Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.

Start free trial →
AS Alex Stamos On Risky Business

“I actually think it's effectively impossible for banks to stop this. … It is, I think, difficult to build an authentication system that will defeat Muse, but not defeat your average 72-year-old banking customer.”

Risky Business · Software Engineering & Infra · October 2026

“I actually think it's effectively impossible for banks to stop this. … It is, I think, difficult to build an authentication system that will defeat Muse, but not defeat your average 72-year-old banking customer.” — Alex Stamos, Risky Business

Context

The hosts were discussing AI agents doing people's online banking. Stamos said some consumer agent startups have defeated every CAPTCHA and bot check, asking users to hand over their SMS, password manager and passkeys, which leaves fragmented US banks with few options.

Transcript

Risky Business Around 13:51 into the episode
James Wilson

…side that maybe there is actually an easier way when you've got a decentralized system because you're dealing with a smaller number of customers, but then the investment's a problem. So I get this is tricky, but I think the problem here is the way banks do online banking, not these unvetted agents.

Patrick Gray

…thing that worries me is that is that fragmented banking ecosystem that you've got in the US with all these tiny little banks that, I mean, there's a lot of work to do here. And I sort of worry that some of your banks don't have the scale that's going to be required to address this sort of thing.

Alex Stamos

…turn over your passkeys, and we will take over every part of your life. And I expect that's what you're seeing here. I'm not sure exactly what Muse does, Facebook having actual value. You that could be sued away, perhaps, would be a little more careful. But like, I know Instinct and some other companies like that will absolutely do your banking for you. So I think this is actually quite hard. It is, I think, difficult to build an authentication system that will defeat Muse, but not defeat your average 72-year-old banking customer.

Patrick Gray

Yeah, that's right. And I mean, it's just another example in my mind of when technology providers are just doing it wrong. And what I mean by that is like when the password, you know, password managers are like, hey, just put your like MFA seed values into our password manager. And I'm like, no…

Alex Stamos

Yeah, a lot of these services allow passkeys and you can lock passkeys to specific GUIDs and to allow them to be non-syncable hardware passkeys. The number of non-enterprise services that do that is spectacularly small. So yes, if you're an enterprise, what you'll do is you'll say this has to be a…

Patrick Gray

Things are going great. This is real good. Now, look, we actually just touched on this a moment ago, but we've got a paper here that has looked at how you can hide malicious capabilities in AI models. Now, I think your argument, Alex Stamos for one of the major Chinese labs to do this would…

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

More from Risky Business