AI risk in banking is exposing gaps in legacy governance

At a glance

What this is: This is an analysis of why AI in banking creates governance gaps that legacy security tools were never designed to manage, with particular risk from prompts, shadow AI, and agentic actions.

Why it matters: It matters because banking IAM, NHI, and AI governance teams now have to control human prompts, service accounts, and autonomous actions under one policy model instead of treating them as separate problems.

By the numbers:

• 82% of employees paste activity into AI tools through unmanaged personal accounts, evading SSO, CASB monitoring, and identity controls.
• 43% of MCP servers examined were vulnerable to command injection.

👉 Read WitnessAI's analysis of AI risk in banking and legacy control gaps

Context

AI risk in banking is not just a model-quality issue. It is an identity and governance problem that appears when people, service accounts, and autonomous systems all reach the same regulated data and transaction paths without controls that can interpret intent in real time.

The article's primary concern is the gap between AI adoption and control design. Traditional DLP, CASB, and perimeter policies can limit access, but they do not reliably understand conversational context, user purpose, or agent behaviour during live interactions, which is why banking AI risk now crosses compliance, operational, and security boundaries.

Key questions

Q: How should banks govern employee use of AI tools with regulated data?

A: Banks should govern employee AI use as an identity and data handling problem, not just a policy issue. The control point is intent, context, and runtime enforcement. If staff can paste client or trading information into unmanaged tools, security teams need visibility into the interaction, not just the network.

Q: Why do traditional DLP and CASB controls struggle with AI risk in banking?

A: Traditional DLP and CASB tools were built for files, domains, and static patterns. AI risk often appears as conversational context, natural language prompts, and agent actions, so the control has to understand purpose and runtime behaviour instead of relying only on content signatures.

Q: What breaks when AI agents have broader access than their tasks require?

A: Over-privileged agents break segregation of duties, weaken auditability, and expand blast radius across transactions, data lookups, and workflow triggers. In banking, a single agent identity can act with more operational reach than any human reviewer can safely justify.

Q: Who is accountable when an AI agent triggers a banking error or compliance breach?

A: Accountability sits with the institution that granted the agent access, defined its scope, and failed to govern its actions. Banking regulators will focus on whether the bank can prove effective oversight, traceability, and control over both human prompts and autonomous actions.

Technical breakdown

Intent-based classification vs keyword-based DLP

AI interactions do not look like files moving across a network boundary. An employee can paste client details, internal research, or policy text into a prompt without triggering classic content rules because the transaction is conversational rather than structured. Intent-based classification evaluates the purpose and context of the interaction, which matters when the risk comes from what the user is trying to accomplish, not just from sensitive words appearing on screen. In banking, that distinction decides whether policy sees a legitimate workflow or a regulated-data exposure event.

Practical implication: classify AI interactions by purpose and context, not only by text patterns or file movement.

Runtime defense for models, apps, and agents

Runtime defense inspects prompts before they reach the model and filters outputs before they reach users or downstream systems. That matters because prompt injection, hallucinated answers, and manipulated instructions become materially worse when the model can act through tools or APIs. In an agentic workflow, the output is not just text. It can become a transfer, an approval, a data lookup, or a workflow trigger. Banking controls therefore need to operate at the moment of interaction, not after logs are reviewed.

Practical implication: enforce policy at interaction time so model outputs cannot become unchecked actions.

Why MCP servers become concentrated risk points

The Model Context Protocol creates a shared integration layer between AI agents and enterprise systems. That architecture is useful, but it also concentrates trust: one vulnerable server can expose multiple downstream systems at once. In banking, this turns a single control failure into a broad access problem because the server sits in the path of tool calls, data retrieval, and agent-to-system execution. Once the integration layer is compromised, the downstream blast radius is no longer theoretical.

Practical implication: treat MCP endpoints as high-value trust concentrators and subject them to hardened control and monitoring.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• AI LLM hijack breach — attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI governance in banking fails when organisations treat prompts as low-risk interactions. The article shows that regulated data can leak through ordinary conversation, not through a file transfer or attachment. That means the old assumption that sensitive information only leaves through structured channels is no longer valid. Banking teams need to recognise that prompt-level handling is now part of the identity and access surface.

Shadow AI outside managed channels is now a control-plane problem, not just an endpoint problem. When employees use personal accounts to reach AI tools, SSO, CASB, and identity monitoring lose visibility at the exact point where regulated data leaves the bank. The governance gap is not simply lack of logging. It is the inability of legacy controls to observe unmanaged identity paths that operate beyond the enterprise perimeter.

Over-privileged agents expose an identity blast radius that traditional human IAM models do not describe well. Service accounts, API keys, and tokens used by agents can execute actions without individual accountability, which breaks segregation-of-duties assumptions that banks rely on for auditability. Identity blast radius: the amount of business impact a single AI or NHI identity can create once it reaches core banking systems. Practitioners should measure that blast radius directly, not assume human privilege logic still fits.

Autonomous agent oversight should be governed as one policy model with employee AI use, because both now touch the same regulated systems. The field is moving toward unified oversight across human prompts and agent actions, which means banking governance is shifting from tool-by-tool control to shared policy enforcement. The practical implication is that banks will be judged on whether they can prove consistent controls across browsers, IDEs, APIs, and agent workflows, not on whether a single monitoring stack exists.

Legacy model risk frameworks do not cover the operational reality of agentic AI in banking. The article points to a gap between traditional model governance and AI that can initiate actions, call tools, and trigger real business outcomes. That means banks cannot simply extend yesterday's validation process to today's AI estate. They need a governance model that recognises conversational, operational, and autonomous risk as one continuum.

From our research:

• 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, and 47% have only partial visibility, which leaves delegated access outside practical governance.
• The next step is to align identity review, lifecycle offboarding, and privileged access controls with the same runtime governance model used for AI prompts and agents.

What this signals

Banking programmes that treat AI as a separate innovation track are likely to miss the control failures that matter most. The real shift is from static policy enforcement to behavioural governance across prompts, models, and autonomous actions, which means the security stack has to understand intent as well as access.

Identity blast radius: banks should start measuring how far a single AI or NHI credential can reach across transaction systems, because the risk is no longer limited to initial access. The combination of unmanaged AI usage and agentic workflows collapses the usefulness of perimeter-only thinking and pushes governance into runtime oversight.

The operating model will increasingly need to join human AI use and autonomous agent oversight into one control plane, with audit evidence that stands up to banking supervision. That is the practical direction of travel for NIST Cybersecurity Framework 2.0 and AI governance aligned to NIST AI Risk Management Framework principles.

For practitioners

• Map every AI touchpoint to an identity path Inventory employee chat tools, embedded copilots, agent frameworks, and MCP-connected workflows, then map each one to the identities and privileges that can reach regulated banking data.
• Classify prompts by intent before enforcement Replace keyword-only controls with policy that distinguishes legitimate work from risky AI use based on conversational purpose, data sensitivity, and business context.
• Reduce agent privilege to the smallest viable transaction scope Bind service accounts, API keys, and tokens to specific banking tasks, then review whether any agent can approve, move, or disclose value beyond its stated role.
• Build audit trails that reconstruct agent decisions end to end Capture prompts, tool calls, outputs, and downstream actions in a single evidence chain so examiners can trace why an AI system acted and under whose authority.
• Treat unmanaged AI usage as shadow access Detect personal-account AI activity as a governance issue, because regulated data exposure can happen even when no enterprise SSO session exists.

Key takeaways

• AI risk in banking is an identity governance problem because prompts, shadow accounts, and agents can all reach regulated systems.
• Legacy tools miss the main failure modes because conversational context and runtime intent are not the same as file movement or network traffic.
• Banks need one control model for employee AI use and autonomous agents if they want auditable oversight and defensible compliance.

Key terms

• Intent-based classification: Intent-based classification evaluates what a user or system is trying to do, not just what text or file is present. In AI governance, it distinguishes routine work from risky interaction by reading context, purpose, and sensitivity. That matters when regulated data is handled conversationally rather than through formal file transfer.
• Runtime defense: Runtime defense is policy enforcement that happens while an AI model is being used, not after the interaction ends. It screens prompts, outputs, and agent actions in motion so harmful instructions, sensitive data exposure, and unauthorized tool use can be blocked before they create business impact.
• Identity blast radius: Identity blast radius is the amount of damage a single credential, token, or agent identity can cause once it reaches important systems. In AI and NHI governance, it measures how far that identity can move, what it can touch, and how quickly one mistake can propagate across workflows.
• Shadow AI: Shadow AI is AI usage that appears outside approved channels and governance. It often involves personal accounts, unsanctioned tools, or unmonitored agent workflows. The security problem is not just unknown software. It is untracked identity activity that can move regulated data or trigger business actions without oversight.

Deepen your knowledge

AI governance in banking is a core topic in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building controls for prompts, agent access, and regulated data, it is worth exploring.

This post draws on content published by WitnessAI: AI risk in banking and why legacy controls fall short. Read the original.