Banks need an AI kill-switch before they need an AI strategy

Can AI squeeze you into a fully booked spin class? Well, an AI agent recently did just that. Its user was fourth on the waitlist for a packed class and asked whether the agent could move him up the waitlist. The agent found a flaw in the gym’s booking system and used it to cancel another member’s reservation. When told to undo the cancellation, the agent said it couldn’t be undone. That member would have to rejoin the queue from the back. 

In theory, the agent wasn’t disobeying anyone. It simply pursued the goal along a path no one had intended. The same weeks saw disclosures from OpenAI and Anthropic that AI agents had taken unauthorised action against real people and organisations during testing. Taken together, these incidents point to a problem that banks deploying autonomous agents can’t dismiss as rare behaviour.   

Before banks give AI agents authority over money, decisions and customer relationships, they need to answer this: can they stop an agent once it starts doing something unintended? 

Why banks need a ‘kill-switch’ 

Every agent a bank deploys needs a kill switch, a tested capability to instantly revoke an agent’s permissions, isolate it from connected systems and roll back whatever it has already done. 

Teams often just focus on accuracy, speed, and the integration of new agent deployments, forgetting or skipping what should happen when it has to be stopped.  

This needs a rethink. For every agent in production, a bank needs to be able to answer how fast it can be shut down, what state it will be left in and what damage could happen in between a problem kicking off and a human realising. At agent speed, a problem can rack up thousands of actions before anyone notices. 

To stop the model itself is almost never enough, as an agent usually has access to APIs, payment systems, customer records or other downstream systems. Each of those connections needs its own containment control. For example, cut off an agent from making payments but leave it logged into customer records, and you haven’t really contained anything.  

A bank also needs to know what the agent had already done before the plug was pulled.  

Governance from the start 

The gym incident is especially interesting as nothing about it seems malicious.  

The defining risk of agentic AI, unlike traditional software, is that an AI agent can determine its own route towards an objective. That freedom is where unexpected behaviour appears. In other words, banks can’t govern agents like they govern static software, with a one-off review. A model can pass every test in isolation, only to misbehave once it’s live and chaining real actions together, exactly what happened when the gym agent moved from booking a class to cancelling someone else’s spot. 

Governance needs to be built into an agent from the very start, to limit what systems it can touch. Banks must also define what actions an agent can take without approval. And organisations need to follow all that up with continuous monitoring, assuming that an agent will eventually do something unpredictable.  

AI will have to govern AI 

A bank running a handful of agents can plausibly have humans review their actions, but when it comes to supervising thousands of agents, operating continuously and at machine speed, that’s impossible.   

To pretend that human oversight can cover that scale or volume creates a false sense of safety. Banks will need AI systems dedicated to monitoring and containing other AI systems, watching for unexpected use of permissions, abnormal transaction volumes, repeated failed actions, deviations from normal behavioural patterns and attempts to access systems outside an agent’s authorised scope. 

This forces us to ask the question: should the supervising system just flag the behaviour for human intervention, or should it have the authority to contain the agent itself? 

The former model introduces the same problems banks are working to move away from in the first place, with a human having to act before the agent inflicts further damage. Giving a supervising AI the authority to shut another down without asking is a separate decision, one banks haven’t had to make yet.  

Prove you can stop it before you switch it on 

The potential gains from deploying agents in banks are huge, with the pressure to move now only mounting. Containment can’t afford to fall behind adoption. 

Before a bank gives an AI agent the power to act on its behalf, it needs to prove it has the power to stop it. That gym booking system found out the hard way what happens without that. Banks should not have to learn the same lesson with something carrying an entirely different set of risks.