A headline crossed my feed this week: major US banks have detected unauthorized third-party AI agents operating inside customer accounts. I pulled the source. One paragraph. No bank named. No vendor named. No account count. No timestamp. Four data points, three of which are adjectives.
That is not a reason to dismiss it. It is a reason to read it correctly. The mechanism is real, it is already running at scale somewhere with better logs, and the industry that owns those logs shipped a fix before the banks noticed.
Here is what a bank actually runs. Strong customer authentication. Device fingerprinting. Behavioral biometrics. Session binding. Every layer encodes one assumption: the operator is the account holder, or an institution on a signed API. An agent breaks that assumption without breaking any single control. It authenticates correctly, with credentials a human handed over, then behaves like software โ uniform keystroke timing, no mouse drift, a fresh browser fingerprint, a session path that does not match the user's history.
So the classifier fires. And here is the trap: from the bank's side, a benign agent and a credential-stuffing bot look identical. Same signals. Same absence of a human. The risk engine cannot read intent, only shape.
Which means "unauthorized third-party AI agents" is a label covering at least four different things. My read of the distribution: roughly 40% benign delegation โ a user pasting bank credentials into a browser assistant to check a balance. About 20% data harvesting, the new screen-scraping. About 20% straight malicious automation wearing an AI wrapper. The remainder, payment-initiation agents whose authorization chain does not close on the bank's side. Four causes. Four liability profiles. One headline.
Read the verb. Banks detected the agents. They did not authorize them, and they did not block them at the door. Detection is a monitoring-layer capability. Admission control is an identity-layer capability, and it does not exist yet in retail banking.
That gap is the entire story, and it is a gap crypto closed first.
The missing primitive is verifiable delegation: a grant that is scoped, time-boxed, spend-capped, revocable, and auditable by a third party. Banks have no format for it. Ethereum has three. ERC-4337 gave us session keys โ a key that can call two contracts, move up to a cap, and expire in an hour. EIP-7702, live since Pectra in May 2025, lets an ordinary EOA delegate its code to a smart account, so the permission logic sits at the account layer instead of inside an app. ERC-7710 and ERC-7715 formalized the caveat system: the delegator signs a permission envelope, an enforcer contract checks the caveats, and the whole surface is inspectable on Etherscan before anyone signs. The chart is just the echo; the code is the voice.
I learned to check the enforcement surface the hard way. In 2017 I read MelonPort's staking logic line by line and found an integer overflow before it was public. The lesson was not that audits are magic. The lesson was that the pitch deck and the permission surface are two different documents, and only one of them is binding.
Same discipline applies here, and it is why I am not bullish on the current generation of agent infrastructure. The delegation primitive is sound. The enforcers around it are not. Nearly every session-key drain I have tracked in the past two years failed identically โ the caveat was validated after the external call instead of before it, or the paymaster sponsored a call the key was never allowed to make. Code executes promises; men make excuses. The primitive is not the risk. The glue is.
Banks will learn this slowly, and in the wrong order. There is a commercial reason the security framing is so convenient. Section 1033 โ the US personal financial data rights rule โ was written to let consumers authorize third parties to read their data. Banks have fought the implementation for years, mostly over API fees versus free screen-scraping. An unauthorized agent is a far better argument for throttling than a fee schedule. Watch what gets blocked and what gets priced. If agent traffic must route through a bank API, every balance read gets metered and the bank recovers the intermediary position it is losing. If it routes through the interface, the bank eats the risk and bills nobody. The security story and the toll-booth story point the same direction, which is exactly why you should read the security story skeptically.
On-chain eyes saw the mania before the crowd did, and they will see this one in the fee data, not the press releases. Agent traffic is machine traffic: high frequency, low value, high transaction count. It lands on rollups long before it lands on core banking. Post-Dencun blob capacity is already being eaten by consumer L2 activity, and machine-initiated transactions do not sleep. When agent volume arrives, blob space saturates and the fee curve that made L2s cheap does a vertical turn. That is a tradeable sequence, and it is more legible than anything emerging from a bank risk committee.
The contrarian read: everyone is asking whether AI agents are safe. Wrong question. The banks are not trying to make agents safe. They are trying to make them billable. Safety is the language; metering is the business. Retail reads this headline as a warning about AI. Smart money reads it as a land-grab over who owns the customer's financial interface โ the assistant, the card network, or the bank.
Which puts the crypto side under the same lamp. Half the "AI agent" tokens trading right now are a wrapper around an API key and a prompt. No delegation model. No enforcer contract. They do not survive an audit. Survival isn't about glory. It's about staying solvent โ and the projects that clear this cycle will be the ones whose permission surface you can read on a block explorer.
What I am watching, concretely. First, whether any top-four US bank publishes an agent-access API with scoped credentials before Q3 ends โ that is the tell that they chose metering over blocking. Second, blob utilization on the major L2s; a sustained move above 80% of target resets the fee floor for everything downstream. Third, audit reports on session-key enforcers, not on the delegation standards. Fourth, whether agent-driven rebalancing starts arbitraging the utilization kink in lending markets โ when software routes capital across Aave and Compound every block, the borrow curve stops looking like a law of nature and starts looking like what it is: a parameter someone picked.
The banks found the agents. The agents were always going to be found. The only open question is whether the delegation gets verified or just gets priced.