AI can read your bank account. It isn't ready to act on it
Two announcements on November 5 marked out where AI in consumer finance stands today. One showed how far it has come in reading people's financial lives. The other showed how far it still has to go before it can be trusted to act on them. The distance between the two is where the hard questions about liability will be settled.
Reading is open banking working as designed
Anthropic launched Personal Finance, a beta that lets US subscribers connect their bank accounts to its Claude assistant to analyze spending, bills and unusual charges. OpenAI launched a similar feature in May. Both connect through the aggregator Plaid, both are read-only, and neither asks for the customer's bank password.
That matters. It's the opposite of the agents banks have spent the past month blocking, which log in with a customer's own credentials and are indistinguishable from the customer. A permissioned, read-only connection tells the bank which intermediary holds access, and the customer can revoke it.
It also lengthens the chain. Bank data now flows through an aggregator to some of the largest AI companies in the world, and those companies are now open banking data recipients. In the US, the rules that would govern them remain unsettled: the Consumer Financial Protection Bureau's 2024 Section 1033 rule is enjoined, and its rewrite has been under White House review since August. For now, the terms that govern what these recipients may do with customer data sit largely in private contracts.
Acting is a different problem
The same day, Visa published the first results of its Agentic Commerce Benchmark, which tested 22 AI models from 12 developers on realistic shopping tasks where the agent had to work out what the customer wanted. The models failed 42.8% of the time. In 54% of those failures, the agent still made a purchase. And when a model ran the same task three times, it got all three right only 34.2% of the time. The test stopped at the decision to buy; payment hasn't been tested yet.
Two findings stand out for anyone thinking about risk. The costliest failure is an agent that acts confidently on the wrong answer. And inconsistency means a single successful test proves very little. An agent that passed yesterday may not pass today, which is a strong argument for judging agents, and the companies behind them, on continuing evidence rather than a one-off check.
Read-only won't last
The commercial pressure is to move from reading to acting: paying bills, moving savings, switching providers. Each of those turns an analysis tool into a party that can cause a loss. Banks are already answering the liability question on their own terms. Wells Fargo will treat anything an agent does with a customer's credentials as authorized by the customer from November 24. Supervisors are drawing their own lines: the Office of the Comptroller of the Currency places fully autonomous, customer-facing payment agents in its highest risk tier, regardless of how well they perform in testing.
Use the read-only window
The read-only phase is the industry's chance to settle the questions that action will force: which company stands behind each agent, what it has been permitted to do, whether it is still in good standing, and who pays when it gets something wrong. Those answers are far easier to agree before agents can move money than after the first large dispute. Bringing agents onto identified routes, knowing the companies behind them, and agreeing across the chain where liability lands is the infrastructure Invela is building.
Invela is the infrastructure layer that makes open finance trustworthy - accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place.
