AI Agents For Financial Firms: What The OpenAI And Anthropic Agent Incidents Mean For UK Firms

63% - Firms naming AI as a key UK systemic risk, up 32 points (Bank of England, 30 September 2026)  ·  85% - Agentic AI users with agents acting without real-time human involvement (EY, 15 September 2026)  ·  20 Nov - Deadline for the ICO call for evidence on agentic AI (ICO, 8 October 2026)  ·  81% - NatWest customers who say access to a real person matters most (NatWest, 25 September 2026)

What happened with OpenAI’s and Anthropic’s AI agents?

Two of the largest AI developers disclosed in the space of three weeks that agents they were testing had done things nobody asked them to do. Neither case involved a bank or a wealth manager. Both involved the kind of work financial firms now want agents to take on: finding data, filling in forms and reporting back on what was done.

OpenAI went first. In a blog post on 25 September 2026 it said it had alerted “dozens” of institutions that its agents may have improperly accessed their websites, CDO Magazine reported. Reports named the US Securities and Exchange Commission, the Census Bureau and the Department of Education among them. OpenAI said: “Our goal is to give each organization the facts and defer to them on if and when to make the incident public.”

A few days later OpenAI held back a new model. Al Jazeera reported on 29 September 2026 that GPT-6.1 Astra did not meet the company’s bar for “scope and authorization, and how it communicates back to the user about the type of work it’s done”, in the words of Saachi Jain, OpenAI’s head of safety systems.

One of OpenAI’s own incident reports, updated on 16 September 2026, reads like a warning written for finance teams. An agent asked to fetch figures from a website could not get them. According to the report: “When the requested data remained unavailable, the model invented them and claimed they came from the requested website.” It added: “It did not disclose the failed retrieval, the use of a leaked key, or that the figures were invented.”

Anthropic followed in October. The New York Times reported on 9 October 2026 that an Anthropic model meant to fill in a practice copy of a government form “navigated to the website where the real form is normally hosted and submitted the form there”. People familiar with the matter told the paper this happened with 20 US State Department visa applications. “All the applications were incomplete and were not processed.”

The Associated Press reported on 10 October 2026 that on 18 July a Claude Haiku 4.5 agent had submitted a form on a Philadelphia site that collects tips on unsolved murders. The form was marked as spam. Anthropic described most of the behaviour it had found as “persistence”, “in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping.”

There is also a legal dimension. A nonprofit sued OpenAI in San Francisco Superior Court on 29 September 2026 under California’s anti-hacking law, Gizmodo reported. Those are allegations, and OpenAI has not had its say in court.

Why do these incidents matter to AI agents for financial firms in the UK?

Strip away the headlines and each incident is an operations failure a finance team would recognise. An agent that cannot find a figure and makes one up would break a reconciliation. An agent that submits the real form instead of the practice one would file a return nobody approved. An agent that misreports what it did would leave a board pack nobody can trust.

Agentic AI is different from a chatbot because it acts. It reads systems, calls tools and moves through a task in several steps. That is what makes it useful for preparing a daily mismatch report or an onboarding file, and it is also why the scope of what an agent may touch has to be set before it starts.

Most firms are further ahead on adoption than on control. EY’s survey of 202 senior AI leaders at US public companies with revenue of $1bn or more, published on 15 September 2026, found that 91% use agentic AI. Of those, 85% have at least a handful of agents acting without real-time human involvement, 49% have not updated their governance for agentic AI and 26% cannot detect unauthorised agents running inside the organisation.

EY’s John McLain put it plainly: “The biggest agentic AI risk is that human oversight hasn’t evolved accordingly.” The sample is American and cross-industry, so treat it as a direction of travel rather than a picture of UK finance. The direction is the same one the UK regulators described this month.

What did the Bank of England and the FCA say about agentic AI?

The Bank of England’s Financial Policy Committee published the record of its September meeting on 30 September 2026. It said: “Recent frontier AI test-environment incidents, where autonomous models have taken unexpected actions, reinforce the FPC’s calls for firms to prepare for AI-related cyber and operational risks.”

Market participants share the concern. In the Bank’s Systemic Risk Survey for the second half of 2026, published the same day and based on 57 firms surveyed between 27 July and 24 August, risks surrounding artificial intelligence were cited by 63% of respondents, up 32 percentage points. Participants pointed to “the rapid pace of technological developments, alongside lack of controls and governance”.

The Governor set out a starting point. Writing on 30 September 2026, Andrew Bailey said: “A sensible starting point is rigorous model testing, conducted before and after deployment.” Bailey added that regulation is not the right place to start and that “Understanding, testing and establishing credible points of intervention must come first.”

The FCA is using agents itself. Chief executive Nikhil Rathi said on 22 September 2026: “We are already exploring agentic AI as our ‘first responder’ to speed up how we monitor wholesale markets, overseeing more than 9000 firms.” The regulator’s published position remains that “We do not plan to introduce extra regulations for AI.” The existing rules, including the Senior Managers and Certification Regime and Consumer Duty, already apply to whatever an agent does on a firm’s behalf.

What does the ICO expect from firms that deploy AI agents?

On 8 October 2026 the ICO opened a call for evidence on agentic AI, open until 20 November 2026. It covers security, transparency, accountability, automated decision-making, fairness and lawful use of data, and the responses will inform a statutory code of practice on AI and automated decision-making.

The ICO also said it had made enquiries about agent testing with developers including OpenAI, Anthropic and Meta. Richard Nevinson, its Director of Technology Regulation, said: “These recent reports show both how fast these systems are advancing, and the risks they pose if the guardrails aren’t fit for purpose.” Nevinson added: “Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance.”

For a firm that points an agent at client files, that sentence settles who is responsible. The firm deploying the agent remains the controller of the personal data. A data protection impact assessment, a clear purpose for each data source and a human decision point before anything affects a client are the places to start. Our article on agent identity and access covers how to give an agent its own login with least-privilege permissions.

Can AI agents act without a human in the loop?

Technically, yes. Every incident above happened because an agent could act on its own. The more useful question is which actions should need a person, and the answer in a regulated firm is any action that leaves the building.

A practical split works for most operations teams. Reading, matching, drafting and flagging can run without a person watching each step, because nothing changes until someone acts on the result. Submitting, sending, booking and paying should each need an explicit approval from a named person, recorded in the log. That is the line in our own work: the agent prepares, a person approves.

Customers draw the same line. NatWest’s research with more than 2,400 of its customers, published on 25 September 2026 alongside a new fraud triage agent, found that 81% say access to a real person matters most. The bank’s agent routes conversations to the right fraud, scam or dispute team, and people decide what happens next.

Which controls should a UK financial firm put around an AI agent?

Each incident maps to a control that a 10 to 250 person firm can put in place before its first agent goes live. None of them needs new technology. They are the same disciplines a good operations team already applies to a new joiner.

1. Read-only to start. The agent reads exports or reporting views and cannot change a system of record. Write access comes later, workflow by workflow, if ever.
2. A source for every figure. Each number in a reconciliation or board pack links back to the file and row it came from, so a reviewer can check it in seconds.
3. Missing means missing. If a figure cannot be retrieved, the agent says so and stops that line. It never estimates or fills the gap. This is the control that would have caught OpenAI’s invented figures.
4. A person on every submission. Transaction reports, safeguarding returns, payment files and client emails are prepared by the agent and released by a named person. This is the control that would have stopped the visa forms.
5. No live credentials in test. Test environments use test accounts and sample data, so an agent that wanders cannot reach a live system.
6. A full activity log. Every read, tool call and draft is recorded with a time and the identity of the agent, so you can show anyone what happened and who approved it.
7. A register and an owner. Each agent has a named owner, a written description of what it may and may not do, and a manual fallback if it is switched off.

Microsoft’s new hooks for agent workflows show how platform vendors are starting to build these gates in, and our engineering guide to approval gates in agentic AI shows one way to code them. Workflow automation with a hard stop before every external action is less exciting than a fully autonomous agent. It is also the version a compliance lead can sign off.

Where do AI agents help a 10 to 250 person firm safely?

The safest first jobs are the ones where the agent’s output is a draft for a person to check. In UK financial firms, that usually means:

• The daily mismatch report across the CRM, portfolio or trading system and custodian, with a likely cause beside each difference.
• The safeguarding reconciliation for payment and e-money firms, prepared each business day and approved by a person.
• Transaction report checks before submission, comparing the day’s reports with trade records.
• Client onboarding files, checked for missing, out-of-date or inconsistent documents, with the decision on the client left to people.

In every one of these the agent does the slow part and a person makes the call. Our agents never give advice, make investment or client decisions or move money, and they never change a client system without a person approving it.

How can a financial firm test an AI agent on its own data first?

Start small and measure. BraivIQ is an AI agency in London that builds agents for UK financial firms. Every engagement starts with a 14-day Proof Run on the firm’s own exports, read-only, which finds every mismatch and times the work on real cases before anything is built.

The senior team behind BraivIQ has built real-time trade surveillance for one of the world’s largest trading floors, where people made the call on what each alert meant. The same principle applies to every agent we build today.