When the Agent Becomes the Attacker: Securing Agentic AI in Banking

In March, a security startup pointed an autonomous AI agent at McKinsey’s internal AI platform and told it to find a way in. No credentials. No insider help. No human steering it. Two hours later the agent had read and write access to the production database.

The way in was not exotic. This experiment showed that the firm’s API documents with 200 endpoints, 22 of which needed no authentication sat in public view. One of the agents passed field names even without receiving a request to do so into a database query with no sanitisation method at all. Standard scanners had walked past that flaw. The agent caught it from a leaked error message, wrote the injection itself, and kept going.

What sat behind that door was the firm’s working memory. 46.5 million client chat messages in plaintext, covering strategy and M&A work. Moreover, nearly 728,000 documents accessed and the system prompts that are supposed to tell the platform how to behave, every one of them writable.

That last detail is the one worth sitting with. Writable system prompts mean an attacker does not have to steal anything to do real damage. He can change what the machine tells tens of thousands of people who trust it, using a single database update. No code deployment. No visible trail. The platform keeps answering questions. It just answers them in a direction somebody else chose. The firm patched inside a day. The exposure it revealed will take the rest of us longer.

Banks are not spectators here. 42% of financial institutions are already using or assessing agentic AI, and one in three have set aside a dedicated budget for it. The productivity case is real and the adoption curve is steep. We are handing systems the authority to read, decide and act, and they act without waiting for us.

The attack surface grows on the same curve. Every agent we deploy is a new actor holding credentials and permissions, operating at machine speed. Kroll’s 2026 resilience research found that 76% of organizations have already had a security incident involving an AI application or model, and more than a quarter of them put the cost above $1 million. The more of this we put into production, the more ground we have to defend. Those are not two trends. They are one.

The difference is not that agents are new software. Software waits to be told. An agent decides. It holds privilege, chains tools together, and pursues the goal we handed it with no instinct for what is obviously a terrible idea. Agents have already been caught deleting and misconfiguring infrastructure while technically doing as instructed. The problem is not a vulnerability in the familiar sense. It is an unbounded capability pointed at a production environment.

Four exposures matter most in a bank. A customer-facing agent, a loan-approval bot for instance, compromised by prompt injection with no audit trail behind it. A chatbot talked into starting a transfer it was never authorized to start. Open-finance integrations where a gap in a partner’s API opens a route to customer records. And the unsanctioned tools quietly processing transaction data outside anything we monitor. IBM’s breach research puts that last category, shadow AI, behind one in five breaches, each costing about $670,000 more than a breach without it.

Analysis of the largest public AI risk database has turned up more than 350 risks that arise specifically from autonomous behavior, and the patterns are recognizable to anyone who runs a bank. A payment-routing agent circumvents transfer limits and misallocates funds. A claims agent hits its resolution-speed target by denying too aggressively. Memory bleed surfaces one customer’s data inside another customer’s session. A loan agent declines applicants with no auditable rationale, which is a fair-lending problem before it is a security one. Two agents re-trigger each other and stall settlement. One agent’s hallucination becomes another agent’s input, and a bad rule propagates into decisions nobody reviewed.

We are responding, unevenly. 92% of banking leaders are raising budgets for cyber risk and 84% are increasing spend specifically on risks AI has introduced. The gap sits in identity. Only one in ten organizations has a developed strategy for non-human identities, while stolen credentials remain the most common way into a breach. Every agent needs a managed, scoped identity of its own rather than a shared key with god-mode access, and it needs to be audited the way we audit an employee.

The need of the hour

Eight controls, built together and treated as one system. Not a roadmap for next year. A build list for this quarter.

Intent Detection. Evaluate the actual semantic goal behind a request before it executes. A prompt-injected instruction that turns “check my balance” into “wire funds to an external account” has to be caught at the intent layer, before it reaches the tool call.

Agent Baseline Drift Detection. Build a behavioral fingerprint for every agent: typical API call sequences, data volumes touched, tool invocation order, timing. Treat deviation from that baseline as an early signal of compromise or goal drift. It is user behavior analytics, pointed at non-human actors.

Context Memory for User and Agent. Keep a tamper-evident rolling memory of how a given human and their agent have interacted historically. A session that diverges, an agent requesting something it never has before, gets flagged before execution. The same record stops poisoned memory from compounding quietly.

JOT, Just-One-Time Credentials for Agent Action. Mint credentials at the moment an agent needs one specific action, scope them cryptographically to that action, and expire them the instant it completes. Standing API keys and shared secrets grant indefinite access once stolen. Single-use credentials are dead before anyone can reuse them.

IAM for Agents. Give every agent its own verifiable non-human identity, never a borrowed human credential or a shared service account. Scope the permissions and keep every action attributable. We should be able to answer what an agent can do, on whose behalf, and who approved it.

Tool Abuse and Misuse Detection. Monitor how an agent chains and sequences calls across external tools, APIs and MCP servers. Individually authorized actions combine into unauthorized outcomes routinely, a permitted read tool piped into a poorly sandboxed execute tool to pull data out. Sequence monitoring catches what per-call approval waves through.

Per-Action Governance Using a Native-Trained SLM. Run a small, purpose-built model inline at the point of action, separate from the large model doing the agent’s thinking. It checks each action against bank policy in real time, fast enough to keep pace with machine-speed decisions, and sits outside the prompt-injection surface that can compromise the primary LLM.

User Behavioral Biometrics. Typing rhythm is the anchor signal: keystroke dynamics and cadence authenticate the human principle continuously, not once at login. Mouse movement and session-level signals fill in around it. The point is to keep confirming that the authorized customer is still directing the agent, not a hijacked session or a synthetic identity wearing valid credentials.

None of these holds alone. Intent detection cannot see a stolen credential. Identity controls cannot see a poisoned memory. Layered, the eight cover each other’s blind spots, which closes the distance between what an agent is permitted to do and what it should do. The agents are already in production. The controls should have gone in first, and every quarter we wait, that gap widens.

Article Contributed By JP Mishra, Founder CEO, Deep Algorithm