Reading time ~14 mins

An ECB supervisor puts generative AI use at about 85% of banks and says its fuller AI-cyber assessment follows the action plans banks have just sent. The card industry's standards body says an AI agent that can reach card data sits inside a PCI assessment. Nate B. Jones reads last week's software tie-ups as one contest to run firms' agents, and argues that recognising a customer's agent does not settle what it may do. Oliver Wyman finds fewer than half of financial institutions with a board-approved AI risk strategy. Two attacks go after AI coding tools.

Regulatory

An ECB supervisor says about 85% of banks use generative AI and that its fuller AI-cyber assessment follows their action plans. Authority

Pedro Machado, a member of the ECB's Supervisory Board, gave an interview to Bloomberg that the ECB published on 30 October. Most of it was about securitisation. On AI, he said around 85% of banks already use generative AI, for fraud detection, know-your-customer documentation, transaction monitoring and credit scoring. He gave no definition or source for the figure, so it may count small pilots. Frontier AI models, he said, shorten the time between a flaw being discovered and being exploited. He called swift and effective patching, and the cyber hygiene of banks' systems, their biggest challenge today. He added: "A more meaningful and substantial assessment can only be made after we get the banks' action plans (by the end of October)." Those are the plans on AI-enabled cyber threats that the ECB asked every bank it supervises to send by 31 October. Asked about data-centre deals, he turned the question to how banks finance their AI exposures. This year's thematic review of underwriting standards examines data-centre lending phase by phase, from land and development to construction and operation, and how each phase is assessed and priced. He had no exposure figures to share. Asked whether AI agents hopping between the best deposit offers could create hot money, he said ECB research does not show that apps raised deposit volatility. Agents might amplify it in stress, he said, and banks could answer with personalised offers and dynamic pricing. On 29 October this brief carried another ECB supervisor, Patrick Montagner, on AI financing, so this is the same institution, not a second source. With the deadline passed, the supervisor's assessment now starts from what each bank wrote, and the one weakness he named was patching speed.

European Central Bank: Interview with Pedro Machado, Bloomberg

Perspectives

Nate B. Jones reads last week's software tie-ups as one contest over who runs a firm's AI agents Perspective

Nate B. Jones, an independent AI commentator, published an executive briefing on his paid Substack on 1 November, with a free preview and a companion talk the same day. It opens with three announcements no brief has carried. On 27 October Salesforce released software that lets it hand work to agents built with Copilot Studio, Microsoft's tool for building business agents. The same day Oracle said it is developing a workspace that brings its business applications into ChatGPT. On 28 October ServiceNow, a workflow software firm, announced a Control Tower Alliance whose founding members include OpenAI, Anthropic, Amazon Web Services and NVIDIA. Nate B. Jones writes: "These companies are helping one another reach their customers while competing to become the supplier those customers depend on to get work done across everything else they own."

For years, his preview notes, a business could buy Microsoft for staff's everyday work, Salesforce for customer relationships and Oracle for finance. Each supplier kept a large account by serving a different part of the firm. Nate B. Jones writes: "Agents give them a reason to pursue more of the work between their applications." In the talk he locates that work in people. Closing the month crosses spreadsheets, email and accounting systems, and someone has always read the email, checked the numbers and asked what changed. He calls the software that lets agents take this on a control plane, software for overseeing agents and sometimes coordinating their work. He compares its future place at work with the one Windows held in offices in the 1990s, and says nobody holds it for agents yet.

Better models do not settle the contest, he argues. In the talk he says firms have no interest in rebuilding what Salesforce gives them because a new model reasons better. A more capable Microsoft agent can instead make a process coordinated through Salesforce more useful, so both suppliers gain. Holding the data does not settle it either. Oracle is helping OpenAI become the place where a finance employee works through a question, and the next request may then start in ChatGPT too. Access is also not meaning. Connecting systems lets an agent reach the data, but someone still has to settle what the data means for the decision at hand. A customer record can be accurate and still miss a promise made in an email yesterday.

He also places the switching cost. Readers met his recruiter on 5 October, who taught her agent over time how she screened candidates and what each hiring manager wanted. In the talk he returns to her. When a change of AI provider came up, the candidate data was the smaller part of what she stood to lose. The rest lay in her instructions, her corrections, the skills she had built and the way her tools worked together. A supplier that keeps that kind of knowledge and makes it useful to more staff becomes hard to replace, he says, for good reasons.

His advice is addressed to buyers. The choices made under the heading of an AI control plane, he writes, will decide a lot about how useful a firm's agents are allowed to become. His preview proposes reading each partnership by what passes between the companies and in which direction the connection runs. It then proposes testing any offer on one real task, described the same way to every vendor, for authority, handoffs, failure partway through a job, portability, cost and availability. His title names the failure he has in mind, an agent that passes every demonstration and still credits a customer twice. For subscribers, the post goes supplier by supplier through what each brings and what its deals suggest it still lacks, and sets out how to stage the failure test on that one task.

He does not expect a single winner. In the talk he says finance may need controls that marketing does not, sees room for several winners and gives the market 12 to 24 months to show whether one emerges. He tells buyers to write interoperability into their purchasing requirements and not to default to the tool staff use every day. A firm that builds its own layer takes on a large build, he warns, and needs the money and the people to keep it running. His cases rest on vendor announcements, several of them previews or products still in development, and the briefing is argument rather than measured evidence. On 19 October readers had his test of withdrawing a permission while an agent's work is under way. This briefing widens that test to the whole purchase.

For Dutch banks the starting point is already set. On 16 October this brief carried Lindstead's finding that all six Dutch banking groups under ECB supervision run their mail on Microsoft 365. On 30 October Deutsche Bank described moving its corporate bank's agents onto one shared platform, Ada, with each agent's cost and risk in view. On his reading, either route decides what a bank's agents can later reach, and the choice is being made now, one agent at a time. Because the new partnerships let several suppliers each claim a piece of the same task, a demonstration of one supplier's piece no longer shows that the whole task can be finished.

Nate's Substack (By Nate B. Jones)

Nate B. Jones argues that recognising a customer's AI agent does not settle what it may do, and that whoever vouches for agents gains power Perspective

Nate B. Jones, an independent AI commentator, published a post on his paid Substack on 31 October, with a free preview and a companion talk an hour later. Its title and second half are a guide for consumers handing errands to an agent. Its first half looks at the same problem from the side of the business the agent visits. Nate B. Jones writes: "Black October showed how AI is making it easier to break into websites." He means the AI-assisted attacks and emergency software fixes of this month, which this brief covered with his earlier post on 26 October. Nate B. Jones writes: "Businesses need a way to let my agent do that without giving an attacker the same access."

In the talk he cites the US banks that said in recent weeks that AI agents are all over their websites. They cannot tell an enthusiast's agent from one a bad actor uses to break in, he says. Telling agent-driven use of a computer from human use is very hard from first principles, and not only for banks. Blocking every agent also blocks work customers want done. He therefore treats it as a question of authorisation. The site has to know whether it deals with an authorised customer, the payment provider what may be charged, and the assistant how to protect the account from attempts to redirect it.

His central distinction follows from that. Cloudflare, a web infrastructure firm, lets the system sending an agent's request attach a digital signature that Cloudflare can verify. That gives the site evidence of where the request came from. The site still has to decide whether that visitor may read a price, see a reservation or cancel it. A business that says it supports agents has said little, he argues, until it says what it admits. One service may recognise the sender and still want proof of the particular instruction, and another may allow research but stop at payment. Two systems cover the money side in his talk. Google's Agent Payments Protocol keeps a signed trail of what the customer told the agent to do and what it then bought. Stripe's shared payment tokens let a payment credential carry limits, such as one seller, a maximum amount and an expiry date. No agreed rules for agents exist yet, he says, and the market may settle on one scheme, a few or a patchwork.

Few businesses can tell wanted from unwanted agent traffic on their own, so in his view the firms that provide accepted connections will gain power. Nate B. Jones writes: "The companies that make legitimate agent activity easier to recognize and accept will gain power because consumers and businesses both need their help." He welcomes that work, and Cloudflare's stated support for open standards that leave sites free to pick their own identity, payment and agent partners. Nate B. Jones writes: "I also want those connections to be open enough that choosing a different assistant doesn’t mean losing access to the places where we live and work online." He adds a caution. During Black October, he says, Claude in some cases gave out people's email addresses when websites carried instructions asking agents to identify themselves. He cites no source, and the claim is unverified.

He points to one working case between businesses. On 20 October Visa, BILL, which runs business payment software, and Billtrust, a billing software firm, announced a live pilot. A buyer approves a supplier's invoice, and a BILL agent pays it through the supplier's portal. The receiving system recognises the agent, and the payment stays tied to the invoice. Readers had his reading of Amazon's block on agents on 30 September and his split internet on 19 October. This post turns from the agent to the gatekeeper. For subscribers, it adds what each of these trust systems leaves unresolved, and what a signed record of a customer's approval proves about a purchase.

Banks sit on both sides of his map. With Royal Bank of Canada's block on 29 October, this brief set out the three stances large banks now hold on record. Some refuse agents that borrow a customer's login, some admit them under a scoped protocol, and some admit them through the bank's own secured interfaces. His split shows that each stance is several decisions, one per action, from reading product terms to viewing an account to paying or cancelling. Admitting agents at all means relying on an outside party to recognise them, and that party is the one he expects to gain power. As a card issuer, a bank also meets the other half of his map, the payment records and credential limits Google and Stripe are building. Today's ECB interview reaches the same agents from the supervisor's side, with the question whether agents hopping between deposit offers could make deposits less stable.

Nate's Substack (By Nate B. Jones)

Oliver Wyman says fewer than half of the financial institutions it surveyed have a board-approved strategy for AI risk. Advisory

Oliver Wyman, the consultancy, published an article on 19 October arguing that a bank chief executive's mandate must include effective AI risk management. It cites the firm's 2026 AI Risk and Governance Market Study, which found that fewer than half of surveyed financial institutions have a board-approved strategy for managing AI risk. The article gives neither the sample nor the method, so the figure is the firm's own claim. It is a different study from the Oliver Wyman Forum survey this brief carried on 21 October. It argues that agents move risk from a model's answer to the whole path an agent takes. That path covers what it retrieves, which tools it uses, what authority it holds and what record its decisions leave. It proposes reusable controls for approvals, monitoring, evidence and escalation in place of a separate review for every use case. Among its questions for chief executives are what authority AI may exercise, how oversight can grow without second-line risk functions becoming an approval bottleneck, and what would make AI stop. Every deployment, it says, needs defined conditions for pausing, escalating, rolling back, containing or terminating agents. Readers had stop conditions from the Financial Stability Board on 16 October and the Hong Kong Monetary Authority on 20 October. Oliver Wyman adds a peer baseline at board level, and it is a question any board can answer about its own bank.

Oliver Wyman: Why risk management is key to scaling AI in banking

Security

The card industry's security standards body says an AI agent that can reach card data falls inside PCI DSS assessment scope. Corporate

The PCI Security Standards Council, which writes PCI DSS, the security standard for firms that handle payment cards, published an information supplement, Security Considerations for AI Systems, dated September 2026. Jakub Szarmach, who writes on AI governance, shared it on LinkedIn on 29 October. The supplement changes no requirement, but it reads the existing ones for AI. It defines an AI system as the model plus its tools, memory and orchestration. Any AI system that can reach card account data, or has unrestricted connectivity to systems that hold it, is part of the cardholder data environment, the set of systems a PCI assessment covers. Encrypted or tokenized card data counts as readable when the agent can also reach the keys or the system that reverses the tokens. An agent cannot perform multi-factor authentication, so it needs credentials of its own, tied to a device and limited in time. An outside AI provider with access to card data is a third-party service provider, with a written bar on training on the firm's data. An agent's logs, notes and working memory count as data stores.

The design advice rests on one premise: treat any AI system as a potential malicious insider, held by limits enforced outside the AI itself. No single AI system should combine sensitive data, untrusted input and outside communication, a mix the supplement calls the lethal trifecta. Its worked example splits vulnerability management across separate agents for triage, development, testing and deployment, and only the triage agent may reach the internet. Jakub Szarmach writes: "That is much more useful than another abstract list of AI principles." The supplement does not cover agents that make payments for customers. Readers had inventories, owners and kill switches from the Financial Stability Board on 16 October and the Hong Kong Monetary Authority on 20 October. This is the first text to say how agents enter a card-payment assessment, and it comes from the body that writes the requirements assessors apply. It is not law, since PCI DSS binds through card-scheme rules. For a bank that issues cards, each agent pilot near fraud, disputes or card servicing either sits inside the next PCI assessment or needs isolation an assessor can test.

PCI Security Standards Council via LinkedIn (shared by Jakub Szarmach) (LinkedIn; original source not verified)

On the radar

• CrowdStrike, a security vendor, reported on 29 October that a group it calls VAPOR PANDA has used AI agents against more than 200 organisations since 17 October, and separately against US firms including financial ones. CrowdStrike

• Symantec reported on 29 October that an unauthorised relay service, used at about a dozen organisations, runs genuine OpenAI and Anthropic coding agents with their safety limits and activity reporting switched off. Security.com

• Symantec reported on 15 October that newer samples of the Aoki infostealer, malware that steals logins, now take saved tokens and session files from AI coding assistants such as Claude, Codex and Cursor. Security.com