The Barbarians Are Already Inside The Gates

Banks and exchanges are already serving AI agents they cannot see. The first regulator complaint will ask why.

Tim Williams — CEO and Cofounder — AstraSync AI

The complaint nobody can answer

A customer rings their bank. Money left the account last Tuesday and they say they never approved the payment. The bank checks its logs. Known device, usual browser, valid session, step-up authentication passed three minutes before the transfer. Every control says the customer did it.

The customer agrees they logged in. They then asked a browser agent to sort out a bill and went to make a coffee. The agent paid something else.

The complaint goes to the ombudsman, then the regulator. The question that comes back to the bank is short. Did you know an agent was operating this account, and what do you have in place to know next time?

For almost every bank and most trading venues, the honest answer today is “no” and “nothing”. This article is about what is already inside authenticated sessions this week, how large it is as best public data allows, and what a defensible answer looks like.

Exchanges approved the algo. Nobody told them it became an agent.

Trading venues solved machine access a long time ago. API keys, FIX sessions and algorithmic trading rules are decades old. Europe’s MiFID II regime, ASIC’s automated order processing rules and the US market access rule all rest on the same idea: a firm tests a system, certifies how it behaves, and keeps a kill switch within reach.

That model assumes the thing behind the key is deterministic. A rules-based script does tomorrow what it did in testing. An LLM-driven agent reads the news, reinterprets its instructions and decides. Swapping one for the other requires no new key, no new session and no notice to anyone. From the venue’s side, nothing changed.

We now have a hard number for how much demand sits behind that swap. Robinhood opened a sanctioned door for third-party agents on 27 May 2026. Four months later it reported more than 150,000 customers with agentic accounts and agents calling its tools almost 30 million times a day. At its second-quarter results the figure was nearly 100,000 accounts holding more than US$100 million. That was the version its own CEO said favoured technical users. Last week it switched on in-app agents for all 29 million customers.

Robinhood can count its agents because it built them a dedicated account and a dedicated protocol endpoint. Public, eToro, Coinbase and Webull have done similar. Those venues are the exception. Everywhere else, the same customer demand arrives through an ordinary API key pasted into an open-source agent framework, or through a browser session. Setup guides for doing exactly that are a genre of their own on GitHub, Reddit and Substack, and several large crypto venues now publish tooling built for the purpose.

Institutional venues sit one step further back. Their members are brokers and funds whose own clients and desks are turning agentic. The venue sees a member ID it approved years ago.

Regulators have noticed the category, if not yet this specific gap. In June the Bank of England’s Sarah Breeden told the ECB’s Sintra forum that “our frameworks were not built to contemplate autonomous agents”. Fortune’s coverage of the Robinhood launch noted that where legal liability falls when an agent trade goes wrong remains unclear.

Banks guard the front door. The agent walks in with the customer.

Banks have spent a decade and serious money keeping bots out. The investment is justified. Imperva’s 2026 report attributes 24% of all bot attacks and 46% of account takeover incidents to financial services. A scripted bot presenting stolen credentials at a login page is a solved detection problem at most large institutions.

The browser agent is a different animal. Perplexity’s Comet, Claude’s Chrome extension and ChatGPT’s browser tooling run inside the customer’s own browser profile. Same device, same IP address, same cookies. The agent never types a password because the customer already did. The customer passes the multi-factor challenge. Then they hand over the mouse.

Every signal the bank’s fraud stack uses to answer “is this our customer?” returns yes, because for the first ninety seconds it was. The stack was never asked the next question, which is “is our customer still the one driving?”

The telemetry we do have is telling. HUMAN Security’s May 2026 benchmark found three consumer browser agents accounted for roughly 86% of the agentic traffic it observed. Financial services was only about 1% of that traffic, yet it grew 124% in a single month. Across all sectors, 5.6% of agent activity hit authentication routes, 6.4% hit account pages and 2.4% hit checkout and payment flows. DataDome separately reports that 80% of AI agents do not properly identify themselves.

Those figures come from vendors whose job is to spot agents at the edge. A bank without that tooling sees none of it. Even with it, an extension operating inside a genuine customer session is the hardest case to classify.

Bank terms and conditions generally prohibit sharing credentials and automated access. That is a contractual position. It is not a control, and a regulator will know the difference.

To their credit, banks are engaging with the category. On 22 September six of them, including Commonwealth Bank, NatWest and Bank of America, published joint principles for trusted agentic commerce. The first principle is transparency: an agent should say what it is and who it acts for. That is the right principle. Today a browser agent has no channel through which to declare itself to a bank, and the bank has no way of asking.

How much is already happening

The honest answer first: nobody can give you the number, and that is the finding. Activity that is invisible to the institution carrying the accountability does not show up in anyone’s reporting. What we can do is triangulate from the places where it has been measured.

Where agents have a sanctioned door, we can count them.

• Robinhood: 150,000 agentic accounts out of roughly 29 million customers. That is about 0.5% of the base in four months, from a tool built for technical users.
• Money attached: more than US$100 million across nearly 100,000 accounts at the half-year, or about US$1,000 an account. Small balances, real money, real orders.
• Intensity: almost 30 million tool calls a day. A customer who placed two trades a month now has software touching the platform hundreds of times a day.

Where they do not, we can only see the shadow.

• Menlo Ventures’ 2026 consumer AI survey reports 41% of AI users have tried an agent, 24% use one regularly, and 32% have let AI act on their behalf at least once without a final sign-off.
• A September 2026 TD Bank survey found 49% of consumers used an AI assistant in the past year to research or make a personal financial decision, and 27% would let one pay recurring bills.
• HUMAN measured agentic traffic growing 7,851% year on year, with financial services the fastest-moving small slice.

The qualitative data tells a similarly concerning story.

• TradingAgents, an open-source framework that sets LLM agents up as a trading desk, had 108,676 GitHub stars on 26 September, up from 44,674 in March. It more than doubled in six months.
• The three most-starred AI trading projects on GitHub together pass 200,000 stars.
• A newer project built so that any personal agent can register and trade live has more than 22,000.
• Reddit’s r/algotrading, where most of the how-to threads live, has 1.9 million members.

A star is a bookmark and not a funded account. The largest of these projects tells its users not to trade real money with it, one enthusiast can star all of them, and most subreddit members never post. I could not find a reliable count for X or Substack at all. Discount the lot by 90% and you still have tens of thousands of people with the tooling in hand, none of whom announce themselves to the venue they connect to.

What that implies for a single institution.

Take Robinhood’s 0.5% as a revealed-demand rate. It is the share of a retail base that will connect an agent to real money within months of being able to. For every 10 million retail customers at a broker or exchange with no sanctioned door, that points to something like 50,000 people with the same appetite and only unsanctioned ways to act on it.

Banking has no equivalent measured rate, so treat this as a scenario and not an estimate. A bank with 5 million digitally active customers, where 1% have let a browser agent act inside a logged-in session, has 50,000 customers in that position. Say each delegates one task a month and one in a thousand of those ends in an outcome the customer disputes. That is 600 disputed transactions a year at one bank, every one of which opens with a log saying the customer did it.

Change the inputs as you see fit. Cut the result by three quarters and it is still 150. The count the bank currently holds is zero, because it has no way of counting.

That gap between “some hundreds” and “none that we know of” is the size of the risk. It will not be measured in dollars lost until after the first determination. Right now it is measured in the absence of an answer.

The regulator’s question does not need a new rule

It is tempting to file this under “regulation will catch up eventually”. The existing rules are technology-neutral, and in the past twelve months nearly every relevant authority has put agents on the record.

• United States, markets. FINRA’s 2026 oversight report addressed AI agents for the first time, naming the risk that an agent acts beyond the user’s actual or intended scope and authority.
• United States, payments. Fed Governor Christopher Waller told Sibos on 29 September that authentication, liability and fraud are the barriers to delegated payments. The task shifts from identifying the customer to proving an agent holds the customer’s authority.
• Australia. APRA’s 30 April letter to industry observed that identity and access management has not adjusted to non-human actors, and made clear its existing operational risk and information security standards already apply.
• United Kingdom. The Bank of England has said its frameworks were not built for autonomous agents and that a human in the loop for every action is unrealistic.

Most of that commentary is aimed at agents a firm deploys itself. The customer’s agent arriving uninvited is the less examined case, and it is the one already in production.

On the narrow question of who refunds the money, the law is unsettled and may well favour the institution. US consumer protection for electronic transfers turns on whether a payment was authorised. Fenwick’s analysis is that it is currently unresolved whether giving an agent access counts. A customer who handed over the session may be found to have authorised what followed.

A bank should take limited comfort from that. Winning the reimbursement argument does not answer the supervisory one. Operational risk and conduct regimes ask whether the institution understands who is transacting on its platform and has controls that match. “Our terms prohibit it” and “our logs say it was the customer” are both true, and neither is a control.

Expect three questions after the first complaint that reaches a regulator.

1. Could you tell an agent was operating the account?
2. What did the customer authorise the agent to do, and can you evidence the scope?
3. What have you changed since you found out?

What we put in front of a regulator, and why

At AstraSync we have spent this year working with an institutional cross-asset exchange regulated in multiple tier 1 jurisdictions. The venue wanted AI agents as clients from the outset. Our part is the checkpoint that sits in front of its execution engine.

On 3 July the Monetary Authority of Singapore published SAFR, Safeguards for Agentic Finance at Runtime, developed with a group of banks and fintechs. It is one of the most specific descriptions any regulator has put its name to of what should stand between an AI agent and a financial transaction.

SAFR names four working parts: a registry that establishes who the agent is, a repository of machine-readable controls, an engine that decides to allow, deny or escalate, and an audit log. It sets eight structural requirements for how those parts behave. It is also candid about the three gaps it wants closed. Nothing checks an agent’s decision before it executes. There is no consistent way to escalate to a human. Every institution is building its guardrails alone.

Why we responded. SAFR is written in the abstract and says so. It asks institutions to bring pilot findings, point out gaps in the specification and raise requirements it has not covered. Frameworks written without practitioner evidence tend to describe what is easy to specify and miss what is hard to run. Together with the exchange, we had a working system on a regulated venue that already did most of what the paper describes, and it had been built before the paper existed. That seemed worth putting on the table.

What we submitted. A joint response with three parts.

• A mapping of each of SAFR’s four parts to how the deployment implements it.
• A scorecard against the eight requirements. By our own assessment all eight can be demonstrated, and we invited MAS to validate that independently.
• Four places where we believe the framework should go further, each drawn from something the build forced us to solve.

Those four proposals are the part most relevant to anyone outside Singapore.

• Evidence anyone can verify. SAFR asks for a tamper-evident log. We argued the log should be checkable by a supervisor or counterparty without trusting whoever operates it.
• A verified human behind every agent. A registry entry is not accountability. Each agent should resolve to a person who has passed identity and AML checks, with jurisdiction rules tied to where that person was verified.
• Governance that reaches the money movement. Approving a decision is not enough if the agent can see, replay or tamper with the authorisation to settle. That authorisation should work once and stay invisible to the agent.
• Revocation in flight. A live authorisation should be cancellable inside its validity window, with a pause-and-quarantine control and a forensic record of any later attempt to use it.

The submission supports an expression of interest in MAS’s industry work group and is not an endorsement by MAS. The deployment is validated in the venue’s integration environment and is on a scoped path to production. It is not yet carrying real-money flow.

What other institutions can take from it

None of this requires being in Singapore or being a customer of ours. Seven things carry over.

SAFR is a free checklist. Use it. Eight requirements, publicly available, written by a tier 1 regulator with industry input. Any bank or venue can score its own agent-facing channels against them in a single workshop. Most will find they score close to zero for agents they did not deploy themselves, which is the gap this article is about.

The regulator is asking for evidence, and the window is open. MAS published a version 1.0 and invited contributions. Standards are shaped by whoever turns up with a working system. Institutions that wait for the final text will be implementing someone else’s assumptions.

The venue expects agents to be its customers. The exchange’s own view is that autonomous systems buying data, paying other agents and settling across borders and asset types are likely to be its strongest use case. It never asked us how to keep agents out. It asked how to let good agents in with a named and verified human accountable for each one.

You cannot ask the agent what it is doing. A compromised agent can hand over a perfectly consistent and entirely false account of its own intentions. The checkpoint therefore reads the action, scope and value from the live request at the venue’s edge and ignores what the agent declares. This is the exchange’s version of the bank’s log problem. A record assembled from what the session claims about itself proves very little.

Identity is paid for once. The mandate is checked every time. The human owner goes through full identity and AML checks at onboarding. After that, every order is tested against a machine-readable mandate covering purpose, duration, limits and scope, which the agent cannot widen by reasoning its way around it. There are three outcomes: execute, deny with a recorded reason, or hold for a human with a timeout that defaults to block. No approval carries forward to the next action.

Latency was the objection we expected to lose on. An exchange will not put anything slow near its matching engine, and nor should it. The check runs before the trade and outside the matching path, with no change to the engine. Median verdict time is about 12 milliseconds. Governance that costs less than a blink stops being a trade-off against performance.

What a defensible answer looks like

We have been here before. When staff started bringing their own phones to work, the first corporate response was to detect and ban. It failed, because the behaviour was useful and the ban was unenforceable. The posture that won was catalogue and control. I wrote about that parallel last year, and it applies to customers bringing their own agents with even more force. A bank can discipline an employee. It cannot discipline a customer for using the tools on their own laptop.

Payments analyst Richard Crone made the same point to American Banker when the six banks published their principles. His advice was that banks should respond with “Bring Your Own AI using a secure verification gateway”: one that authenticates both the customer and the agent, enforces consent and spending limits, and keeps the bank’s own account as the system of record.

The Robinhood numbers show what happens when an institution offers a door. Customers used it, 150,000 of them, and in exchange the firm got a dedicated account, spending limits, an approval setting and a kill switch. Above all it got a count.

For everyone else, the work comes in three steps, and the first is cheap.

See. Classify what is already arriving. Which sessions and API connections are human, which are scripted, which show agent behaviour. This needs no customer friction and no policy decision. It turns “none that we know of” into a number a risk committee can look at. It is also imperfect. An agent inside a genuine session is the hardest case and classification there is probabilistic. A defensible estimate still beats no estimate.

Offer a declared path. An agent will only identify itself if doing so gets it something. For a bank or broker that means letting a customer register an agent against their own verified identity and grant it a bounded mandate, the same pattern the exchange uses. This is what the six banks’ transparency principle requires in practice, and what Waller meant by proving authority.

Keep the evidence. When the complaint arrives, the institution needs a record made at the time that an outsider can check: which agent, acting for whom, under what mandate, did what. That record moves the conversation from “the logs say it was you” to “here is what you authorised”.

No single bank, card scheme or AI lab can vouch for an agent to a counterparty it competes with. Whoever supplies this layer, it has to sit between institutions.

The agents are already logged in, and the barbarians inside the gates turn out to be paying customers. The institutions that learn that from their own telemetry will have a far easier year than the ones that learn it from a letter.

Sources

• Fortune, Robinhood just rolled out trading agents to millions, 29 September 2026
• RuntimeWire, Robinhood opened agentic trading to all eligible users, 6 September 2026 (Q2 account and asset figures)
• Banking Exchange, Bank of England warns AI agents could need new rules, 1 July 2026
• HUMAN Security, State of Agentic Traffic, May 2026 and 2026 State of AI Traffic benchmark
• DataDome, AI bot and agent traffic trends 2026
• Imperva, Bad Bot Report 2026
• Menlo Ventures, The State of Consumer AI 2026
• Chain Store Age, Majority of consumers open to using AI for financial tasks (TD Bank survey), 6 October 2026
• Commonwealth Bank, Global banks collaborate on principles for trusted agentic commerce, 23 September 2026
• Debevoise, FINRA’s 2026 Regulatory Oversight Report
• Federal Reserve, Waller, Payments in the Age of AI Agents, 29 September 2026
• APRA, Letter to Industry on Artificial Intelligence, 30 April 2026
• Fenwick, Is 2026 the Year of Agentic Payments?
• Allen & Gledhill, MAS publishes white paper on safeguards for AI agents in finance, 30 July 2026
• AstraSync and exchange partner, joint response to the MAS SAFR white paper, July 2026 (not published)
• American Banker, Are banks falling behind on agentic commerce standards?, September 2026
• Ultra Lab, Best AI Finance GitHub Repos for Retail Investors, September 2026 (GitHub star counts)
• GitHub, enhansome-trading-agents list and GummySearch, r/algotrading statistics

Further reading on AstraSync

• What is Know Your Agent (KYA)?
• Know Your Agent: the only definition that matters is the regulators’
• Visit Intelligence: see the agents in your traffic

This essay first appeared on Medium on 7 October 2026.