Ruslan | Kulrus (AI Security for Banks)

Founder of Kulrus AI Security Posture Management for Banks · Inventory every AI system · OWASP LLM Top 10 + NIST AI RMF · Audit-ready reports

[0xor0ne @0xor0ne]

How to use LLMs for vulnerability research (@ZephrFish)

MCP: https://t.co/MT4LbPOVGU
Harness: https://t.co/Boa1uD5BQu

#infosec #llm

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

The Three Lines of Defense was built for humans.

Now agents exist in four places at once:

Client agents can drain accounts. Attacker agents can probe and move in parallel. Internal agents and security agents try to detect and stop them. All of this can happen within minutes of the same signal.

The first line now has to control agents that move money in real time.
The second line needs visibility into all four.
The third line has to audit decisions that were made in milliseconds.

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

Most banks still treat compliance as a policy problem.

The real constraint is evidence that exists before the agent moves money, not after.

When client-side agents start acting on the same signal, that evidence has to be generated in milliseconds.

How close are banks to having that today?

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

Most agents that can move money aren’t inside the bank at all. They’re on the client side, connected to accounts.

When news hits and stocks drop, client agents start moving to cash at the same time. The bank’s systems react separately.

How do you see runtime governance working when the agents aren’t yours?

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

@infosec_fox MAS guidelines assume banks still have time to react.

They don’t. Agents now move money in hours. Most banks still need days to detect and stop them.

That gap is the real risk.

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

@ediggs What did my agent just do? isn’t a problem

it’s what will 10,000 agents do at the exact same millisecond when they all see the same risk signal.

Audit trails are useless if the liquidity is already gone.

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

@efipm Banks are talking about 30,000 agents. Who can stop them when they all move at once?

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

@IntCyberDigest UK banks are locking the doors. The agents will still get in.

The real risk isn’t one rogue bot. It’s thousands of them moving deposits at the same millisecond.

[AISecHub @AISecHub]

https://t.co/fif5dWOntI

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

A massive blind spot is developing in banking security, and it has nothing to do with fraud or data leaks. It’s about liquidity.

US banks are quietly tracking a surge in unvetted AI agents logging into customer accounts using real passwords. But the real danger isn't the access, it’s how these machines think.

Imagine thousands of corporate autonomous agents actively managing cash and counterparty exposure.
A completely ordinary piece of bad news hits a routine regulatory fine or a minor 5% drop in the bank's stock price.

Humans might wait and watch. AI agents don’t hesitate. They operate on cold, automated risk-minimization logic. To an algorithm, a minor risk spike triggers an immediate, rational rule: Move the funds to a safer haven.

Because thousands of agents monitor the same market data and apply the same optimization logic, they will all reach the exact same conclusion at the exact same millisecond.

Machines don’t panic they optimize. But when thousands of them optimize simultaneously, they create an automated, lightspeed bank run. Silicon Valley Bank can collapse at the speed of social media. The next crash will happen at the speed of light because AI removes all human friction.

You can’t stop this with standard security. Demanding a manual Face ID check or a CEO's selfie 500 times a day completely kills the automation businesses want. Plus, real-time deepfakes easily bypass camera checks anyway.

The only viable solution? Behavioral Biometrics.
If banks can't stop the rationality of the agent, they must detect the execution style of the machine.

Humans are beautifully chaotic we hesitate, make micro-errors, and move mice with erratic friction. AI agents send request batches at perfect intervals and click pixels with mathematical precision. Real-time profiling of this "machine fingerprint" is the only way to trigger automated liquidity circuit breakers before the vault evaporates.

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

Exactly. But here’s the catch: who issues that license?

If banks wait for a global standard or government framework, fintechs will have already built the entire economy on "borrowed masks." Singapore is right, but the tech is moving faster than the compliance.

How do you enforce a license on an agent running inside a simulated phone?

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

Banks block AI agents. Fintech builds doors for them.

One day on X shows the gap:
1. Banks ban agents logging in with user passwords.
2. A founder pays salaries via Revolut using an agent in an emulated phone.
3. Cashfree launches checkouts built for AI.
4. Mercury ships Agent Controls: audit trails, permissions, instant disconnects.

Fintech builds doors. Banks brick up windows. The agents get in either way.

Blocking is just what you do when you can't tell an agent from a customer.

P.S. My Grok bot finds these twice a day. Want the setup for your niche? Reply "+" and I’ll send it.

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

@CloudFuze Visibility only spots the mess. it doesn’t clean it up.

Most teams let their shadow IT list grow forever.

What to Fix it this quarter:
1. Block the worst tools immediately.
2. Replace others with official tech.
3. Set strict expiration dates for the rest.

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

@YassineCorse The named human still has to rebuild the context from scratch every time. If the only record of what the agent saw and proposed lives inside the agent, the reviewer cannot move faster than a full manual check. That is why the savings disappear.

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

Picture this: a bank has an outside agent that drafts loan decisions.

The framework asks about consequences and autonomy. But if the agent can still approve a high-risk file without a named human saying yes, and the logs stay inside the vendor tool, the examiner sees the outcome only after the money has already moved.

Who owns that risk when it goes wrong?

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

What happens when a bank cannot name which agent ran which action under whose authorization?

The deeper problem is that most banks still give agents the same long-lived access as service accounts.

Without short-lived, task-scoped keys that expire after one job, the audit trail just records damage that already happened.

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

An agent that opens a PR after hours is not a tool you can treat like autocomplete.

The practical gap is that the person who approved the scope needs a way to see the exact files and actions the agent took, held outside the agent, so they can still own the outcome after the PR is open.

[Ruslan | Kulrus (AI Security for Banks) @NeoRusII]

@buckleyplanet How do you give each AI agent its own identity so it does not just inherit a person’s standing rights or a service account’s broad access?