AI Agents Raise Bank Deposit and Disintermediation Risks

to three leadership teams, two at very large banks, and all on the same topic. Meta’s Muse, and what they should do about it. They asked: should we block this thing? Will it cause deposit flight? What if the agent gets compromised? Do we need to build our own? Those questions took on a new urgency when Apollo’s chief economist, Torsten Slok, asked: “[Is an Agentic Bank Run Coming?](https://www.apollo.com/institutional/insights-news/insights/daily-spark/is-an-agentic-bank-run-coming)” The unsettling part is that the customer doesn’t have to be scared of their bank going insolvent. They just have to want a better deal, and an agent could move deposits earning 0.1% to somewhere above 3%. I'm a pro-innovation-leaning human. I expected to say no, don't block Muse. Then I found myself saying something different. Imagine an agent with the keys to every account a customer holds today, and the risks are frankly enormous. Consumer agents currently appear to be good for Meta, bad for banks. For customers, they could mean finally getting the deal they never had time to chase. Since the launch of Muse, Meta stock has hit new highs; it closed Monday at a one-year high, up 11 percent. Meanwhile, the S&P 500 Financials index fell to its lowest level since July. This shift has already catapulted [Mark Zuckerberg past Sergey Brin](https://www.forbes.com/sites/zacharyfolk/2026/09/23/zuckerberg-overtakes-googles-brin-as-worlds-fifth-wealthiest-as-muse-fuels-meta-rally/) as the world's fifth richest person. The answer to “what should we do” isn’t simple, and it certainly isn’t “block everything.” It's alarmist to suggest this will drain any meaningful amount of deposits in the short term. But long term, banks absolutely must respond. Like by putting limits around what agents can do, while giving customers a safe way to use them. Experiment with your own agent, absolutely. But the more urgent job is making sure your bank works with the agent your customer has already chosen. And that it has something worth choosing. 1. The threat to banks 2. The risks for consumers 3. Should we block this thing? 4. Should we build our own agent? 5. Be the thing their agent uses 6. Some perspective 7. What I'd do now ## 1. The threat to banks Muse puts a working agent in the hands of a decent percentage of US bank customers, and soon everyone else's. Meta has been aggressively integrating financial services. Muse already plugs into [Plaid](https://plaid.com/blog/meta-muse/) (read-only, for now), [Stripe Link](https://www.eesel.ai/blog/meta-muse-agent), [PayPal](https://pasqualepillitteri.it/en/news/17532/paypal-checkout-meta-muse-amazon-blocked) and [Shop Pay](https://www.implicator.ai/amazon-bars-muse-nscale-2-6-billion-active/). It isn't moving deposits or managing your investments yet. Those would require another level of permission and trust. [Embedded Tweet: https://x.com/i/status/2103947119740493873] For consumers, the personal "CFO in your pocket" is now within reach, provided you're willing to progressively give it more data. The early adopter crowd is already canceling subscriptions, making reservations and [switching insurers](https://rallies.ai/news/buzz-shopping-for-insurance-with-metas-muse-e55ff42559788270). A BMO analyst fed it his policies and photos of his roof. It found him $800 a year on car insurance before the kinks stopped him switching. VC investor (and Brainfood reader) Angela Strange said that should make insurers “TERRIFIED” (yes, in all caps). If agents gain the permissions and customers trust them to act, a bank customer could instruct theirs to - Sweep their cash to the highest-paying suitable account - Watch the market and trade on their behalf - Maximize their credit card reward points and rebates - Become more useful by hoovering up data a. Deposit flight For consumers, this could be a very good deal. For banks that depend on cheap, sleepy deposits, it could be brutal. But it's hypothetical today: Muse's current Plaid connection is read-only. It can see the money; it can't use that connection to move it. [Slok’s scenario](https://www.apollo.com/institutional/insights-news/insights/daily-spark/is-an-agentic-bank-run-coming) is simple: agents could soon sweep household cash out of checking accounts paying 0.1 per cent and into accounts paying 3.3 to 5 per cent. If every household did it, banks would lose a large share of the cheap deposits they lend against. That is what Apollo’s chief economist is calling a potential problem for the entire financial system. The money doesn’t have to leave the banking system for this to hurt. It just has to leave the banks that rely on paying next to nothing for it. They’d have to pay more to keep the money, find other funding, or accept lower margins. [Embedded Tweet: https://x.com/i/status/2104213040937812262] Dave Birch (@dgwbirch) shared with me what that could mean for bank profits: > [McKinsey points ou](https://www.mckinsey.com/industries/financial-services/our-insights/global-banking-annual-review-2025)t that if just 5 to 10 per cent of current account balances moved to the best rates on the market, which is exactly the kind of chore AI agents will happily do, the industry's deposit profits could fall by 20 per cent or more. Across the whole business, it reckons that if banks don't adapt, global bank profit pools could shrink by around $170 billion, or 9 per cent, over the next decade or so, enough to push average returns below the cost of capital. But look at the history. [US commercial-bank deposits rose from $9.3 trillion at the start of 2013 to $19.6 trillion in September 2026](https://fred.stlouisfed.org/series/DPSACBW027SBOG). Fintech and easier account access arrived; aggregate deposits more than doubled. That's nominal growth, not proof that individual banks escaped pressure. But easier access alone plainly hasn't emptied the banking system. Canceling a subscription or shopping for cheaper insurance is one thing. Moving the account your salary lands in, with bills and direct debits attached, feels like a much bigger leap. An agent could move spare savings without touching any of that, but it still needs permission to move money and a customer willing to give it. My read: low immediate likelihood, potentially high impact. I'd raise that assessment when agents can move deposits and customers actually let them do it at scale. Today, the threat is margin erosion and disintermediation. Agents don't need to move your salary to take your next insurance policy, credit card, or savings decision away from your bank. b. Disintermediation I keep coming back to the sentence > "I don't want your agent, I want my agent to use your thing." If agents like Muse become common, they could become the default interface to your finances in the way open finance and app aggregators never did. With mobile banking, banks could at least compete with neobanks and fintech companies in the same channel. Agents could take even that away. Once the agent becomes the starting point, the customer makes the decision outside your app, in a channel you don't own. Your app can work perfectly and still never get opened. There are early signs this is a real issue in marketing. [AIVO ran 2,160 conversations](https://www.aivojournal.org/when-customers-ask-for-their-bank-ai-recommends-someone-else/) with ChatGPT, Gemini and Perplexity on 18 September, posing as small business owners choosing a bank. Mercury leads the chart below with 327 endorsements, followed by Wise with 184 and Relay with 68. - Chase, the highest-ranked bank shown, got 60. - When the customer named their own bank and asked about it, Bank of America and Wells Fargo were never recommended outright on ChatGPT or Gemini. Not once. - The one place banks still win is credit. When customers named their bank and needed credit, banks won 74 per cent of outright recommendations. (The whole study is [required reading](https://aivomeridian.com/research/ai-banking-study/) for anyone in banking.) Four smaller banks, Popular Bank, East West Bank, Valley Bank and Associated Bank, were never named in the study. These are recommendations, not completed account switches. But they show how a bank can lose the decision before the customer ever opens its app. My read: disintermediation is a higher-probability threat than a sudden bank run, and potentially more damaging over time. The recommendation layer is already moving; how many customers will let agents run their whole financial life is still uncertain. Risk rating: 10 out of 10 for strategic importance, not certainty. You can keep the account and lose the customer's attention, their next product purchase, and the chance to shape the relationship. Missing this will be bigger than missing mobile. By far. ## 2. The risks for consumers An agent can get a customer a better deal and still expose them to fraud, data leaks or a compromised account. Those risks deserve their own assessment. When you take new products live inside a bank, you're supposed to collect and write up everything that could go wrong, then think up mitigants ahead of time. It's a bureaucratic process, not always grounded in reality, but it's a useful skill for surfacing the big gotchas that will sting. Here's my stab. The ratings are my judgment calls on how seriously banks should take each risk, not the odds of something going wrong tomorrow: a. Commerce fraud Bank of America, NatWest and others [warned](https://www.reuters.com/legal/litigation/banks-warn-ai-shopping-bots-raise-scam-fraud-data-privacy-risks-2026-09-22/) this week that shopping agents raise the risk of scams, privacy breaches and fraud. Consumers don't know who is responsible if the tech fails, agents could ask for raw card numbers and leak them, and safety standards haven't caught up. ([The paper itself](https://newsroom.bankofamerica.com/content/newsroom/press-releases/2026/09/global-banks-collaborate-on-principles-for-trusted-agentic-comme.html) is worth twenty minutes.)For their part, the card schemes have built technical standards to audit what an agent did; they're piloting liability frameworks, and EMVCo has an [Agentic Payments Task Force](https://www.emvco.com/knowledge-hub/agentic-payments-and-digital-payment-credentials-highlights-from-the-emvco-board-of-advisors-meeting/). Agents like Muse and Instinct are embedding existing wallets, [Link, Shop Pay, and PayPal](https://superpowerdaily.com/posts/meta-s-muse-ai-agent-draws-millions-of-downloads-but-amazon-blocks-its-shopping-access), but existing wallet protections don't settle every question about what an agent was authorized to do. This is a solvable problem, but it is not solved. Risk rating: 6 out of 10. Fraudsters are the earliest adopters of any technology. If there's a way to mess with your agent, they'll figure it out. Know Your Agent (KYA) and understanding its link to a human is the next huge industry thing (and a Rant in its own right). b. Non-card payment fraud Existing payment rules weren't designed around a customer delegating tasks to an AI agent. What did the customer authorize, did the agent stay within that authority, and who pays if it didn't? If agents can log in and instruct payments, they can start to move much larger sums of money. This isn't happening much today. Plaid only lets Muse read. But where there's no API, Muse logs in through its own browser [the way you would](https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/), and ACH can't tell a customer from a customer's agent. Risk rating: 7 out of 10. It's large in magnitude if it does happen, but not a common use case yet. c. Data leakage Even by 2019 Cambridge Analytica standards, Muse is data hungry. The service wants to scan your entire inbox, read your messages, connect your bank accounts, and take your passport details so it can fill in forms quickly. All things most people will happily do if the app is useful, but that have enormous consequences if they go wrong.For its part, Muse does protect customer data very differently. It runs each user's assistant inside an isolated cloud environment called a Muse Secure VM, rather than the traditional Facebook model where massive central databases store, aggregate, and process user data for advertising. (Credentials sit in a separate compartment, so the agent can use your logins without seeing them. [Meta's security post has the detail](https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse).) So that’s somewhat comforting 🙂 Risk rating: 5 out of 10. The architecture here is solid, but not battle-tested. Agents leaking your Facebook data is one thing. Leaking your passport and your entire financial life is another. d. Agent compromise and hallucination Direct prompt injection attacks achieved success rates exceeding 79%, while indirect prompt injections (where malicious code is hidden inside an email, webpage, or file read by the AI) succeeded 41% to 68% of the time [[1](https://deepstrike.io/blog/owasp-llm-top-10-vulnerabilities), [2](https://www.csoonline.com/article/4184455/prompt-injection-breaks-todays-ai-agents-study-warns.html)].Today this seems early and far away. Most users don't have a personal agent yet. But many in cybersecurity rank prompt injection as a Tier-1 application risk, the way they viewed social engineering and phishing in the early 2000s. And Meta has [already patched a zero-day in Muse](https://gizmodo.com/big-banks-say-theyre-uneasy-about-people-shopping-via-ai-agents-2000815443) that could have handed an attacker every permission a user had granted it. Risk rating: 8 out of 10. I often hear this worry and dismiss it as hypothetical. The challenge is that because agents aren't widely used, the specific risks aren't well understood, and neither are the mitigations. It has a multiplier effect on every other risk here. Likelihood and impact are different questions. A risk can be uncommon today and still deserve hard limits because of the damage it could do. You have a window to build those controls before the behaviour becomes routine. It's rational for a regulated company to start at "we should protect our users." But how? ## 3. Should we block this thing? Amazon did. So did [Insurify](https://coverager.com/?p=250587)the insurance comparison site. Allstate shares fell 5.5 percent on Tuesday, then [went green the day that block went up](https://seekingalpha.com/news/4646210-insurers-trade-higher-after-online-insurance-marketplace-blocks-metas-muse) from Insurify. Blocking bought a day of share price. But you probably can't fully block consumer agents in the same way. Open finance exists, and card rails exist, and both already work partially with agents. You might be able to block "bots" from using your apps and logging into online banking, but you can't stop a user from giving their agent a card or connecting via API. A competitive dynamic is hard to ignore here. Neobanks will help users securely integrate their finance agents and aggressively try to win customer deposits by ranking at the top of LLM recommendations. There is a real risk of consumer harm. For most customers, especially of very large incumbent financial institutions, unleashing Muse or any financial agent on their entire financial life is probably a step too far. It's sensible for banks to limit what bots can do on their owned channels, what data they can get, and to make sure consumer risk warnings are in the right place. If your main reason for blocking something is that you monetize customer inertia, then frankly, you suck, and your product needs to get better. One of the reasons AI agents recommend fintech companies is because often the customer value proposition and product experience is better. You'd need to dramatically change your product to keep up. When I said that to bank leadership teams recently, their next question was: ## 4. Should we build our own agent? Only if it's actually good. Nobody wants another shit chatbot. They really really really don't. Mobile apps had the advantage of being quite hard to mess up. Login, display balance, recent transactions, maybe make a payment or deposit a check. Showing up was 90% of the battle. Agents are different. Muse is the first time people have experienced magic. Where most agents with computer use get stuck, don't quite understand you, or just fail to complete a task, Muse somehow figures it out. To the point where you want to peek under the hood and see if there's secretly a large team in the Philippines fixing stuff the agent can't do. That takes dedication and skill most companies don't have. There's a real risk you'll ship an agent, and it will suck. You should still experiment with it, and learn that skill. But if you're not already strong at design and rapid iteration around customer feedback (which is 99% of banks, even banks who say they are good at this stuff), you're going to really struggle. A bank can build a useful agent for the things it knows well. Competing to become the customer's assistant for everything is a much bigger job. And however good your own agent becomes, some customers will bring theirs. ## 5. Be the thing their agent uses Whether or not you build your own agent, you need to be useful to theirs. Give consumer agents a secure, permissioned way into your services, perhaps through an MCP server built on your open banking APIs. I'll come on to the controls in a moment. In this future, a customer securely connects their agent to your data service (or agent), you handle the customer's request, then hand it back to the agent. Your customer still has a relationship with you, probably even authenticates with you, but you're now headless: they may rarely need to open your app. You're not a mobile app, website or branch. You're a promise. We'll keep your data and money safe. ## 6. Some perspective It's easy to get carried away with future-gazing here, and there are some sensible caveats. - Usage drops off. Consumers can get gifted a perfectly smart personal agent, then forget to use it or run out of ideas how to. [AI apps keep 6.1 per cent of monthly subscribers ](https://techcrunch.com/2026/03/10/ai-powered-apps-struggle-with-long-term-retention-new-report-shows)against 9.5 per cent for everything else after 12 months, and nobody has Muse's retention numbers yet. - There's also early evidence Muse is extremely costly for Meta to run. One a16z partner says personal assistants [cost $3k-$7k per user per year](https://x.com/illscience/status/2103941433883557983). That's $250 to $580 a month per user. Imagine scaling that to 2bn users. The estimate could be way off and the economics would still deserve a very hard look. Meta charges $0, $20 or $100. - Public opinion on AI is negative and could shift on agents. Early adopters adore Muse. But if some pensioner loses their retirement fund with an agent, the pushback could come quickly. - Bank analysts aren't panicking. [Bank of America's analysts](https://finance.yahoo.com/markets/article/banks-have-profited-from-idle-cash-for-years-ai-agents-could-change-that-154215138.html) say what matters is deposit costs, not download numbers. That's a good point. It could also be complacency. We're in a war for consumer adoption and attention. Every big tech company sees the single biggest platform shift coming, possibly ever, and is throwing its enormous resources at winning. OpenAI's always-on agent is reportedly called "o" and [could land at DevDay on Tuesday](https://wccftech.com/openai-rushes-an-always-on-agent-called-o-after-jp-morgan-crowns-meta-muse-the-top-ai-agent/). Apple has yet to play its hand, and Google has a habit of showing up late with something solid in AI. The consumer agent won't go away. You need a strategy. ## 7. What I'd do now Most fintech companies are already leaning in aggressively to serving agents as customers. - [Robinhood](https://www.americanbanker.com/payments/news/robinhood-launches-agentic-trading-and-an-agentic-credit-card) opened its brokerage and Gold card to third-party agents in May. 100,000 users so far. Every agent trade pings your phone, and every card purchase can require your OK. - [Coinbase for Agents](https://finance.yahoo.com/markets/crypto/articles/robinhood-plans-let-ai-agents-105053282.html) launched in June. - [Mercury](https://www.accountsrecovery.net/2026/06/17/fintechs-new-ai-assistant-lets-users-bank-by-conversation/) shipped an MCP server, a CLI, then Command, then cards issued to an agent with its own spend limit and its own audit trail. - Stripe is inside ChatGPT, Perplexity, and Muse, and [issues virtual cards to agents](https://fortune.com/2026/05/27/robinhood-ai-agents/). - Plaid [powered Muse's finance tab](https://plaid.com/blog/meta-muse/) from day one. The winners are all shipping incredibly quickly, with limits on what agents can do. Spend limits, audit logs, and user notifications are the default. They're learning by putting these products in customers' hands. That speaks much louder than warning the press about fraud risks. You need to make your bank worth choosing, keep customers safe, and move fast enough to learn. In practice, I'd start here: - Give the agent a reason to choose you. Make your rates, fees, eligibility and terms easy to find and compare. Then make sure the product stands up to the comparison. A better API won't rescue a bad deal. - Give agents an official, permissioned way in. Let them read balances and transactions, pay up to a limit, or open a savings pot, all inside rules the customer set. An MCP server is one way to do it. The alternative is an agent logging in through your website, where it's much harder to see what was delegated. - Add friction for high-risk journeys. Anything that moves money out, adds a payee or raises a limit gets a second check with the customer, in your app, not in the agent's chat window. Banks call it step-up. The agent queues it, the customer releases it. - Engage with the new economic actor. Treat the agent like a customer who turned up with a power of attorney. Check the ID (which agent, and is it the real one). Read the mandate (what the customer delegated, how much, until when). Keep both on file for the day it goes wrong. - Experiment with your own agents and limited integrations. Start with read-only access for the customers who ask for it. Add payments under a limit once you trust the logs. You'll learn more from 500 real customers in a month than from a year of roadmap. The technical work is already under way. Cards are ahead. Visa (Trusted Agent Protocol), Mastercard (Verifiable Intent), and [EMVCo's draft framework](https://www.emvco.com/?p=134726) can all tell you how an agent proves what it was allowed to do. Proving authority doesn't, by itself, settle who eats the loss when an agent exceeds it. Google and OpenAI have their own (UCP, ACP). I covered the soup [here](https://www.fintechbrainfood.com/p/the-agentic-payments-map). Banks can start with those controls now. The industry also needs to agree on what happens when an agent crosses from one provider to another: - Shared identity, delegation and audit records. Which agent acted, what did the customer authorize, and what actually happened? The banks' own paper [asks for exactly this](https://www.pymnts.com/?p=4219832): keep the instruction, the authentication, the intent and the outcome. Those records need to mean the same thing to the bank, the agent provider and whoever handles the dispute. Direct debit has had a mandate for over fifty years. [EMVCo's Intent Services](https://www.emvco.com/?p=134726) is one attempt to make delegated authority usable across agentic payments. - Liability frameworks - what happens if an agent deletes data, is compromised or hallucinates? Who pays: the merchant, the issuer, Meta, or the customer? [Amex will cover agent error but not agent fraud](https://www.cxnetwork.com/cx-experience/articles/6-global-banks-collaborate-on-principles-for-trusted-agentic-commerce), which tells you how early this is. The UK's APP reimbursement code is the nearest template: decide who pays by default, then let the parties argue about the split in private. - A kill switch. Lose your phone, and you freeze the card in one tap. Lose control of your agent, and today you revoke it one connector at a time. Somebody needs to build the button. ## 8. Muse might be a fad, but its threat and opportunity aren’t Muse may be a fad people put down after three weeks. But I don’t think we’re going back to a world where customers have to do all this work themselves. AI has an annoying habit of going nothing, nothing, nothing, SaaSpocalypse. You do not want to get caught on the wrong side of that. The cost of experimenting and learning has never been lower. You need to engage with this threat and generational opportunity on the front foot. It's not BAU, annual budget cycle, roadmap release stuff. It's small teams, moving quickly, developing something new. Like the early days of mobile. But 100x faster. ST. If you enjoyed this, please do share it with someone else who might :)