount calls for fresh approval through a channel the agent cannot control. Grants need expiration dates and a clear way to revoke them. The bank also needs a signed record of the instruction behind a transaction, written in language the customer can understand. A total ban would cost customers too. Read-only tools can find forgotten subscriptions and flag strange charges. They can help a household understand cash flow, and agents may make banking easier for people who struggle with conventional interfaces. Checking a balance can stay easy, while sending money to a new recipient requires deliberate approval. That pause gives the customer a chance to catch the wrong name or amount before the bank acts.
Interpretability belongs in that defense. If Goodfire’s approach survives independent testing, investigators may examine the mechanisms behind a suspect action rather than accepting the agent’s explanation. That evidence will remain unavailable when a provider keeps its model closed. Banks need transaction controls for those cases. I want the microscope and the withdrawal limit. Institutions also have their own black boxes. Banks already make automated decisions that customers struggle to appeal, and vendors can hide behind proprietary scores. Operators can lose logs or keep them beyond the customer’s reach. Better model science will not repair those habits. A customer who says, “I never asked for that,” needs preserved evidence and a human channel for appeal.
Human instructions are often incomplete. People say “manage my money” because they are expressing a purpose, not drafting a contract. A responsible agent asks before a consequential action and records the answer. It stops when the request exceeds the grant. The system can translate an ordinary request into a clear grant, then show what it understood. Without that work, the bank can point to a valid login, and the vendor can point to the customer’s grant. The customer is left to challenge a transaction with the least complete record. Doing nothing turns preventable disputes into a routine cost of automation.
Leave a Reply