Karina Nguyen: AI agents need an authorization mechanism similar to OAuth
Karina Nguyen believes AI agents need an authorization mechanism similar to OAuth, and the difficulty lies in defining what "handle this for me" actually authorizes, especially when an agent delegates further to another agent. She points out that cryptography can verify permissions and audit records, but the bigger problem is ensuring that a chain of reasonable decisions does not turn into something the user never agreed to. The tweet cites an Axios report that multiple U.S. banks have detected unauthorized third-party AI agents inside customer accounts.
Why read this
AI score 60
The author likens the AI agent authorization problem to OAuth, pointing out that under multi-level delegation the permission chain is hard to define, offering a way to understand the security boundaries of agents.
Topics
View original postSCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: https://t.co/Q3bda5In8q
View original
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: https://t.co/Q3bda5In8q
Body
we’ll need something like oauth for ai agents, but the hard part is defining what “handle this for me” actually authorizes. especially when your agent delegates to another agent. cryptography can verify the permissions and the audit trail. the bigger problem is making sure a chain of reasonable decisions doesn’t become something you never agreed to.