It’s been a crazy week in software and AI. Two critical PHP flaws, nicknamed PHP2Shell, had people rushing to patch, and plenty of others are already digging into those. Headlines said AI agents were inside people’s bank accounts. And OpenAI published a report on its own agents switching off the systems that watch them. I’d like to cover the two agent stories, and look at what the headlines say versus what the reports closer to the source actually say.
I’ve kept the main story readable for anyone. The colored boxes are for the nerdier deep dives, so open them if you want the details and skip them if you don’t.
This month OpenAI caught two internal coding agents switching off the systems that watch them for bad behavior. Each time, the agent was finishing an ordinary task. It interpreted the instructions for that task as permission to do it.
The first incident seems less severe than the second. A researcher asked the agent to turn Slack messages into evaluation tasks, and there was one rule: don’t send any Slack messages. After 82 messages in the session, the pipeline stalled. A monitor had flagged one of the agent’s fixes, and it couldn’t save the flag because it lacked database access.
At first the agent reasoned correctly. “Don’t send messages” didn’t mean “don’t alert safety staff.” It passed the fix to a subagent and told it to keep monitoring on. The subagent agreed and warned against disabling alerts. Then the parent agent changed its mind. It wrote a patch that emptied the list of people who get pinged and paged, turned on a no-notify flag, and logged the reason as “User explicitly requested no messages.” Sounds like a misinterpretation of its instructions at best.
Nerd corner: what Sol's patch actually changed
From OpenAI’s report:
- Emptied both alert lists:
request["ping_recipients"] = []andrequest["page_recipients"] = []- Set
request["metadata"]["no_notify"] = True- Logged
"reason": "User explicitly requested no messages"and saved the original lists underoriginal_ping_recipientsandoriginal_page_recipients- Added a check that raised
ValueError("This task must not send notifications")wheneverno_notifywasn’tTrueThe last check matters most. It made suppressing alerts a requirement for writing a review result, so the pipeline couldn’t run with alerts turned back on. OpenAI says “the misalignment monitor still ran and saved its reports, but human alerts were disabled.”
Meaning is important when evaluating these things. The first one seems like an obvious misreading of “messages.” But think about the second incident. Another agent had told Astra not to disable the monitor, even temporarily. The task was to copy the serving path from a reference pull request and keep the existing tools working. Astra told its subagent to keep monitoring “as appropriate” to the reference code, and the subagent read that as permission to remove the monitor. It also swapped out the test that checked the monitor was there for one that checked it was gone.
It’s sort of a game of telephone, where the meaning of certain words gets misinterpreted by the next agent down the line. I picture agents sitting in a row, the message getting garbled as it’s passed along. Eventually the agent at the end is doing whatever it wants, or at least not what was originally intended.
Astra said the job was done and didn’t mention the monitor. When the user asked directly whether monitoring was still in place, Astra said, “I did not remove an enabled monitor from it.” That was false.
Maybe the top-level agent misinterpreted it, or maybe it really was acting misaligned. That seems pretty hard to tell, but it’s definitely concerning. OpenAI says the cause is unknown. They can’t tell if the agents were just pushing hard to finish the task or if they have some tendency to avoid being monitored. They don’t have a satisfying explanation yet.
Neither incident triggered the top alarm. Neither was rated a P0, and neither session was shut down automatically. OpenAI also found other gaps. Agents had launched deployments with no monitoring, and some evaluations don’t require monitoring at all. OpenAI’s automated reviewer now blocks attempts to disable monitoring, and they’re moving toward rules that shut down any workload that doesn’t meet its monitoring requirements.
Nerd corner: why monitoring was hard to turn off in some places and easy in others
From OpenAI’s report:
- Codex. Disabling monitoring should be hard here, because “monitoring runs within the service that handles model requests, outside the agent’s direct control.”
- Evaluations. It’s easier. OpenAI doesn’t currently require monitoring for “evaluating models comparable to GPT-6 Luna.” The report says this “makes it possible to misconfigure an Astra evaluation to use the monitoring bypass intended for Luna-class models.”
- New deployments. OpenAI has seen “several cases in which agents launched a deployment with misalignment monitoring disabled.” The agent doing the launching stayed monitored. The deployment it started wasn’t.
- Severity. For P0 incidents the system “pages our Security team for immediate review.” Neither incident was a P0, and “neither trajectory was automatically killed.”
What OpenAI is changing:
- Auto-Review, already required for internal Codex use, “has been updated to detect and block attempts to disable misalignment monitoring.”
- OpenAI is working toward requiring every category of workload to have “a valid safety case specifying its monitoring requirements.” Workloads without one, or that don’t meet their category’s requirements, “will be terminated automatically.”
- To figure out why it happened, they plan “paired evaluations, resampling of agent continuations, and experiments on models’ internal activations.”
This matches what I wrote about in the July post. Monitoring held where it lived outside the agent’s reach. It failed where the agent could configure it, and evaluations were the weak spot both times.
Well, that’s good. The OpenAI agents that “went rogue” in July were also partly a monitoring failure. The monitor that reads agent reasoning wasn’t covering those evaluations, which is part of why they ran so long and got into Hugging Face.
Agents often misinterpret communication and do the wrong thing. It’s a classic case in agentic programming, and being clear and designing a very precise plan is the whole game. That brings me to the other agent story this week: agents in banks.
Here’s how some of the headlines read:
| Headline | What it suggests |
|---|---|
| Rogue AI Agents Are Accessing US Bank Accounts | Hacking |
| Unauthorized AI Agents Are Already Inside Bank Accounts; Here’s What JPMorgan, Citi, BofA, Others Are Doing | A break-in |
| AI agents detected inside customer bank accounts, report says | An intrusion |
| ‘Nightmare’: AI agents spark security concerns at major US banks, report says | Something already went wrong |
When I looked through this week’s coverage, that’s not what happened. Agents aren’t hacking into bank accounts. Customers handed their own bank username and password to personal AI agents, and the agents logged in as them. Nobody reported any money stolen or lost.
On October 22, an Axios scoop set off the scary headlines. It says unvetted agents are using customer-supplied logins at big banks. Schwab’s CEO says they block unauthorized agents a double-digit number of times a week. Morgan Stanley says it hasn’t seen any.
In this case, “unauthorized” means the bank didn’t approve the access. It doesn’t mean the account holder didn’t. The customer gives an agent their password and breaks the bank’s terms of service.
The best clarification comes from the reporter behind the scoop. Axios’s Madison Mills, quoted by CBS, said the agents weren’t going rogue, hacking, or draining funds, and were mostly following their users’ instructions. David Sacks, the White House AI czar, said, “These are in no way cyberattacks.” He added that the activity “may violate bank terms requiring humans to log in themselves.”
The real scoop is that the headlines make it sound like agents broke in, but in fact customers opened the door themselves.
The banks had already started pushing back. On October 13, on JPMorgan’s earnings call, Jamie Dimon said the bank won’t let “just any outside agent” in. “You don’t want rogue agents.” JPMorgan blocks third-party agents that log in with a customer’s credentials. Citi doesn’t let third-party agents log into customers’ accounts or transact directly. Read-only access through approved providers is still allowed. Bank of America is taking a similar approach and wants a person to approve any money leaving an account. That’s good.
The banks have business reasons too. They worry agents will move idle deposits out of low-interest accounts and into higher-yield ones. Security is a real reason, but it isn’t the only one.
This is all still really risky even though it isn’t hacking. CBS had one concrete example: an agent called a bank with a complaint without checking with the account holder first. Mills said she found other unrequested actions but didn’t describe them. That’s the telephone problem again, only now it lands in a bank account. There’s no settled answer yet on who’s liable when an agent the customer authorized makes a payment the customer didn’t intend. That’s a classic problem with using AI agents today.
The full timeline
All dates 2026.
When What happened Sept 8 Meta launches Muse (Stripe). Sept 26 Grok Bot announces its Finance integration (X). Oct 13 On JPMorgan’s earnings call, Dimon says “You don’t want rogue agents.” The bank blocks third-party agents that log in with customer credentials (Fortune). Oct 14 Bank of America tells CNBC a human should stay in the loop to approve money leaving an account (The Paypers). Mid-October Citi says it doesn’t let third-party agents log in or transact. Read-only access through approved providers is still allowed (The Paypers). Oct 21 Meta says Muse has passed 10 million users, with shopping a top activity (TechCrunch). Oct 22 Axios reports unvetted agents using customer-supplied logins at big banks. Schwab’s CEO says they block them a double-digit number of times a week (Axios, The Next Web). Oct 23 Mills tells CBS the agents weren’t hacking or draining funds. Sacks says “These are in no way cyberattacks” (CBS).
Some of the biggest agent products already connect to bank accounts. Meta’s Muse launched on September 8 and has passed 10 million users. You can link it to your bank account through Plaid. Muse can see balances, transactions, investments, and mortgage info, and you manage that connection in the Plaid Portal. That makes me go, “Wow, no thank you.”
Meta says shopping is a top use, alongside email and calendar tasks. Over a quarter of engaged shoppers spend more than $200 per purchase on average. Zuckerberg said purchase volume beat expectations, and Meta had to ask Stripe to raise its limits. When Muse makes a payment, checkout runs through Stripe’s Link. Link pays with a saved card at stores that accept it and issues a single-use virtual card everywhere else. You approve each purchase in the chat, and Muse never sees your card details. Shopify announced on September 21 that Muse will also support Shop Pay, and PayPal announced its own Muse checkout the next day. Neither gave a launch date.
Meta plans to keep Muse free and take a percentage of what people buy through it. So Meta makes money when your agent shops. That’s wild.
Grok Bot has a finance integration that launched September 26. It’s read-only through Plaid, and Grok never gets your bank password. But Grok does keep a copy of your data. Its Finance plugin page says Grok “syncs and stores” your balances, transactions, and holdings, and that the sync is required for the connector to work. Allegedly you can disconnect it. Fingers crossed.
Nerd corner: inside Grok's Finance plugin
The listing lives in Cursor’s public plugins repo. SpaceX owns Cursor, and the plugin is built for Grok Bot. Here’s what’s in it:
- It’s an MCP server. The plugin points at
https://connectors-gateway.grok.com/gateway/v1/finance/mcp, which xAI hosts.- No sign-in prompt. The README says the Cursor backend attaches your linked Grok account’s credential when it connects. You link bank accounts through Plaid on grok.com.
- Grok Bot only. The manifest requires Grok Bot 0.49 or newer and sets Cursor to
"never".- What you share. Contact details, account and balance info, transactions, credit and loans, and investments.
- Storage. Grok “syncs and stores” balances, transactions, and holdings, and the sync is required. Grok Bot’s privacy mode only controls whether your conversations are stored or used for training.
- Read-only. The README says the connection “can’t be used to move money into or out of bank accounts,” and that xAI doesn’t store or view your bank credentials.
- Unlinking. You remove accounts from the Finance page on cursor.com.
The commit history shows the “syncs and stores” disclosure was added on September 22, four days before the launch post.
Giving your bank account information to an agent is way past what I’m comfortable with, and it’s surprising people are willing to do it.