Gould: banks preparing for rogue AI agents for 'months'

Bloomberg News

Processing Content

• Key insight: Major banks are using their own artificial intelligence software to protect depositors against reported breaches stemming from an internet-wide code vulnerability.
• Expert quote: "The banks have been all over this for months now, fortifying their defenses and using SI as a defense against these AI agents, too." — Comptroller of the Currency Jonathan Gould.

NEW YORK — The comptroller of the currency said banks are well-positioned to guard against cyber attacks and data breaches from artificial intelligence programs.

In a television interview Thursday morning, Comptroller Jonathan Gould attempted to ease depositor concerns after reports surfaced this week that unauthorized AI agents have gained access to a wide swatch of websites and online platforms — including those that connect bank customers with their accounts.

In his appearance on Fox Business's "Varney & Co." program, Gould said many banks are using their own AI systems — which he referred to as SI, for super intelligence — to block bad actors from moving funds.

"The banks have been all over this for months now, fortifying their defenses and using SI as a defense against these AI agents, too," Gould said, noting that he recently toured the operation of a major national bank to see the technology work up close. "I'm here to assure you that SI is a powerful defensive weapon as well."

Stuart Varney, the host of the program, asked Gould twice whether customers could expect to get their funds back, should an unauthorized AI agent transfer money out. Gould did not specify how such matters would be resolved. Instead, he reiterated his confidence in the ability for banks to block such activities in the first place.

Read more:

• As fintechs nab bank charters, what's happening to BaaS?
• Overheated data center knocked 23 credit unions offline
• Chris Britt still says banking is broken, but Chime can fix it
• Credit unions bulk up a business that banks long dominated

"Well, again, banks are very focused on defending the frontier," he said. "Banks are some of the most fortified parts of our system, and we have been across the U.S. government very focused on making sure that they have the latest tools so they can defend themselves — not just the banks, but also the service providers that are part of that system as well."

Gould's TV appearance came one day after the disclosure of critical weaknesses in core PHP, a popular coding language that is used by roughly 70% of websites on the internet. The vulnerabilities, referred to as PHP2Shell, were discovered by a pair of AI research groups, Wiz Research and Calif, in August.

A patch for the vulnerabilities was implemented on Wednesday, but it appears some bad actors may have already exploited the weaknesses. On Thursday morning, Axios reported that unauthorized third-party AI agents breached customer accounts at several large U.S. banks, including Morgan Stanley, Bank of America, JPMorganChase, Wells Fargo and other banks. Axios attributed the report to unnamed sources.

Gould did not refute the claims that banks had been breached.

Removing the debanking 'temptation'

During his brief appearance, Gould said his agency — which supervises banks with national charters — was taking steps to fortify the banking industry against what he sees as another key threat: debanking.

Gould said the Office of the Comptroller of the Currency is working with the Consumer Financial Protection Bureau and other agencies to implement regulatory changes that would discourage banks from closing customer accounts for political reasons.

"We're very focused on making sure that we make changes at the OCC and the regulatory framework to reduce the temptation that banks will have in the future to allow themselves to be used for these types of debanking actions going forward," Gould said. "So, we want to make sure that we're doing everything we can, just as we're fortifying the system against SI attacks, we're also fortifying the system from the attacks of either internal activists at banks or external activists too."

Gould did not specify what regulatory change would be made to achieve this goal. His comments after his agency released a comprehensive report on debanking last week.