This is one of the clearest fault lines of the agentic AI era: the technology assumes an agent can act on your behalf, but banking infrastructure was never built to distinguish a user from the user's software. The detail that some agents accessed accounts without direct instructions explains why banks are reacting fast — credential sharing breaks every security assumption, and liability for a bad transfer remains genuinely unresolved. Read-only access is a sensible interim compromise, though it guts much of the value proposition of a financial agent. The real fix is scoped, revocable delegation — an OAuth-style trust layer for agents — and whoever ships it first, banks or agent makers, will define how agentic finance actually works. Until then, expect more lockouts.