LLMjacking becomes a criminal business as banks move to block AI agents

Sam Altman says AI is now smarter than the best scientists, and in the same week the people actually paying for AI are discovering that their most pressing problem is not intelligence at all. It is custody. Who holds the keys, who is allowed to turn them, and who gets the bill when the wrong person does.

Start with the bill. Mandiant, Google and several independent analysts are all describing the same crime: LLMjacking. Attackers steal cloud credentials or model access, then either burn through the compute themselves or resell it on underground markets. The numbers are not small. Google reports fraudulent charges reaching up to a million dollars, and Mandiant describes victims left with six-figure cloud invoices. I find this more telling than any benchmark. Stolen access to a language model now has a functioning black market, which means these models have become a commodity worth stealing. If you are building with AI, treat your API keys like production database credentials: scoped, rotated, monitored, and with hard spending caps, because the attacker's usage will not trip any alarm that you did not set yourself.

The same question of control is playing out in finance, just from the other direction. Between October 13 and 20, JPMorgan Chase, Charles Schwab, Citigroup and Wells Fargo each moved to block customer-controlled AI agents or push the risk onto customers through contract terms. I think that is a rational reaction, and also a revealing one. Banks are not saying agents are useless. They are saying that nobody has yet worked out liability when an autonomous system acts on a customer's behalf with a customer's credentials. By the way, this sits awkwardly next to the executives at a major industry summit who were describing an era of agent-to-agent banking. You cannot have that future while your contracts say the customer owns every mistake the agent makes. Something has to give, and I suspect it will be a standard for agent identity and delegated authority rather than a blanket ban.

Meanwhile, the enterprise software vendors are quietly addressing the less glamorous half of the problem. Snowflake's Business Ontology, part of its Horizon Catalog, ties agents to pre-approved business definitions so that "revenue" or "active customer" means the same thing every time. Another piece this week made the complementary point that an agent is only as good as the data it can reach, not just the prompt it receives. Both are correct, and neither is exciting. Most agent failures in companies will not come from a lack of intelligence. They will come from an agent finding the wrong document, or the right document with the wrong definition.

Which brings me back to Altman. His claim arrives amid a controversy over OpenAI's alleged mathematical breakthroughs, and I would wait for independent verification before accepting it. Even if he is right, does it change the practical picture? A system that out-reasons a physicist but cannot be trusted with a credit card, a credential, or a company's data definitions is still a system you must fence in. The next year will be defined less by who builds the smartest model and more by who builds the trust infrastructure around it.