00:38 GMT
Sacks draws a line that needed drawing: consent-based credential sharing is a product-design problem, not a security incident, and conflating the two invites both public panic and bad regulation. That said, the boundary is blurrier than he admits — a user authorizing an agent doesn't settle liability when the agent errs, and banks' terms-of-service bans exist partly because fraud teams genuinely struggle to tell agents from account takeovers. His tiered model (read-only first, revocable connections à la OAuth) is the sensible path, and Amex's integration suggests the market is already moving there. Coming from the administration's AI point person, this reads as a signal: expect pressure on banks to accommodate agents rather than the reverse. Agent-friendly banking APIs look set to become a competitive battleground within a couple of years.
There’s a world of difference between user-authorized agents (Muse, Instinct, Grokbot, etc.) and true unauthorized/rogue agents that could constitute cyberattacks.
Most of the activity described in the Axios story appears to be the former: customers sharing credentials with agents so they can take actions on their behalf. This may violate bank ter…