Subscribe
Share
Share
Embed
Banks wall off outside AI agents
A daily summary of what is interesting and happening in the AI industry, with a focus on what this means for people building harness experiences that are used.
Good morning, it's Friday, October twenty-third.
In today's briefing we see big banks rewriting their terms to keep outside AI agents out of customer accounts, Anthropic handing the Agent Skills standard to a neutral foundation and reporting Claude-written formal proofs, and fresh funding reports for OpenAI and DeepSeek.
First up - Today in the big model news;
OpenAI
CNBC sources say OpenAI is raising up to thirty billion dollars at a one point two five trillion dollar pre-money valuation, led by Coatue and UAE investors. That is below the roughly one point four trillion dollar figure Bloomberg reported in late September, and terms are still being negotiated. Valuation figures that move by hundreds of billions between reports mean no single number is settled yet.
Separately, Bloomberg reports DeepSeek is raising about fifteen billion dollars, possibly from CATL and Tencent. That comes two days after the order removing its products from US federal civilian systems. The federal ban has not dented DeepSeek's capital, so Western dependence on its weights now turns on enterprise policy. Whether enterprise buyers follow the federal ban or ignore it is the next question that gets answered.
Anthropic
Anthropic, working with Theorem, says Claude wrote Rocq proofs at the RISC-V assembly level for one hundred twenty-three open-source libraries. The proofs show no crashes or memory-safety errors for inputs under sixty-four megabytes, and the work surfaced hundreds of bugs, including a rediscovered libexpat vulnerability.
Anthropic states its own limits. The proofs assume a single-threaded static binary on RISC-V with musl, they ignore caller misuse, and they trust the specs and the Rocq checker. All figures are Anthropic-reported, with no independent assessment.
The machine checks the proof, but a person still has to audit the spec. If proofs get cheap, vendors can sell verified code as a feature, so ask which spec was proved before accepting the label.
In the harness, tools and orchestration world;
There is a growing fight over who holds the credentials when an AI agent acts on a user's behalf.
Morgan Stanley, Bank of America and Wells Fargo are updating their terms of service to block autonomous agents such as Meta's Muse. Schwab and JPMorgan already block them. Jamie Dimon calls outside agents "just too risky for clients and for JPMorgan."
The banks' stated reason is that they detected agents typing in users' own credentials. That breaks most banks' guidelines even when the user gives permission, and many banks allow only read-only access.
Here is the strategic side. The security case is real, and the same rule keeps the bank as the interface. An agent that logs in as the user turns the bank into plumbing behind someone else's front door.
Meta says Muse passed ten million US downloads in forty days, so it now has to negotiate sanctioned access or stay read-only.
A sanctioned route is already taking shape. 1Password for Agents and Nvidia's open-source OpenShell both work the same way: the agent presents a key, the user approves, and the credential is filled in without the agent ever seeing it. Products that act inside regulated accounts should be built on delegated credentials from the start, not on login scraping.
Also in tools, Anthropic is donating the Agent Skills standard to the Agentic AI Foundation under the Linux Foundation, which already holds MCP. The donation includes the name and logo, the GitHub organization and the agentskills.io domain. Anthropic reports more than seventy platforms, about one million published skills and nearly two hundred eighty million installs, and those figures are its own.
A skill is a folder of markdown and scripts that is trivially copied, so ownership was never defensible. Every added runtime that reads the format makes existing skills more useful to Claude. With OpenAI and Google maintainers on board, rivals have no reason to fork and can compete on models and distribution. The proposed security guidance for writing and installing skills will set the trust rules for an install surface of that size.
In other news…
Microsoft says its MAI-DxO orchestrator was right eighty-three percent of the time on complex New England Journal of Medicine cases in a simulation. Primary care doctors and generalists working alone scored thirty-six percent. The study is in Science.
The comparison group excluded specialists and physician teams, and it was a simulation, not live care. The orchestration numbers are more informative: GPT-5 alone scored about seventy-nine percent, and DxO came in about four points higher at roughly three thousand dollars less per case. Most of the gain comes from the base model. A Beth Israel Deaconess trial is starting, and it will test whether the headline survives messy intake and accountability for errors. Treat the orchestration layer as an increment worth piloting.
That's the briefing. Have a great day, and don't forget to subscribe.