Kristalina Georgieva did not offer reassurance. At the IMF and World Bank meetings in Bangkok, the IMF’s managing director compared artificial intelligence to a Formula 1 car that could leave the track and “run people over.” The job, she said, was to install barriers so that “if a car was to fly out it doesn’t kill people.”
That is her way of saying the speed is real and the physics of a crash are unforgiving. For a bank, a payments firm, or any company already handing work to software, the line describes a control problem you already have.
She was speaking on a Friday panel with Jack Clark, Anthropic’s co-founder and head of policy, and Tiff Macklem, governor of the Bank of Canada. The Associated Press reported the exchange. Cybersecurity sat in her argument beside electricity and access to digital networks: the dull plumbing required if the gains from AI are going to spread, rather than pool inside a few firms and cities.
That panel, on the record, was about guardrails, infrastructure, and jobs. A separate commentary by Heather Stewart, drawing on the same meetings, presses a harder thesis: AI-scaled fraud could undermine trust in money, and software acting for customers could move deposits faster than a bank can answer the phone. The first is what officials said in public. The second is a risk argument. It deserves a control plan. It is not a forecast.
An agent with the keys is not a chatbot
An AI agent is software cleared to act. It can search, choose, and, if someone has handed over the credentials, move money.
If you are piloting AI for business (treasury sweeps, refunds, credit suggestions, customer follow-up), you are already deciding what that agent may touch. “The model can do it” is no kind of control. Complexity then gets ahead of the people meant to supervise it.
Georgieva, who has called her personal AI assistant bossy, joked that agents can be “really annoying” and asked whether their manners could be improved. Clark said there is “a dial between sycophantic and rude.” Manners are the easy setting. Authority is the one that matters.
A tool that finds a better savings rate and shifts the cash is an easy sell. It is also how a sensible optimization becomes a stampede, if many agents read the same table and chase the same exit. A bank run once needed a queue and a rumor. An automated one needs a shared objective and permission to transfer.
Stewart reports that Jamie Dimon, JPMorgan’s chief executive, has drawn a line: the bank will not let digital agents act for customers. “You don’t want rogue agents, and there could be thousands of them.” That is one institution’s boundary. It does not bind every firm. She also describes consumer tools that ask users to hand over financial details so an agent can hunt a better rate and move the balance. Nothing said at these meetings establishes how widely that is happening, or what limits sit underneath.
The liability point is narrower than a history lesson, and more urgent. If an agent moves money and something goes wrong (a bad transfer, or a criminal use of the same permission), it is not obvious who owes what. Courts may sort that later. A board that waits for the lawsuit has let the lawsuit write the control.
Fraud is a trust problem
Stewart’s picture of the threat starts with something ordinary: reports of a hack against connected equipment in French stores, systems turned against the businesses that ran them. If a device or a workflow can be reached from outside, it belongs on the risk register. You do not need a finished forensic report to put it there.
Her larger warning, as she reports Georgieva, is that AI is “putting the potential of digital fraud on steroids.” Social-media ads using fake celebrities to push gold or cryptocurrency. Email scams produced in volume rather than one clumsy note at a time. No loss totals were attached. Trust usually cracks on a story before it cracks on a spreadsheet.
I worry, today, that unless we figure out how to get ahead of this curve … we may end up with lots of people with shoeboxes under their beds.
In Stewart’s account, that image is personal. Georgieva was remembering Bulgaria behind the Iron Curtain, where thin trust meant cash kept at home. The worry she is raising now is that an AI-scaled fraud wave could push people the same way, out of banks, out of payments apps, and out of the formal system.
Treat that as a risk, not as a dated prediction of a run. A household can rationally unplug a connected oven. The financial version of that hedge is a collective loss. Households earn nothing on cash in a drawer. Banks lose the deposits that fund loans. Policymakers lose some of the transmission that makes interest rates bite.
Andrew Bailey, governor of the Bank of England, supplies the line Stewart uses to close the loop: “If we don’t have trust in money, we don’t operate as a society.”
Officials have a second, more familiar worry, and it should not be mixed up with the first. An AI investment boom could reverse hard enough to shake markets. The polite word is a correction. A fall in share prices and a fraud-driven loss of faith are different accidents. Boards should plan for both, and not assume that surviving one means they have survived the other.
The other risk is consent
The labor point from the same panel is the better-documented one. It sits outside the cyber story.
Describing an IMF study, Georgieva said repetitive work would disappear, that the investment boom would create service jobs, and that the net effect could still be positive. She also said services “don’t pay a lot, ” picturing young people “serving coffee in Starbucks” instead of entering routine professional roles. That is her account of the study, as the Associated Press reported it: a gain that can still leave people in thinner-paid work, not a claim that some fixed share of all jobs vanishes.
Macklem made the point trade economists have made for a generation. Technology, like open trade, can lift the total and still impose large losses. Fail to help the people on the wrong side of that split, and you get a backlash. Fraud and rogue automation threaten the pipes. A labor market that sheds routine work and replaces it with lower-paid services threatens consent for the pipes. Put both in the same memo.
What policy has, and has not, done
Clark was direct about the gap. Children’s toys, he said, are regulated more tightly than “the literal superintelligence I work on.” Companies should not be left to make these decisions alone. A coordinated pause among leading AI companies, he said, had been proposed in a blog post the previous month. Negligent policy could produce “some form of chaos.” He also said the world is now taking the issue seriously. Alarm and attention can both be true.
Elsewhere, the motion is thinner. Stewart reports that G7 finance ministers in Bangkok said they would simulate the financial system’s resilience to cyber-attack, and that the UK has pledged to raise AI safety during its coming G20 presidency. Scope, timing, and what would count as success were not set out. Exercises and intentions are not a rulebook.
Questions worth answering before the next pilot
- Is an AI-driven bank run an established forecast?
No. It is a risk argument: automated agents could herd deposits, and scaled fraud could push people toward cash. Nothing on the public panel turned that into a prediction. Treat it as a reason to cap transfers, not as a date on a calendar.
- Should every firm ban AI agents?
No. Stewart reports that JPMorgan will not let agents act for its customers. That is one boundary. The useful question is which actions an agent may take, with whose credentials, under what limit, and who pays when it is wrong.
- What should a limit actually look like?
Pick the action, the owner, and the ceiling before the pilot goes live. A refund agent can draft a refund and release it only under a cap the payments lead has signed. Above that, it stops. The agent never holds treasury credentials, and anything it sends can be reversed the same day from a queue a person can see.
- Who is accountable when the agent is wrong?
A person, not a model. If the workflow can move money or change an account, someone in the business already owns that risk. AI automation does not move the signature. If you cannot name who approves, who is called at 2 a.m., and who eats the loss, the pilot is not ready.
- What happens to the people whose routine work this removes?
Budget for them in the same plan as the software. A net gain can still look like a demotion to the people living it. Retrain, redeploy, or be honest about exits. A backlash against the tools is a business risk, not a soft aside.
Put the barrier in the workflow
Boards do not have to wait for a communiqué. Pick one workflow and write the barrier down.
Take refunds. The agent may draft the refund and release it only under a ceiling the payments lead has signed. Above that ceiling, it stops and a person approves. That payments lead owns the workflow, including the night call. The agent has no treasury credentials and no ability to change where money is sent. Anything it releases can be reversed the same day from a queue that person can open without calling a vendor.
A sales follow-up is a different action, and a smaller permission. The agent can draft the note and schedule it. It cannot take a card, store one, or pass credentials to a payment tool. Talking to a customer and moving their money are different jobs. Do not give both to the same piece of software because it is convenient.
Build review and authentication for the volume you will face when fraud is cheap to produce, not the volume you see now. And fund the retraining, or the exit, in the same budget as the AI automation. Gains that are real in aggregate still produce a backlash when the losses are left to individuals. Macklem was describing a pattern with a long record, not offering a slogan.
The private hedge (a simpler fridge, an oven that cannot be reached from outside) can be rational at home. Cash in a shoebox cannot be the institutional answer. It starves lending and treats distrust as a personal workaround.
Georgieva asked for barriers so that a fast car, if it leaves the track, does not kill people. For a firm, the barrier is dull on purpose: permission, a ceiling, a named human, and a way back. Install those while it is still a choice.
The control problem, one bank earlier
Dimon’s line on agents is easier to weigh beside how he once answered for a trading loss that got ahead of the people meant to supervise it.