Banks grapple with detecting third-party AI agents using legitimate customer sessions
CommonGrapefruit3653 · reddit · 2026-10-29
A cybersecurity practitioner at a Canadian financial institution discusses how banks are detecting and blocking third-party AI agents, prompted by RBC's decision to block Meta's Muse AI agent over security, privacy, and liability concerns. Explored defenses include WAF/bot management with behavioral fingerprinting, robots.txt/ai.txt, OAuth DPoP sender-constrained tokens, and API-level anomaly detection — the hard part being agents that operate through legitimate authenticated customer sessions. Asks for real-world implementation experiences and emerging standards.
More from coding & agent
- 10 open-source repos that give coding agents a code map, led by 125k-star Graphify — victor_explore · 2026-10-29
- Snaptrude launches AI agent that takes building designs from site to construction-ready LOD 400 models — EXM7777 · 2026-10-29
- Workflow: Claude Code + Remotion generates animated videos from your assets, controlled from a phone — TawohAwa · 2026-10-29
- The full recipe: install Remotion in Claude Code, paste a prompt, upload assets, control it from your phone — TawohAwa · 2026-10-29
- Turning photos, charts and logos into animated videos in 5 minutes with Claude Code and Remotion — TawohAwa · 2026-10-29
- 1Password for Agents lands in Meta's Muse, giving AI agents their own credential manager — xeophon · 2026-10-29