Loading story…
Cybersecurity and fraud-risk leaders are urging stronger, enforceable security controls as the U.S. Department of the Treasury develops AI cybersecurity and risk-management guidance for the financial sector. Reported expectations for the forthcoming materials include coverage of governance, data practices, fraud, transparency, and digital identity, but analysts warned that non-mandatory “principles” risk being ineffective as AI-enabled attacks increase. Recommended guardrails include mandatory adversarial testing, maintaining an AI inventory, model monitoring, and real-time identity validation, with specific concern for threats such as data poisoning of training pipelines.
In parallel, financial institutions deploying agentic AI (systems that can initiate payments, approve transactions, or freeze accounts) are being warned that traditional authentication models assume a human user and do not adequately address autonomous or semi-autonomous agents. Fraud and AML specialists are calling for managed, revocable digital identities for AI agents—ideally with cryptographic proof—and continuous trust approaches that validate not just identity but delegated authority, detect “scope creep,” and preserve traceability to both the authorizing human and the executing agent.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Cybersecurity analysts and public-sector security leaders urged Treasury to make its forthcoming AI guidance mandatory and enforceable rather than principle-based. They warned that concrete guardrails such as adversarial testing, AI asset inventories, model monitoring, and real-time identity validation are needed as AI-enabled attacks accelerate.
The U.S. Department of the Treasury, through its Artificial Intelligence Executive Oversight Group, began preparing AI cybersecurity and risk-management guidance for the financial sector. The planned guidance is expected to address governance, data practices, fraud, transparency, and digital identity.
Datos Insights' David Barnhardt said financial institutions need managed, revocable digital identities and continuous trust models for agentic AI systems that can initiate payments, approve transactions, and freeze accounts. He argued traditional point-in-time authentication is insufficient for autonomous agents and predicted fraud will shift from credential theft toward direct compromise of AI agents.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Enterprises and financial institutions are warning that **agentic AI**—autonomous agents that can initiate actions without continuous human input—creates new operational and security failure modes that existing governance and control frameworks are not designed to handle. Commentary aimed at CIOs highlights the risk of “AI agent havoc,” where always-on agents can trigger cascading business impact (e.g., unintended actions, compliance failures, and accountability gaps) that could translate into executive-level consequences if controls, monitoring, and escalation paths are not redesigned for autonomous behavior. In banking, fraud and identity experts describe a **“dual authentication crisis”** driven by AI agents that can autonomously initiate transactions, approve payments, or freeze accounts in real time. The core issue is that traditional point-in-time authentication (passwords/MFA) assumes a human actor; banks now need to validate both **intent** (did the customer authorize the agent to take a specific action) and **integrity** (is the agent operating as designed and not manipulated), shifting security from “verify identity” to “verify delegated authority and agent behavior.”
Jun 29, 2026
Multiple outlets reported growing adoption of **agentic AI**—systems that can autonomously execute multi-step workflows—across commerce and the public sector, raising new security, fraud, and accountability concerns. In e-commerce, AI “shopping” agents are increasingly able to initiate purchases and interact with merchant sites; reporting highlighted merchant complaints that automated agents can scrape product data without consent, generate inaccurate listings or images, and create fulfillment/pricing errors that damage customer trust while leaving merchants to absorb the operational and reputational impact. In financial services, commentary on **stablecoin** payment fraud argued that because many crypto transactions are effectively irreversible, fraud controls must shift “left” to *pre-authorization* blocking using **real-time AI** models tuned for high recall, supported by layered defenses and use of open blockchain telemetry. Separately, state and local government IT leaders are exploring agentic AI to improve productivity and citizen services, implying a need for stronger governance over autonomous actions, auditability, and risk controls as these systems move from pilots into operational workflows. One reference was a vendor/platform announcement and another was a broad societal-risk article on AI (deepfakes, opacity, labor disruption) that did not materially add to the specific agentic-payments/fraud/government adoption thread.
Jun 29, 2026
Banks and payment providers are warning that **deepfakes** and agentic AI are increasing fraud pressure on digital payments, particularly where identity verification, authorization, and anti-money-laundering controls depend on signals that can be spoofed. Deloitte highlighted rising concern that AI-generated voice and video can be used to impersonate customers and defeat banking verification workflows, while other industry reporting noted warnings that deepfakes could bypass AML and identity checks and expose institutions to higher account takeover and payment fraud risk. At the same time, firms are adapting payment infrastructure for AI-driven commerce rather than allowing autonomous models to move money without guardrails. Industry analysis said payments remain difficult for AI agents because settlement requires licensed intermediaries, deterministic execution, regulatory compliance, and clear liability for fraud and errors. Providers are responding with agent-focused controls such as wallet-based authorization, token protections, and abuse detection, reflecting a broader shift toward **constrained, supervised AI payments** instead of fully autonomous transaction execution.
Aug 4, 2026