Royal Bank of Canada has decided to block third-party personal AI agents from direct access to its authenticated digital properties, including online banking, the bank said in an Oct 27 post. Clients who use an AI agent to reach their RBC accounts will see those connections stop working. RBC acknowledged the move "may be disappointing for the small portion of our clients who use these tools," Financial Post reports, and CEO Dave McKay wrote that as agents become more autonomous, the stakes rise, from fraud and consumer harm to risks that could ripple through the financial system.

Why I think a ban is the wrong fix. RBC’s own post names the real problem: agents need access to your accounts and “may store your passwords to get there.” Banks should absolutely stop hacker bots running on stolen logins. But a customer’s own assistant, acting with the customer’s permission, isn’t that. The better answer is a key the bank issues to the customer’s agent, with limits the customer sets (read-only, or a spending cap), that can be revoked at any time. That lets the bank tell a trusted agent apart from an attacker, instead of locking everyone out.

This follows the US banks restricting agents that sign in with customer passwords, covered in our Oct 23 briefing.

Action item: If your team uses AI near money.
1. If anyone has given an AI tool their real bank login, change that password and remove it from the tool. Sharing a password can also affect a bank’s fraud guarantee; RBC’s terms exclude losses if you share your passwords.
2. Use the bank’s own app and official, read-only connections where they exist.
3. Keep a person approving anything that moves money.
4. Tell your bank you want agent keys with limits you control. Banks build what customers ask for.

Also today

Patch now: Node2Shell and PolyShell. CISA on Oct 27 added two actively exploited flaws to its Known Exploited Vulnerabilities catalog, per The Hacker News. CVE-2026-111497 (CVSS 9.2, “Node2Shell”) is a flaw in Google’s Brotli decoder; ELLIO reported exploit traffic in the wild that gets a shell on vulnerable Node.js builds. Node.js fixed it in 22.23.4, 24.22.1 and 26.12.1, and there is no workaround, so upgrade (move off any discontinued release line). PHP shipped fixed builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, and Bun, Envoy, Istio, .NET, Python and others have patches or advisories. CVE-2026-48356 (CVSS 9.3, “PolyShell”) is a file-upload flaw in Adobe Commerce and Magento; Sansec saw attackers use it to breach hundreds of stores. If you run a Magento store, apply Adobe’s security update now and ask your developer to check CMS blocks for injected code. Federal agencies must fix both by Nov 10.

Vet your ransomware recovery vendor before you need one. A federal grand jury indicted MonsterCloud CEO Zohar Pinhasi, who allegedly told ransomware victims he could recover files without paying hackers while secretly paying ransoms, charging clients more than $19 million and paying more than $8 million in ransoms, ProPublica reports. He has pleaded not guilty. Ask any recovery firm in writing whether it pays ransoms.