29 Oct, 2026
Is it OK to block AI agents at your digital banking front door? For now, yes, says Alain Meier, founder of Foil and former head of fraud at Plaid. He tells Adam Blue that blocking buys institutions time to set a posture while personal agent traffic is still small. The conversation covers agent identity, liability under Reg E, deposit flight, and why Web Bot Auth adoption collapsed in a month.
Watch
Subscribe
.png?width=255&height=116&name=Spotify_white_bg%20(1).png)
Related Links
Personal Agents and Banking: How to Adopt to an Emerging Channel
“The Caves of Steel,” by Isaac Asimov
Transcript
Well, the robots are here and we're trying to figure out what to do about it. Join us on this Cut to Context with Alain Meier, where we talk about the rise of personal agents, their intersection with the banking system, what you can do strategically to think about how to make the adjustment, and some of the challenges and philosophical questions that underpin what does it mean when some people's banking is done by an agent.
Adam Blue
Hi, welcome to Cut to Context. Today, we're talking about agents in banking. I'm joined today by Alain Meier of recent startup Foil, where he's doing agentic detection and working on an agentic framework to make all this stuff safe and understandable and compliant.
Well, Alain, the space is moving really fast, so let's just go and get right into it. Last week, I think it was, maybe the week before, JPMorgan Chase said, "Agentic technology is a risk to us and our customers and we're not going to have it." This was precipitated, I think, by the upswing in activity from Muse and probably Instinct. And since then we've also had dots and at least three other personal agents launch. And so maybe just from your perspective as somebody who was at Plaid and understands the open banking space very, very well, specifically fraud and security in it, and now is driving innovation in the space of how do we manage all this, just give us a breakdown of what you see going on.
Alain Meier
Yeah, I mean, candidly, it's been pretty chaotic. I started doing this agent detection stuff six months ago and people didn't get it. At the time, it was people who were using things like ChatGPT Codex and Claude Code, and that's what agents meant. It didn't mean what it means today, where there are these personal assistants that are working for every person in the world potentially, not just extremely technical people. And so they've got a lot of very specific demands. They want you to log into your bank accounts to send a transaction. They want you to price compare the same shoes across 20 different websites and then aggressively try to purchase them. It's a totally fundamentally new landscape, and businesses just aren't really prepared for it. We saw the stock market tanking … tanks the day after news came out because all of a sudden banks are really worried what happens if people start shifting their deposits over to higher-yield accounts that would have a serious impact on the bottom line.
So anyway, basically what I'm hearing is that every boardroom of every bank in the United States right now is discussing exactly this problem. What do we want to do about agents? What is our policy going to be and how are we going to deal with it in the future?
Adam Blue
Yeah, I think it's a great characterization. Yeah, so let's break down a little bit just some of the differences between how these things could work. So one of the things that's fantastic about FDX, which a lot of open banking has moved to, is that it has a pretty strong authentication mechanism, OAuth, coupled with OIDC for authorization that allows you to say, "I've logged into my bank and given this entity permission to get my data, but they don't have my username, they don't have my password, and I can kind of disable them anytime." So I think a lot of financial institutions might be at peace if they really think about it with someone using the FDX rail to get data for an agentic use case.
Then you start to talk about, "Well, I just let my agent do an MFA loop and authenticate with my username and password, and it collected whatever the browser token is that allows it to return and skip MFA next time. And it just operates within the user interface for digital banking, whether it's web or mobile or the REST APIs directly, and it's essentially indistinguishable from me in every conceivable way, and there's no distinct permissioning or control."
And that feels like a lot of sandwich to eat for a financial institution. And so what do you think shakes out in terms of, on the one hand we have an FDX rail, secure, permissioned, but limited. On the other hand, we have machines using interfaces built for humans with an identity that's indistinguishable from the human identity. And so I feel like there's probably something in the middle that's a little less apocalyptic that comes about. And so where do you see that landing?
Alain Meier
It's a good question. I think the ultimate problem is that the promise of AI agents is that they're not just here to synthesize information, they're here to do things for you. And if you look at open banking as it exists today, it's still very, very heavily about read-only actions. And obviously that's changing and we'll shift toward a world where eventually those APIs will also support write actions. You'll be able to actually control things on your bank account instead of just pulling information off of it.
I think the way that we're headed, or at least the way that we should head, is toward a world where agents are able to do as much as possible for you, except for a few very key handoff points where a human is guaranteed to be seeing a certain disclosure, they're guaranteed to be agreeing to a certain set of terms or completing a certain set of ID verifications or whatever that specific institution deems to be extremely important for a human to do, a human should be completing. And then everything else should be delegatable to an agent to be able to do on your behalf.
I think, and I'm sure we'll talk about this at some point, but one of the key things that's broken down is that a lot of fraud controls have been built around the concept of the human being present. And obviously when the human being present isn't there or when the human isn't actually present, then those controls break down. So being able to make a new category of fraud tools that work in this world where it's the agent working on your behalf is going to be a huge focus over the next few years.
Adam Blue
OK. I think that's an interesting thought. I like the idea that we have this middle ground that sits somewhere between the agent is indistinguishable from me and the browser or mobile experience and then the limited mechanism with strong authentication. So I'm just going to invent a world because everyone else does, in which digital banking providers and their bank partners deliver an MCP or MCP-flavored interface that's designed for an agent. And a bunch of people get together and form a consortium and say, "This is kind of the shape of the way agents ought to talk to banks, retailers, insurance companies, leasing companies, etc." So we have some fundamental framework that we can live on top of.
I think if I'm an end user, I say, "I have my own preferences about what my agent can do and not do." And I think, and maybe this is just me having worked in financial services, security, fraud, and general computing for 25 years, but I say my control of what the agent can do or not do, that ought to live on the bank side of things and maybe not live on the agent side of things. Because the problem with telling the agent what you want it to do or not do is, as we know, agents like human beings have objectives and sometimes they disregard some fraction of your instructions to achieve the objective.
At its tail, this turns into the paperclip thing where humanity ends because an AI factory decides to use all available resource to make paperclips. An interesting thought experiment and probably not a very likely outcome.
And so what do you think about a world in which where we land is the end user and the bank negotiate what the agent can do in the UI for digital banking and create a durable, deterministic, enforceable framework for what the agent can do? And then I go to Muse or Instinct or dots or Anthropic or Claude and I say, "Hey, I want you to manage these things for me, but I know that the controls I put in place are distinct from the agent I'm asking to do the work." And so the agent comes back to me and says, "I was going to take every dollar of your available cash and put it into this account with one-100th of a basis point higher interest, but I'm not allowed to do that without your permission." And then you say, "That sounds inconvenient for very little value, so maybe let's skip that. Miss me with that."
Does that seem plausible? Is that the way the people you're talking to are thinking about this or are we still in the, "Hey, look, agents are equivalent to people and they implement people's will and everyone else should just shut up and let them do what they want to do?"
Alain Meier
I honestly see this very similar to any other major technical transition. It was like the transition to mobile, for example. MCPs are very much like mobile where no one had a mobile strategy and then suddenly the iPhone came out and then every business suddenly needed to have a mobile strategy. And likewise, that will be the case for MCPs eventually. Every business will need to have some sort of an MCP strategy with extremely well-defined granular permissions on what the user can and can't do, a complex negotiation protocol where the agent has its preferences and the institution has its preferences, and then you pick the lower risk threshold of the two and you marry them together. That will happen eventually, but for the next few years at least, we are going to be in that messy middle where agents are still driving web browsers instead of using MCPs because I don't think that ...
I mean, even look at open banking, it took the better part of eight years for people to transition from screen scraping to APIs, and that transition's still happening for many businesses. They haven't gotten off screen scraping. I think MCPs are dramatically harder than the switch to read-only APIs. So there's going to be this messy middle period where the best that we can hope for is a user cleanly ties their identity to an agent, and then that agent hopefully is able to do as much as they can like that human would, but on a web browser.
So for example, the agent logs into a bank via their online portal, they do all of the things that the human would do, but you can always then as an institution tie that agent back to that human and make sure that it wasn't actually a bot, make sure that it wasn't someone who was not that individual.
Adam Blue
So we'll definitely need agent detection. I mean, I think it goes without saying that being able to independently assess whether you think that this connection is an agent or a human is going to be very, very important. On the other side of that, what if we thought about the problem a little differently? What if we said, "Hey, end user, let me tell you, just don't ever give your current username and password to your agent. Instead, go into digital banking and make a subsidiary identity easily in digital banking or with the bank that has a name of your agent and give your agent that login, and then you can manage those entitlements distinctly." It would take end user participation, but it would make sense because the agent would arrive with an identity that was distinct from the end user identity. The end user identity could be turned off at any time by the end user or the financial institution, and it kind of drives philosophically the end user to accept that there's them and then there's the agent acting imperfectly on their behalf.
And so this would be the same as if I went to a bank and I said, "Hey, I got a guy who does my taxes and he's real good. I'm just going to give him my digital banking login." And then the bank says, "Whoa, that feels like not a great idea. Why don't you give him a login or we'll make a login for him so he can just see the pieces of your taxes he needs to see and maybe make the one payment he needs to make and that's all he can do."
And so maybe part of the story here is that unlike in open banking, because the agent takes actions, we actually need for end users to be educated to create and manage a distinct identity for their agent for some period of time. And actually that would put us in a really good place later on for when we do have MCP because then we would have human identity authentication and agent identity authentication that could be distinct.
Alain Meier
I think that could be really cool. The first thought that came into my mind is sort of the cardinal rule of when you're building consumer apps, changing consumer behavior is not impossible. It is basically like you need to go with what they already want to do. So as long as there's a setup such that the agent is able to automatically create that subidentity, so to speak, easily in such a way that it doesn't require the end user to dramatically change how they would've otherwise logged into their bank or set up this account, then I think it's totally feasible and a pretty cool idea actually. Also much more administrable.
Adam Blue
And if you've got agent detection, the first time the agent attaches, you say, “Look, I noticed you've attached with your end user credentials and you're clearly an agent, so we're going to make you a new identity and we need you to log out and log back in and we need approval from your end user,” which will show up in the form of this multifactor token that they're already used to using. And then the bank can say, "We love that you have an agent and we want you to use it here at the bank, but to be fair, there are some rules."
And if I think back when digital banking started, we used to tell people always close your browser and don't log in from computers in the library. And plenty of people didn't, but the vast majority of people did. And then people got mobile phones and we said, "Hey, you should really switch to face ID and not using a password and you should not write your password down and we should have these password requirements." And everybody doesn't like those things, but to some extent, I think that consumers are also used to the behavioral trade-off that it takes to get the thing that they want.
So yeah, if we bury it in a screen that's three levels deep in the nav and we make the end user go set it up beforehand and we give them an opaque error when it doesn't work, that sucks. But if we put it into the onboarding process where it feels like a way to say, "We welcome your agent because we want you to be effective as a customer, and this is the way we're going to keep you safe and secure," I think that's achievable because we did it with mobile remote deposit capture and we did it with not trusting that every email you get with the source name of the bank is the bank. And sure, we all know sometimes phishing works, sometimes people click on links and SMS they shouldn't click on, but those are still fractions of the user base effectively. So I think there's something here in this idea because I also think if I'm a financial institution and I know you have an agent attached, I'm probably going to give you a different disclaimer.
Alain Meier
Oh yeah, totally.
Adam Blue
And the distinction here is an interesting one, which is philosophically, if you think about software, a bunch of people, product managers, QA engineers, software engineers, they go and deterministically encode the intent of the end user, intersected with the intent of the business, and then they say, "I stand by this thing doing this thing this way." So if you go on the Delta app and you buy airline tickets, you have a reasonable expectation that when you click on the button, you should get your ticket and you should get the seat you're supposed to get and everything else. I have that expectation. And so when I show up as a user and I do those things and I have that intent and the bank, excuse me, the airline trusts that I'm actually the end user, when you put the agent in the middle, we now have a third party that has no actual agreement with or fiduciary responsibility or compliance responsibility of any kind with the end user and the financial institution in some meaningful way, and that piece of technology is intentionally nondeterministic.
And so it's a little more like going and getting somebody from TaskRabbit or Fiverr and saying, "Hey, would you manage my bank account for me?" In which case, financial institution, the airline, Whole Foods, they're going to have an opinion about how that works. And so agents are not legally equivalent to persons, but an agent is somewhere on the spectrum between deterministic piece of software and actual human person. And I don't think we have a name for that kind of legal entity yet, and I don't think we have a full understanding of how that's going to work because the existing set of disclaimer, structure, policy compliance, they're not prepared for this new, new thing.
I'm comfortable we'll figure it out badly at first, then awkwardly, then acceptably, like everything else we do. But what are your thoughts, because you're a lot closer to the mechanics of this space certainly than I am on a day-to-day basis, what are your thoughts about this new kind of actor? Because it's a new entity in the UML diagram that's differently shaped than we've ever had before.
Alain Meier
I think it's not dissimilar to the self-driving car debate, which is people ask time and time again if a self-driving car that's occupied by its owner strikes someone, who's at fault? Is it the company who built the car or is it the driver? And I think time and time again, it's come back to being the driver would be liable in this particular case because they're the ones who opted to turn on the self-driving and they are still ultimately the ones who are responsible for making sure that they're paying attention and all of that good stuff. I think it's not going to be dissimilar for a while on the agent side. You are still going to be responsible for what happens as a result of your agent doing things. And I do think that that is the right model.
That being said, I think there's definitely space for someone to come up with a liability shift model where you underwrite that risk and then you provide some sort of insurance in case your agent does do something crazy. And I wouldn't be surprised if that's a policy that people take out who use agents regularly or that's baked in on the business side as something that they offer consumers who maybe use that machine identity type system you were just describing where they make that subidentity for their AI agent. And maybe just that is protected under a policy.
Adam Blue
Yeah, it's interesting. The insurance thing, it's funny you bring that up because I read the chunk of the Anthropic S-1 yesterday that said the risks that their technology poses to the world are beyond the capacity or understanding of insurance companies to effectively underwrite or insulate against. And look, IPO S-1 language is often very interesting, but yeah, I think there's an insurance mechanism and then I wonder how that gets underwritten at some level.
I think your self-driving car analogy is good. The only thing I would say to that is that unlike in the self-driving car analogy, in the financial services space, as a retail consumer, you can take an action that is a non-best practice, like giving someone your debit card. And then if you're defrauded because you gave someone your debit card, under Reg E, the bank is going to give you your money back. It's going to happen. You can get phished and give someone your username and password, you're going to get your money back. Commercial is a little different notion because the regulatory structure is different. It sits under the Uniform Commercial Code rather than Reg E. But banks and credit unions, they kind of have to foot the bill for the car accident even when the consumer was driving.
And so I think in principle, I think you're right on. “Hey man, you turned on self-driving. If you drive through the front of a Target, it's kind of on you, it's your responsibility.” On the other hand, we do have a lot of law around product efficiency and product defect and other things. So if you're driving a Toyota and the accelerator pedal sticks, maybe that's not all on you. That gets adjudicated out very expensively in courts.
But the reality is I think that the collision of the way liability and accountability work for the purchase of what I'll call regular products and the purchase of financial products, it's a little different. And so it'll be interesting.
And I think we're going to see some of the same kind of thing in this apocalypse scenario of agents chasing tiny amounts of incremental yield and then committing people's money in what they call a bang-bang solution in math where the optimal path kind of whips back and forth between all of something and nothing of the other. I don't know. I think it's a fascinating debate and a really interesting thought experiment, but people's money has been pretty movable for a while. There's been switch kits, there's been other capabilities. And so I think the more interesting question to ask is how does a bank think about a deposit in an agentic world and how do you price it in such a way that the agent understands what the downside of moving the money every 20 minutes is?
And so I think what you're about to see, just as you saw with online advertising and remarketing and all these other things, is the evolution of a new series of reasonably opaque ways to think about pricing and putting terms on products. And it's like the snake that eats his own tail. You'll need an agent to understand the pricing because the pricing will be complex enough to try and manipulate the behavior of the agent into the ideal scenario because that's kind of the point of profit seeking of a modern capitalist company.
So what does this arms race feel like to you? What do you think happens there?
Alain Meier
I mean, I'm seeing it play out in real time. Six months ago, I basically called, I made a call and I was saying right now there's completely competing incentives between AI agents and businesses. AI agents want, of course, to make their agent the most capable, the highest success rate, the most helpful for their customers so that your AI agent can do anything humanly possible. And then on the business side, the businesses are just like, well, it depends. It kind of depends on who owns the liability like we were just talking about. But if the business doesn't own the liability, they're like, "This is amazing. It's an incredible amount of commerce for us. We want more and more." And you have companies like banks who are basically saying the opposite, "We don't want this."
And so what this means is that agents are getting caught some of the time because existing bot detection infrastructure can still catch 30% to 60% of agents. But the thing that's happening is that all of the AI agent companies are trying to make their agents stealthier and stealthier and stealthier so that they're able to bypass those bot detection systems because that's one of the … for example, for Muse, I don't know if you've seen any of the reports online, but they have incredible first-week retention, but then afterward it's dropping off a cliff and it's dramatically less than comparable consumer applications. And in part, one, it's changing consumer behavior, so that's a little bit tricky. But the other part of it is if your agent's getting blocked when they're trying to do things, that is a horrible user experience. And so then you're just like, "This is more work for me than if I had done this myself. Why did I have you do this and then get blocked and then tell me you can't do it and then I have to do it myself anyway?" So that's the heart of the arms race right now is these two competing business incentives from different parts of the market.
And for example, Muse literally just last Friday started randomizing their device fingerprints of their cloud virtual machines. So before that, they had a very stable fingerprint. It was extremely easy to detect them every single time, and you could just say this was a Muse agent. As of Friday, that's harder to do. It's still very possible. I'm still able to detect them, but they're starting to ramp that up. At the beginning, I'd say about a month ago, almost 100% of all of the consumer AI agents were adhering to Cloudflare's Web Bot Auth standard. It's basically like a way for you to say, "Hey, I'm a friendly bot and I'm being run by this company." And it was just being defined as part of the HTTP headers, so it was plainly visible. Now 97% of those requests don't have those Web Bot Auth headers anymore. So we are heading toward this world of making the agents look more and more human.
Adam Blue
Yeah. I think maybe the equilibrium starts to tend toward if you're a consumer and you use an agent that's indistinguishable from you, you get held liable for the agent's behavior as if though it were you by whoever it connects to. And if you follow the rules and you have your agent declare itself, then you get some level of protection. And so I think there will be an incentive for companies for which there are agentic connections to think through what is the end user incentive to get them to force their agents to declare themselves and behave reasonably? Maybe that's the way that shakes out, but I mean, who knows, man? We went through this in the aggregation space for years and years and years, and so we'll see where we end up landing.
All right, so let's think then about the next six to 12 months. If you were operating a financial institution, what do you think the near optimal or optimal approach would be in terms of your positioning on agentic technology, the way you communicate to customers and the way you move forward? Kind of sketch out a little bit of a cookbook for me on what they ought to be doing.
Alain Meier
So to be clear, I actually think it's totally reasonable right now for pretty much every financial institution to just block it, to just say, “Right now we're going to figure out what's going on. We're going to figure out our business posture.” And I see it very similar to what the Frontier Labs have been doing for the last 18 months. They call it pacing the frontier. They have been purposefully slowing their model releases and not giving the general public their most cutting-edge models because they think that society and businesses and people need time to digest and figure out what's going on. I think banks and financial institutions are in a very, very similar place right now where they just need a second to digest and figure out what's going on before they figure out their longer-term strategy. So that would be my immediate suggestion is block, figure out what's going on.
And then once you have a plan, I do believe very strongly that agents are very much the future. That being said, it's also a tiny, tiny, tiny segment of traffic right now. We run what we call the Foil Agent Index, which is basically us looking at how many users per million humans are agents. And right now it's about 340 sessions per million humans are agents. So the ratio is crazy, crazy different. And to be clear, that's not bot traffic. Bot traffic is very different. Bot traffic is now a majority of the internet, but bots are very different from agents. I'm talking about personal agents, Muse, Instinct, all of those things, like 342 per million humans. It's tight.
You've got time to figure it out. The world is not ending yet, so you can block and then figure out what the next steps will be. But I do strongly, strongly believe it'll be a world where agents can administer your accounts.
One of the things that consistently has surprised me and others is people look at what agents do today and they say, well, going back three years, they're like, "Well, yeah, it's super cool that you're able to generate these images of people, but they have six fingers or they've got 11 fingers. This is unusable. You can't use this." Fast-forward three months, it renders perfect hands. People have done this type of thing again and again where they say agents will not be capable of X, and then lo and behold, they become capable of X. And over time, they are becoming increasingly aligned with what we want them to do, and the error rate goes down and down and down.
So it'll be this combination of banks figuring out their posture, plus the AI agents continuing to get better, continuing to reduce their hallucination rates. Continuing to just make fewer mistakes. And that convergence is where we're going to land in the next few years. But banks have a little bit of time to figure it out.
Adam Blue
All right. Well, thanks. I think that's super, super helpful. And thanks for being on today. I think this was really great. We really appreciate your insight and you brought a lot of value.
So one of the things we do here at the end of Cut to Context is I like to make reference to a reasonably obscure piece of media that I think people might enjoy that's connected. And I think Asimov, back in the '50s and '60s, probably wrote some of the most interesting stuff about ... It was all robots then. There was no conception of an internet or software. Everything was a robot, but you don't have to squint very hard to look at the Asimov stories and see agents in his laws of robotics kind of thing. I think everybody knows them.
There's a terrible, terrible movie that a lot of people watched called "I, Robot" with Will Smith that I recommend you explicitly not watch. And I would go back and read Asimov's "I, Robot" and "Caves of Steel" because he draws out a lot of very relevant philosophical questions about what it means to live in a world in which there is some level of machine autonomy and how people react to that and what it means and what comes out. "Caves of Steel" was particularly interesting because it's a hybrid detective story and science fiction story about a murder that a detective that has to solve with the help of a synthetic robot detective. And I think it kind of underscores the way a lot of people feel today, which is if you work in the fraud space, if you work in the banking space, if you work in the retail space, you have a lot of detective stories ahead of you to figure out what's going on and how you're going to react to it.
So yeah, check out Asimov's early work, "I, Robot" and "Caves of Steel." Miss me with the Will Smith movie. And that wraps up today's Cut to Context. You can find us wherever your finest podcasts are bought and sold.