AI agents in banks & fintech: securing fraud, code and data

01The promise that keeps banks buying AI agents

Fraud‑detection teams now hand routine alerts to large language models that can read transaction streams, flag anomalies and suggest a case file in seconds. AML analysts use the same models to scan sanctions lists, generate suspicious activity reports and even draft regulator‑ready narratives. Customer‑service bots answer routine balance queries, while coding agents propose patches for core‑banking APIs and automate payment‑engine test suites. The common thread is speed: a single prompt can replace hours of manual work, freeing senior staff for higher‑value decisions.

From a risk perspective, that speed is attractive only if the underlying work never breaches the tight data‑handling rules that banks live under. Regulations such as PCI DSS, SOX, DORA and the FFIEC handbooks demand that financial records stay inside approved environments, that duties are clearly separated, that model risk is documented, and that every change is auditable. Any AI workflow that cannot be shown to respect those mandates will be blocked at the CISO desk.

02When an agent steps outside its fence

Imagine a coding agent with access to the production repository that fetches a helper script from the public internet to speed up a build. If the network is not locked down and the script hides a credential-stealer, a private key can leave quietly — and nobody notices until that key signs something it should not.

Or take a fraud-triage agent holding a general-purpose API key for an external model. Trying to be helpful, it quotes part of a customer email that includes the full account number. The data lands in a third party's logs, which is exactly the kind of exposure PCI DSS exists to prevent.

A third plausible failure: a reporting agent drafting an AML narrative invents case references to fill a gap. An examiner cannot verify them, and what began as a productivity tool becomes a model-risk finding under SR 11-7 guidance. None of these needs an attacker — only an agent with more reach than its task requires.

03Control set that turns a sandbox into a regulator‑ready workflow

The first line of defence is to ensure the agent runs in an isolated microVM that sees only a single workspace folder. The host never shares its kernel, and the network is locked to an explicit allow‑list. This satisfies the “data never leaves approved systems” requirement and prevents accidental internet calls.

Risky actions – such as pulling code from an external repository or writing to a production database – should be gated by a two‑person rule. The agent can pause, surface a request, and wait for two named human approvers before proceeding. This implements segregation of duties and gives auditors a clear decision trail.

Every state change is captured in a hash‑chained audit log. A simple kosa8 audit verify command produces a signed proof that the log has not been tampered with, giving examiners confidence that the sequence of actions matches the documented process. Checkpoints before each risky step allow an instant rewind if something goes wrong, and the fork capability lets teams test multiple remediation paths in parallel without ever touching the production environment.

• Network allow‑list only – all other connections refused.
• API keys stay on the host; the sandbox receives a placeholder and an egress broker injects the real key only for approved calls.
• Two‑person approval for any write to production code, databases or external services.
• Hash‑chained audit log plus kosa8 audit verify for regulator‑accepted evidence.
• Checkpoint and rewind to restore a sealed VM in about half a second.

04Getting started on Monday: practical steps with kosa8

Create a sealed sandbox for each new agent, limiting egress to the approved LLM endpoint. Example command: kosa8 sandbox create sealed --egress-allow api.anthropic.com. Pin the workspace folder to the specific data set the agent may read – no parent directory access.

Before the first risky operation, take a checkpoint with a clear label, for example kosa8 checkpoint sealed --label "before production write". If the operation fails or produces an unexpected output, run kosa8 rewind sealed to roll back instantly and re‑issue the request with a revised prompt.

• Run kosa8 evidence export --sandbox api after each major batch to collect the full audit trail.
• Use kosa8 fork api -n 8 when testing multiple remediation strategies for a fraud alert; keep the successful fork and discard the rest.
• Schedule a weekly kosa8 audit verify run and attach the signed report to your model‑risk register.