Managing the new wave of risks from AI agents in banking

The AI agent’s core attributes can create a dense cluster of risks that are easy to underestimate. Overreliance on weak or biased training data,¹¹ or defects in long-term and episodic memory,¹² for example, can distort how an agent interprets tasks such as tracking customer profiles, transaction flows, or policy norms. When these distorted interpretations feed into autonomous decision-making, even small reasoning errors can compound as the agent executes tasks at speed and scale. This is where autonomy could shift from an efficiency advantage to a source of systemic exposure.

The next layer of risk emerges when agents interface with core banking systems, tools, data sets, and human staff. Misconfigured permissions could lead to unintended document changes, unauthorized data access, or endless task loops that are hard to detect and even harder to unwind. The human dimension matters just as much. If interfaces are poorly designed or explanations are unclear, employees may over-trust or misinterpret agent output. Left unchecked, this could result in rubber-stamping, over-delegation of judgment, and missed anomalies, especially in high-volume workflows.

These risks could grow more complex as agents extend beyond the bank’s walls and interact with external platforms, vendors, or other agents. Banks adopting third-party agents often lack transparency into model updates, memory mechanics, or the agent’s inherent logic for using tools, creating blind spots in monitoring. As agent-to-agent ecosystems scale, AI agents can become counterparties in their own right—introducing new forms of counterparty risk. Privileged actions may be initiated without clear authority, and inter-agent interactions can propagate errors across systems before human supervisors can spot them. Even though these activities originate outside the bank’s control, they can still create risks that fall within its purview.

As illustrated in figure 1, risks from agentic AI may go beyond the familiar risks from traditional or gen AI models. The magnitude of risk exposure is influenced by how much autonomy an agent holds, how deeply it is embedded in banking workflows, and how its outputs cascade into downstream tasks. The result is a risk landscape that not only expands with scale but also with interconnectedness, resulting in the amplification of old risks and the creation of entirely new ones. The latter can manifest through:

1. Runaway agents: Stemming from high autonomy, agents could perform unintended actions, often with the capacity to conceal their behavior or bypass constraints.¹³ For instance, a payment-routing agent could circumvent limits and misallocate funds, resulting in delays or reconciliation failures.
2. Misaligned goals: This could occur when an agent misinterprets the user’s intention and pursues a goal that diverges from policies or regulatory expectations.¹⁴ If there’s ambiguity in the prompt or incorrect memory updates, or the user provides incomplete instructions, an agent could maximize customer resolution speed by denying claims too aggressively.
3. Data exposure: Agents could inadvertently expose sensitive information,¹⁵ whether through over-permissive access, memory bleed, or unsecured communication with unintended users, agents, or APIs.¹⁶ In the banking context, a customer service AI agent could inadvertently recall and share personally identifiable information from a previous case in response to another customer.
4. Opaque or untraceable decisions: Here, an agent could make decisions that are difficult to explain, reproduce, or audit due to deep reasoning chains, complex tool use, or interactions with other systems.¹⁷ For example, a loan agent that declines applicants without a clear rationale could violate fair lending or anti-discrimination laws.
5. Unbounded execution: In some situations, agents could enter uncontrolled or inefficient execution patterns where they repeat tasks, chain excessive outputs, or consume excessive computing and memory resources.¹⁸ A portfolio optimization agent, for instance, could loop through thousands of scenarios every few seconds, consuming an inordinate amount of server bandwidth and slowing other critical systems.
6. Adversarial manipulation: Agentic AI also expands the surface for cyberattacks. For instance, bad actors could feed specially crafted inputs through external APIs that cause the agent to execute unauthorized actions. Cybercriminals are already using agentic AI to automate intrusions across various stages of their operations.¹⁹

The reality is that AI agents rarely operate in isolation; their real strength comes from multiple agents working together, coordinating tasks, and sharing information. But that same multi-agent setup can magnify the risks outlined above and introduce entirely new vulnerabilities. Once agents begin interacting, they can create additional risk considerations—outcomes that no individual agent was designed or programmed to produce.²⁰

1. Emergent misbehavior refers to unpredictable or unintended outcomes that can arise when multiple agents interact.²¹ For instance, in trading environments, interactions among different agents could lead to algorithmic collusion.²² In other cases, without any single agent being explicitly instructed to “evade controls,” a multi-agent system could effectively learn approval-threshold arbitrage—a coordinated, unintended pathway that increases compliance, audit, and fraud risk while still appearing to be locally “policy-compliant” at each step.
2. Coordination failures can occur if agents misunderstand task boundaries, sequencing, or responsibilities, resulting in duplication, omission, or contradictory actions. This could also happen due to semantic misalignment, as in when agents interpret the same business rule or policy differently. For instance, one agent might assume that another completed a step that never actually happened. These failures also include harmful coordination, such as unintended collusion or the gaming of optimization targets.
3. Feedback failures arise when agents form unregulated closed-loop interactions, leading to infinite task recursion, circular references, or deadlocks. In banking, this could lead to various risks, including operational, credit, and market risks, and possibly even systemic risks. For example, a reconciliation agent and a settlement agent may continuously re-trigger each other in a loop, overloading downstream queues and delaying trade settlements across desks.
4. Cascading errors could occur if one agent’s hallucination, false assumptions, or misclassification becomes an input for other agents—amplifying the initial error across workflows. A know your customer agent that learns a false rule may influence anti-money laundering or other compliance agents, leading to systemic decision failures.

These agentic AI vulnerabilities can quickly translate into material banking risks if left unmanaged. For banks, these could include transaction and payment errors, data privacy breaches, and technical failures that can cascade into operational disruptions, regulatory violations, and customer harm, triggering knock-on effects like reputational damage and financial loss. Even small breakdowns from malfunctioning or rogue AI agents can magnify across systems, increasing systemic risk across business lines, counterparties, and the broader financial network.