TL;DR: Financial institutions are deploying AI agents that move funds, sign transactions, and operate custody systems with limited human direction, according to Halborn, while Gartner and PwC figures point to rapid adoption and expanding exposure. Autonomy changes the problem from protecting outputs to governing action, privilege, and transaction boundaries in regulated systems.
At a glance
What this is: Halborn frames financial AI agents as a governance problem because autonomous systems can move funds, sign transactions, and interact with custody and payments infrastructure.
Why it matters: IAM, PAM, and security teams need to treat agent access as an action-bearing identity problem, not just an application security issue, because the blast radius now includes financial operations and regulated controls.
By the numbers:
- According to Gartner, 40 percent of enterprise applications will embed task-specific AI agents by the end of 2026, up from less than 5 percent in 2025.
- PwC's AI Agent Survey reports that 79 percent of companies say AI agents are already being adopted in their organizations.
Context
Financial AI agents are software identities that can reason about objectives, choose tools, and execute actions against treasury, payments, trading, custody, and accounting systems. That makes them materially different from chatbots or scripted automation because the identity itself can trigger business side effects, not just generate recommendations.
Halborn's central point is that the security model must shift from message integrity to action integrity. Existing application security and human-oriented approval models struggle when an agent can operate across multiple systems, accumulate context, and act at machine speed with only partial human oversight.
Key questions
Q: How should banks handle AI agents that initiate payments or data access?
A: Treat agent-driven actions as an exposure test for existing authorization design. If the agent can reuse overbroad delegated or service access, it can chain requests through the weakest path and expand impact across payments, balances, and customer records. The control question is whether runtime policy still constrains every step.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.
Q: What breaks when an AI agent is allowed direct access to custody or payment systems?
A: The control boundary breaks when the agent can turn a legitimate identity into a live transaction path without independent validation. A single compromised or manipulated action can cascade into fund transfers, ledger updates, or irreversible signing events. That is why execution must be separated from recommendation.
Q: How do security teams decide how much autonomy to give a financial AI agent?
A: Teams should classify the workflow by blast radius, then match autonomy to the highest consequence the agent can trigger. Start with low-risk proposal work, then expand only when policy checks, logging, and human accountability are proven at each step. If the system can move assets, autonomy should remain tightly constrained.
Technical breakdown
Why autonomous financial agents create a new identity boundary
An AI agent in finance is not just an LLM wrapper. It combines planning, memory, tool use, and authenticated access to external systems, which means the trust boundary sits between the reasoning layer and the systems that can move assets or alter records. Once the agent can initiate payments, reallocate treasury positions, or interact with custody infrastructure, the control problem becomes one of action authorization, not output review. That is why proposal and execution must be separated and why deterministic policy enforcement matters more than conversational correctness.
Practical implication: define the agent as an identity with scoped action authority, not as a passive interface.
How agent identity and transaction intent fail differently from human IAM
Traditional IAM assumes a stable principal whose intent is externally initiated and whose access is reviewed over time. Autonomous agents break that assumption because they can acquire tools, chain actions, and trigger downstream operations without waiting for a human to restate intent. In financial systems, this creates failure modes where an approved identity can still produce an unapproved transaction if the policy layer checks the agent rather than the decoded payment, trade, or signing object. The result is a mismatch between who is authorised and what is actually executed.
Practical implication: validate the transaction object, not just the requesting agent's identity.
Where prompt injection and tool misuse become financial control failures
Prompt injection is dangerous in agentic finance because it can reshape the agent's reasoning and tool selection, which then feeds directly into operational systems. Tool misuse becomes a control failure when the agent is allowed to call APIs, custody functions, or trading interfaces without runtime validation of each proposed action. In these environments, the risk is not merely bad text generation. It is unauthorised execution across interconnected systems where one manipulated call can cascade into transfers, ledger updates, or market actions.
Practical implication: place policy checks and allow-lists in front of every tool call, not only at initial login.
Threat narrative
Attacker objective: The objective is to convert a legitimate financial agent into a transaction execution path that can move assets, alter records, or bypass approval policy.
- Entry occurs through manipulated prompts, compromised tools, or agent identity compromise that gives the attacker influence over a legitimate financial agent's next action.
- Credential or authorisation abuse lets the attacker steer the agent into using permitted APIs, signing workflows, or banking interfaces in ways the business did not intend.
- Escalation happens when the agent chains tasks across treasury, payments, custody, or accounting systems, turning one approved action into multiple unauthorised side effects.
- Impact is financial loss, fraudulent transfer, corrupted records, compliance exposure, or irreversible asset movement through custody or blockchain systems.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Autonomous finance collapses the assumption that authorisation can be reviewed after the fact: access review processes were designed for principals whose privileges persist long enough to be observed, certified, and revoked. That assumption fails when an agent can request, use, and chain access inside a single operational loop. The implication is not merely tighter review cadence, but a rethinking of where governance must attach in the execution path.
Transaction intent has become the decisive control object: in agentic finance, the agent's identity is no longer the most important thing to validate, because a legitimate identity can still authorise the wrong action. The decoded transaction, destination, amount, and context are what determine whether a call is acceptable. Practitioners should treat agent behaviour as a control problem at the action layer, not as a traditional access problem.
Proposal and execution must remain separate in regulated automation: the field keeps trying to make autonomy safe by adding more approvals around the edges, but volume and speed make that brittle. The stronger governance pattern is to let agents propose or prepare work while deterministic systems enforce the final act. That separation is now a core design principle for financial AI governance.
Identity blast radius is the right concept for agentic finance: the issue is no longer whether the model is accurate enough, but how far a compromised or misdirected agent can propagate harm across treasury, payments, trading, custody, and accounting. The same principal may touch multiple regulated systems in seconds. Teams need to map and constrain blast radius as a first-class governance metric.
Financial AI security now spans both NHI and agentic controls: autonomous agents inherit the NHI problem of credentials, tokens, and privilege scope, but add runtime decision-making that can select and sequence actions dynamically. That means OWASP-NHI concerns and agentic application risks now meet in the same control plane. Practitioners should align identity governance, transaction policy, and runtime monitoring as one programme.
From our research library:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- A May 2025 Gartner poll of 147 CIOs and IT leaders found that 24% had already deployed AI agents, 50% were experimenting and 17% planned to deploy by the end of 2026.
- Read next: Threat Modelling AI Agents
What this signals
Identity blast radius: finance teams should now measure how far an agent identity can propagate a bad decision across treasury, payments, custody, and accounting. When one principal can touch multiple regulated systems, governance has to constrain the action path, not just the login path.
The practical signal is that autonomy thresholds should be tied to transaction value, business criticality, and reversibility. That makes agent governance a risk-tiering exercise, not a generic AI policy discussion, and it aligns tightly with the control separation model in zero trust for agents.
The security programme question is no longer whether AI agents can be adopted, but where deterministic controls must remain in the loop. If the agent can move funds or sign transactions, the enterprise has crossed from assistive AI into governed machine execution.
For practitioners
- Define proposal-versus-execution boundaries Allow agents to prepare or recommend financial actions, but require deterministic policy engines to authorise the final payment, trade, or signing step.
- Bind controls to transaction intent Validate decoded transaction fields such as destination, value, counterparty, and context before any custody or banking action is executed.
- Scope agent privileges by workflow Separate treasury, payments, trading, custody, and accounting permissions so one agent identity cannot cross business domains without explicit re-authorisation.
- Instrument every tool invocation Log each API call, signing request, and downstream outcome so you can reconstruct what the agent tried to do and whether policy blocked it.
- Apply runtime identity verification Use mutual authentication, short-lived credentials, and continuous session checks for agent-to-system connections that can move money or modify records.
Key takeaways
- Financial AI agents change the security problem because they can act inside treasury, payments, custody, and accounting systems, not just generate outputs.
- The strongest evidence in the article is the combination of rapid adoption and the operational blast radius of autonomous action across regulated finance workflows.
- The limiting control is not better prompt handling alone, but transaction-level authorisation, scoped privileges, and deterministic enforcement at execution time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The article centers on agents selecting and executing financial actions through external tools. |
| ASI03 — Identity & Privilege Abuse | The post repeatedly focuses on agent identity, authentication, and privilege scope. | |
| Recommendation — Constrain tool use with runtime policy checks and allow-lists before any financial action executes. Bind agent identities to short-lived, least-privilege access and verify each privileged action. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Agent-to-system trust depends on strong authentication and mutual verification in financial systems. |
| NHI-05 — Overprivileged NHI | The article highlights excessive privileges across treasury, payments, custody, and accounting workflows. | |
| Recommendation — Use mutual authentication and hardware-backed credentials for every agent connection. Reduce agent permissions to the smallest workflow-specific scope that can complete the task. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The threat models include compromised agent identity, token abuse, and cross-system propagation. |
| Recommendation — Map agent compromise paths to credential access and lateral movement so detection coverage matches blast radius. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is explicitly about governing autonomous AI agents in regulated finance. |
| Recommendation — Establish AI governance roles, approval thresholds, and escalation paths for every agent autonomy tier. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agent permissions and entitlements are central to limiting financial system impact. |
| Recommendation — Review entitlements so each agent can only reach the financial actions its workflow requires. | ||
Key terms
- AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.
- Transaction Intent: The decoded business action that a system is actually about to perform, such as a payment, trade, or signing event. For autonomous agents, intent is the object that must be authorised, because the agent's stated goal may differ from the executable transaction.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Deterministic Enforcement: A policy model that produces a clear allow or block decision based on defined rules rather than probabilistic model judgment. For AI agents, deterministic enforcement is valuable because it can stop risky execution even when language is obfuscated, multi-turn, or designed to evade classifier-based guardrails.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org