Photo via superstate.com
JPMorgan, Wells Fargo, Bank of America, Citi and Schwab are restricting AI agents from acting inside customer accounts, and Robert Leshner, founder and CEO of Superstate, said on Unchained's The Chopping Block that the move protects the banks rather than their customers.
The banks cite "unauthorized activity." Robert said the same banks spent a decade fighting Plaid's read-only access to accounts, and an agent that can act on a customer's behalf alarms them far more while posing little real risk to them.
"Anything that can click a button is 10 times as terrifying. Is it actually a risk to the bank? Not really, right?" — Robert Leshner
Robert previously co-founded Compound Labs and now runs a firm that moves funds and stocks onto blockchains. He sat alongside Tom Schmidt, General Partner at Dragonfly, and Tarun Chitra, Managing Partner at Robot Ventures and founder of the risk-modeling firm Gauntlet, with Rob Hadick, also a General Partner at Dragonfly, guest-hosting.
The full episode is covered here so you can skip it. 50 minutes of audio, 11 minutes of reading.
Here are the 9 arguments that matter.
Unchained · Oct 24, 2026 · 50m · 39m saved
Key Takeaways
The worst 48 hours of web security bugs in memory did little real damage
The main casualty was one DeFi project hosted on Railway that lost its keys
Closed-source software is less safe than open source in the long run, because a hidden breach stays hidden
Banks blocking AI agents are protecting their own bad user experience, not consumers
An agent that can click a button is "10 times as terrifying" to a bank as Plaid's read-only access
AI agents should remove friction for consumers, not add risk, the opposite of the lesson Bernie Sanders drew
Visa buying Fireblocks for about $2.5B, against an $8B peak valuation, would still be a sensible deal for both sides
AI data centers funded with 10-year debt and resold on contracts of a few years are where an AI financial crisis could start
1. Black October's 48 Hours
Tom opened with what security researchers named Black October. Within roughly 48 hours, critical remote-code-execution bugs were disclosed in PHP, Node.js and the Railway hosting platform. Remote code execution means an outsider can run their own programs on someone else's server.
The PHP bug let anyone take over a server with a single line of code
"This vulnerability basically allows anybody to take over their server and run remote code with, like, one line." — Tom Schmidt
The PHP flaw was nicknamed "PHP2shell." Tom added that the chief executive of Cloudflare, which sits in front of a large share of websites, reported millions of attempts to exploit it.
Tarun listed the rest of the damage the same day: Linux kernel exploits posted with no warning to the maintainers, a QUIC zero-day and a GitLab bug of the same kind.
A state-linked hacking tool was caught turning the new bugs into attacks automatically
"Microsoft found a custom agent that they claimed was a Chinese state-aligned threat actor, built on immediately exploiting all the CVs — they caught it in the wild, indexing and exploiting Microsoft's security threat intelligence." — Tarun Chitra
The "CVs" in the quote are CVEs, the public catalog numbers given to security flaws. Tarun's point is that an automated tool was reading new disclosures and turning them into attacks as they appeared. Governments felt it directly: Finland shut down government internet services, the Netherlands' cybersecurity agency took over government sites, and France's regional prefectures went offline.
