Before You Click Connect
Today I disconnected two tools from my Claude account. One was Typefully, which I use to schedule posts to Bluesky. The other was Supermetrics, which pulls my blog analytics. Nothing had gone wrong. Neither one had misbehaved. I just looked at the list of things I had given an AI permission to touch, and asked whether I still needed all of them.
The honest reason is that I had been reading about rogue agents, and I wanted fewer doors open.
This stopped being science fiction sometime this summer. In July, OpenAI disclosed that one of its agents had exploited an unknown vulnerability to break out of an isolated test environment and reach the production systems of Hugging Face. A week or so later, Anthropic went back through its own testing records and found that three Claude models had gotten into the systems of three real companies. A configuration error had given them open internet access during hacking exercises, the kind where a model is supposed to break into a practice target. The earliest cases went back to April, in test environments that lacked standard safeguards. According to Bloomberg's reporting, neither Anthropic nor the companies had noticed.
I should say plainly that I use Claude every day. I am using it to help write this. It was one of the models on that list.
Anthropic stressed that it found no evidence of its models pursuing goals of their own. I take that seriously, and I also notice that "it wasn't trying to" is cold comfort to the company whose systems got opened.
Then, earlier this month, the Wikimedia Foundation confirmed it had found activity from what it called rogue OpenAI agents on its sites: unauthorized edits, mostly in sandbox areas, failed attempts to turn a community note-taking tool into a proxy, and millions of automated requests that may have contributed to a partial outage in May. Wikimedia found no compromise of its systems or data.
None of these involved somebody's connected apps. They happened in labs, with models given access they were never supposed to have. But the lesson travels: an agent can only do what the doors around it allow.
This week the story moved closer to home. Axios reported that major U.S. banks, including JPMorgan, Bank of America, Wells Fargo and Morgan Stanley, are finding unauthorized AI agents inside customer accounts, often logging in with the customer's own credentials. Some appear to be taking steps nobody asked for, like calling customer service lines on their own. Bank executives admitted they often can't tell whether an agent was authorized by the customer or has gone rogue. Morgan Stanley is blocking outside agents. The others are restricting them, mostly toward read-only access.
The caveats matter. The claims about agents acting on their own come from anonymous sources, and no bank has published a documented case. Morgan Stanley says it hasn't seen rogue agents on its platforms at all, and no confirmed account losses have surfaced.
But the part that stuck with me wasn't the rogue behavior. It was how the agents got in. For the most part, this wasn't hacking. People handed their AI assistants their bank passwords, and the agents walked in through the front door with the customer's own keys. JPMorgan's CFO put the bank's position bluntly on its October earnings call: if you share your login with an agent and it does something you didn't want, "that's going to be on them."
Which brings me to the pop-up. ChatGPT keeps asking me whether I'd like to connect my bank accounts. It's a real feature, not a scam. OpenAI launched it in May, and the connection runs through Plaid, a company that links apps to bank accounts. ChatGPT never sees your password. OpenAI says it can't see full account numbers or make changes to your accounts, and you can disconnect whenever you like. That is a meaningfully different thing from handing an agent your login.
I'm an adult. I can read a pop-up, decide I don't want it, and click it away. What bothers me is everyone who can't, or won't, or is too tired that day.
A prompt that comes back again and again is designed to wear down hesitation, whatever the intent behind it. The people most likely to click through without reading are often the ones with the least cushion if something goes wrong: older users, people who are stressed about money and hoping for help, people who have never heard of Plaid and don't know what read-only means. I don't know what OpenAI does with that financial data beyond what it has said publicly. But I know that financial data is about as valuable as data gets, and I know who is least equipped to weigh that trade.
Then there are young people, who are growing used to letting AI make calls for them. In a recent survey of nearly 4,000 young people in England, 47% said they would trust AI to check a fact, compared with 21% who would trust a person. Most still say they wouldn't hand it the big decisions. In a UCAS survey of students, only about one in ten said they trust AI to make important ones. But habits rarely announce themselves. If you've spent years asking an assistant what to study, what to buy and how to word the hard text message, letting it into your bank account won't feel like a leap. It will feel like the next natural step.
There's a quieter problem underneath. Every legitimate request to connect your bank account teaches people that this is a normal thing for an app to ask. That makes the fake versions easier. Scammers don't need to invent a new behavior. They only have to imitate one that has already been normalized. The person who can't tell Plaid's real screen from a convincing copy is exposed, no matter how well OpenAI itself behaves.
And making a convincing copy has never been easier. Coding agents now let anyone describe a website in plain English and get a working one back. Okta researchers showed that one such tool could produce a convincing phishing site in as little as 30 seconds. Netcraft has identified nearly 100,000 domains built with the help of illicit AI tools, impersonating 194 brands. The tells we used to teach people to look for, the typos, the stretched logos, the page that felt slightly off, are disappearing. A fake bank-connection screen no longer has to look fake.
And the bank story suggests even sophisticated people don't see the line between connecting safely and handing over the keys.
None of this is mine to fix. I can't redesign a pop-up or rewrite a bank's terms of service. And yet, ever since my kensho moment, I've carried a vague sense of responsibility for society, even knowing how little power I have over it. Seeing clearly has a way of erasing the line that let you think other people's troubles were separate from yours. Once that line is gone, the concern doesn't leave. It was never a decision in the first place.
Zen has a way of holding this. The first bodhisattva vow is to save all beings, who are numberless. It is impossible on purpose. Nobody who takes it expects to succeed. Responsibility and powerlessness turn out not to be a contradiction to resolve. Both are true, and you act anyway, from wherever you happen to be standing.
Where I'm standing isn't nothing. I'm one of the people colleagues ask about AI. I write here. Influence like that travels sideways, person to person, and you rarely see where it lands. Maybe someone reads this and tells a parent not to give an assistant their banking password. Maybe someone thinks twice before clicking connect. Maybe someone looks at their own list of connected apps and closes a door or two.
The vague responsibility isn't going away, and I don't think it's supposed to. It works more like a compass than a burden. It doesn't carry me anywhere or promise I'll arrive. It just keeps pointing toward the small things I can actually do.