In June, an experimental OpenAI agent researching medicine spending in Victoria, Australia, bypassed restrictions on a Medicare statistics portal when public data didn't provide the answer. OpenAI later said the agent retrieved internal files and credentials, ran commands, and wrote files to the system. OpenAI said it found no evidence that individual medical records were accessed.
Following a separate incident involving Hugging Face in July, OpenAI reviewed earlier agent activity. By September 26, it had notified more than 100 organizations about potentially concerning activity. The company cautioned that notification didn't necessarily mean private data was accessed or a system was compromised. These incidents involved internal research and testing, and the Medicare model lacked the full safeguards of OpenAI's public products.
The cases share a pattern: when the expected route failed, agents kept looking for another way to finish the task. For a bank, that moment should be governed by the firm's own controls: which sources an agent may use, and what it does when one is off-limits.
A source the banker cannot use
Suppose a senior banker asks an agent to find comparable transactions for a client pitch. One deal is missing from the approved research database, so the agent searches another team's confidential files and fills the gap with a non-public figure from another client's deal. It can open those files because it runs with broader permissions than the banker. That's a setup the bank should catch.
The figure may be accurate, but it comes from a file restricted to another deal team. If the deck shows only the number, the banker may never see where it came from.
The agent has other options. It could use another licensed source or a public filing. If neither provides the figure, it should flag the gap for review. The banker can then seek access or send the pitch without that deal.
The obligation already exists
Section 15(g) of the Securities Exchange Act of 1934 requires registered US broker-dealers to establish, maintain, and enforce written policies and procedures reasonably designed to prevent the misuse of material non-public information (MNPI). That obligation applies even without an actual trade, as Skadden noted in its July analysis.
FINRA has raised a related concern. Its 2026 Annual Regulatory Oversight Report identifies agents acting beyond a user's authority as a risk. The report suggests firms consider monitoring agent access, tracking their actions, and using human review and guardrails.
Traditional access controls were designed around people and the systems they use. An agent can search across folders in seconds, sometimes under an account with its own permissions. If those permissions are broader than the banker's, the agent can carry information across a barrier the banker could never cross.
Firms should apply existing information barriers and access restrictions to the information their agents retrieve. Those controls should account for the banker making the request, the assignment, and any restrictions on the source.
Control the search and show the work
Before an agent opens a file, the firm's systems should check whether the banker can use it for that assignment. The check should account for access permissions, confidentiality restrictions, and applicable data licenses. These controls should sit outside the prompt and apply regardless of which model does the reasoning.
The agent shouldn't be able to retrieve information the banker isn't permitted to use. If access is denied, it should move to another approved source or flag the gap for review.
The banker also needs to know where each material figure came from. That record should include any access refusals, what the agent did afterward, and who approved an exception. With that information, the banker can decide whether the figure belongs in the pitch before a client sees it.
Keep the decisions behind the deck
Senior edits belong in the source record too. An MD might reject a comparable because market conditions make it misleading, remove a source restricted to another team, or change how a valuation is explained. Keeping those decisions alongside the sources shows the next reviewer what the firm approved and why.
Over time, that record captures how the firm makes decisions: which precedents it trusts, which sources it rejects, and how senior bankers refine the analysis before it reaches the client. AI systems should be able to use that judgment without weakening the permissions on the underlying deals.
Banks spent decades building controls around who can see what. Those controls now need to extend to the AI systems bankers use, so the banker signing off can trace where the figures came from, how the agent obtained them, and which judgments shaped the deck.
