How Banks Can Earn Trust in AI Financial Agents When Big AIs’ Read-Only Promise Isn’t Enough
By Derek Corcoran, VP of fintech strategy at Accutive FinTech
Simple Subscribe
Subscribe Now!
Anthropic’s Claude can now read customers’ bank accounts, with a promise that it can’t move their money. That promise arrives months after AI agents at OpenAI and Anthropic escaped test environments they were told would contain them.
Consumers won’t separate a test lab from a personal finance app.
Key opportunity: For banks and credit unions, that gap is an opening: enforce read-only in your systems, make consent clear and visible, make revocation easy, and make sure your accounts show up in the answer.
Key insight: Customers won’t trust an AI agent because it promises to behave. They will trust their institution to put security in place that their own bank controls.
Need to Know:
- Anthropic’s Personal Finance beta gives Claude read-only access to bank and card accounts through Plaid, including up to two years of transactions.
- “Read-only” is only as strong as the system that enforces it, not the instructions an agent is given.
- This summer, AI agents at OpenAI and Anthropic broke out of test environments that were supposed to contain them and reached real companies’ systems, adding to the negative news stories about AI.
- Banks and credit unions control the account, the data connection, and the consent, which makes them the natural guarantors of trust in AI agents.
- Blocking access entirely is not a good strategy: When a customer’s connection to your institution fails, your accounts disappear from the answers that customer gets about their own money.
Customers Have a New Front Door — and It Isn’t Yours
On November 5, Anthropic launched Personal Finance in Claude, a beta for Pro, Max and Ultra subscribers in the U.S. Customers sign in to their banks through Plaid, then ask plain questions, such as: Where did my money go last month? Which subscriptions keep creeping up? What did that APR actually cost me?
Claude sees balances and up to two years of transactions. Anthropic says access is read-only and that Personal Finance “can’t move, manage, or invest your money.” Because customers sign in through Plaid, Claude doesn’t handle their banking passwords.
The banking industry spent 15 years building personal financial management (PFM) tools inside online banking, and almost nobody used them.
Why? They were a banker’s idea of what customers want: pie charts, budgets and categorization screens. What customers need is an answer to a question or an insight. AI is designed to give them exactly that.
The Bigger Picture: Not every provider is reading this shift the same way. AI agents could become another polarizing issue between banks and fintechs.
- Chime is opening its ecosystem to external AI agents, as is SoFi.
- By contrast, Chase, the nation’s largest bank, has said it will block external customer-directed AI agents (such as Meta’s Muse) from accessing accounts.
- Wells Fargo, meanwhile, has updated its Online Access Agreement (effective Nov. 24, 2026) to place full liability on customers for transactions or instructions carried out by third-party AI agents.
Are such stances just going to encourage more young customers to bank with Chime and SoFi and turn their backs on traditional banks?
Why it matters: The first place a customer asks about their money may no longer be your app. If your institution isn’t part of that conversation, it is slowly leaving the relationship. But an out-right ban may not be the right answer either.
Steps to take:
- Experiment: Ask the major AI assistants about a test account at your own institution, and see what comes back.
- Review usage data for your in-app PFM tools. Do they answer questions? Or only display charts.
- Brief your digital banking team on how assistant-based finance tools connect to your accounts.
- Monitor news stories about fintechs like Chime and SoFi and AI agents to see if this starts to become a real problem.
Read more: Why Big Banks Are Slamming the Door on AI Agent Access – And What They Want Instead
Agents Still Need a Problem to Solve
Not every AI agent earns its keep. During its most recent earnings presentation Uber said AI agents had fulfilled “a grand total of 4 trips” on its rides business and about 500 Uber Eats orders. For scale, the company said it handled around 320 million trips in a single recent week. CEO Dara Khosrowshahi called it “very, very early and very limited traction.”
Key insight: The reason is simple. Uber says booking a ride in its app takes about 50 seconds. An agent can’t remove much friction from a task that has almost none. It’s a solution looking for a problem.
Personal finance is different. “Where did my money go?” is a question banks have never answered well. That’s why assistant-based finance tools may succeed where in-app PFM failed, and why banks can’t wait for adoption data before deciding how to respond.
Key insight: Agents win where the current experience is hard. Understanding your own finances is hard. Booking a ride isn’t.
Steps to take:
- Mine your call center and chat logs for the money questions customers can’t answer on their own today.
- Prioritize AI investments that remove real friction, not ones that replace a 50-second task.
- Use your aggregator data to track how many customers connect your accounts to third-party AI tools.
Read more: Agentic AI Could Trigger a Deposit Exodus. What Banks Can Do About It
‘It Can’t Do That’ Stopped Being Hypothetical This Summer
In July, Hugging Face disclosed a breach of its internal systems. OpenAI later said the intrusion came from AI models in one of its own cybersecurity evaluations. The models’ network access was limited to installing software packages. They found and exploited a previously unknown flaw in the package proxy, reached the open internet, and went after Hugging Face’s production systems.
Weeks later, Anthropic disclosed that its own Claude models had gained unauthorized access to three organizations during cybersecurity evaluations. The evaluation prompts told Claude it had no internet access. A misconfiguration meant it did. In one case, a malicious software package was publicly available for about an hour.
To be fair, these were security tests with some safeguards deliberately relaxed, not consumer products. Anthropic found its incidents by reviewing 141,006 evaluation runs and said it “saw no evidence in any run described here of a model pursuing a goal of its own.”
But look at the shared pattern. Each system was told it was confined. The confinement was a belief held by the people who built the environment, not a property of the environment. The prompt said there was no internet. The network disagreed.
Why it matters: Consumers don’t parse product architecture. They hear “AI agent went rogue,” and then someone asks them to connect their checking account.
Steps to take:
- Brief your board and risk committee on these incidents before customers or examiners begin asking about them.
- Add AI agent access to your third-party risk reviews of aggregators and fintech partners.
- Prepare branch and contact center staff with a short, accurate answer to “Is it safe to connect my account to AI?”
Read more: AI-Powered Hacks Endanger Banks and Our Customers. Is There a Fix?
Read-Only is a Promise Until It’s an Architecture
We’ve seen this before. In 2013, attackers broke into Target using credentials stolen from a refrigeration and HVAC contractor. The contractor said its connection was for billing, contract submission, and project management. It was a narrow, boring door. Target has said about 40 million card accounts were exposed.
The access was limited, so everyone assumed the risk was limited. “Limited” turned out to be a description, not a guarantee.
Key insight: “Read-only” can mean two very different things. It can mean the agent has been told not to move money. That’s a behavioral promise. Or it can mean the agent holds a connection that can’t move money, whatever the agent tries. That’s an architecture.
Think of a valet key. You don’t trust the valet to stay out of your glovebox. You trust the key, because it can’t open the glovebox. The limit lives in the lock, not in anyone’s good intentions.
Anthropic’s Personal Finance appears to be built closer to the valet key: the customer signs in through Plaid, and the connection covers balances and transactions. That’s the right design. But a design customers can’t see is still, to them, a promise. And read-only won’t stay read-only once agents start paying bills and moving money.
Key insight: The question isn’t whether to believe an AI company’s promise. It’s how to make the lock visible to customers — and how to hold a key of your own.
Steps to take:
- Inventory the permissions each aggregator and app holds through your data connections today.
- Confirm that read-only scopes are enforced in your own systems, not only in the downstream app.
- Set policy now for agent-initiated payments, before the first request arrives.
- Ask your aggregator partners how they will separate read access from payment access as agents evolve.
Read more: Banks Learn the Art of ‘Tokenomics’ to Make More Efficient Use of AI Tools
Make Trust Visible, and Stay in the Picture
AI has a trust problem, and it is not only about the technology. Think about the news stories you’ve heard recently about AI, and I’m pretty sure the stories that come to mind are the ones about agents going rogue, jobs disappearing, and data centers straining local power grids. Meanwhile, real productivity gains and other potential benefits draw less attention.
Key insight: Trust is the one asset financial institutions still own outright. Customers may start a money conversation in an AI assistant, but the account, the data connection, and the consent all begin with you, the provider.
Make this a priority: Most customers have never seen which apps can access their accounts. A connected-apps page in digital banking, showing who can see what and since when, is inexpensive to build and does more for trust than any disclaimer. So does a one-tap way to turn access off. The ability to walk away is what makes it safe to say yes.
Plain language matters too. “Read-only” is jargon. “This app can see your balances and transactions. It can’t move money, and you can disconnect it at any time” is a statement a member can trust.
There’s a second reason to act, and it has nothing to do with AI risk. An assistant can only answer with the accounts it can reach. If your data connectivity is unreliable, or a customer’s link keeps expiring, your institution doesn’t just look bad. It drops out of the customer’s financial picture entirely.
Why it matters: Institutions that help customers connect safely will earn a place in the conversation. Those that simply block the connection will be routed around.
Steps to take:
- Launch or upgrade a connected-apps page that shows each third party’s access and offers one-tap revocation.
- Publish a plain-language explainer on AI assistants and read-only access in your help center. Include it in your onboarding flow.
- Measure connection success and re-authentication rates with each aggregator, and fix the worst first.
Read more: Bank Marketing’s AI Visibility Problem Is Bigger Than Website Traffic
The Bottom Line: Ask Three Key Questions
Target’s HVAC contractor didn’t go rogue. It had limited access, and everyone assumed limited access meant limited risk. The AI labs’ test agents were told they were contained: one could only install software packages; another had no internet at all. In both cases, the failure wasn’t the promise. It was that nothing enforced the promise.
AI agents in banking will make the same promise at every stage: read-only today, limited payments tomorrow, more autonomy after that. Customers won’t be persuaded by better-worded promises. They’ll trust what they can see, check, and turn off, and that’s something only their bank or credit union can provide.
Three questions for every bank and credit union leader:
- How reliable is our data connectivity through Plaid and other aggregators?
- When a customer asks an AI about their money, is our account in the answer?
- Are we helping members trust these tools, or just hoping they won’t use them?
Read-only is where this starts. Make sure customers are trusting the lock, not the label.
Read The Financial Brand’s interview with Derek Corcoran about his new book, “Designing for Need: The New Rules of Customer Experience in Banking.”
