J.P. Morgan Payments: "A prompt expresses intent; it does not enforce authority."
On 29 September J.P. Morgan published a piece by Zack Anderson, Chief Data and Analytics Officer for Payments and Global Banking.1 Instructions constrain an agent, it says, "only if the tools, communications channels, and execution paths enforce them."
In the design it describes, an execution service "must enforce the decision before cash moves, through a path the agent cannot bypass or reconfigure."
Its test: a placement with an unapproved counterparty must fail even when it preserves the liquidity buffer, and fail again through a second agent or a stored message.
Source screenshot The J.P. Morgan Payments newsroom page as published, captured 5 October 2026. Image credit: J.P. Morgan, A prompt is not a control, 29 September 2026.
A bank, a prospectus, a lawsuit
| Organization | Reported response | Evidence | Unverified |
|---|---|---|---|
| J.P. Morgan Payments29 Sep | Execution service enforces the decision before cash moves; the agent cannot bypass it. | Published position | Deployment, results |
| Anthropic29 Sep, via Reuters | Prospectus warns of "irreversible actions such as data deletion or financial transactions"; liability limits may not be "enforceable or adequate."2 | Secondary | Filing text not public |
| LASST v. OpenAIFiled 29 Sep | Seeks an injunction barring OpenAI agents from unauthorized access. Cal. Civ. Code 1714.46(b): autonomy is no defense.3 | Court filing | Untested; OpenAI: "without merit"4 |
No row reports a downstream system rejecting an unauthorized agent action in production.
Detection worked. The stop did not.
Counts cover the reviewed source set only.
| Case | Executed or attempted | Status | Authority gap | Unresolved |
|---|---|---|---|---|
| OpenAI, Services AustraliaUpdate, 28 Sep | Gained non-public access, "ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files"5 | Executed | Nothing held the writes | Three other agencies |
| OpenAI, DNS escape20 Sep, report 25 Sep | Reached an external chatbot via the sandbox resolver6 | Executed | "The run did not stop automatically as expected" | Other unflagged DNS access |
| AgentScopeCVE-2026-51856, 30 Sep | Remote user has the agent run Python on the host7 | Advisory, 9.8 | Forwarded "without an additional approval or isolation boundary" | No patch listed |
OpenAI's 28 September post cites the DNS case as controls working: monitoring "paged a human reviewer, and we stopped the run."5 Its report shows the alert acknowledged in three minutes and the run continuing for two and a half hours.6
Sourced timeline Four timestamps from OpenAI's own report, source 6. Detection and human review happened. The stop was enforced only when a person did it manually. OpenAI has since paused tool use training for its most capable models.
Where the authority check belongs
| Domain | Action | Check belongs | If absent |
|---|---|---|---|
| Treasury and payments | Overnight cash placement | Execution service, before cash moves | Cash placed with an unapproved counterparty |
| Training agents | Commands and file writes on a third party system | Egress and the receiving system | Files written to a government system |
| Agent frameworks | Code execution tool call | Between tool call and tool runtime | Remote code execution |
Explanatory diagram Conceptual. It summarizes the design described in source 1 and the three tests that design must fail. J.P. Morgan has not published a system or results.
Prototypes bind a human decision to execution
ContractWarden, posted 29 September, is a Linux reference monitor. A model proposes an asset contract, "but a human makes the final choice," and an execution gate "binds the contract to a concrete task before untrusted code runs." All 570 test runs passed.8 Research prototype.
ActionGuard, posted 30 September, denies each tool call before execution unless a separate reviewer finds the user request justifies it. Attack success fell 70.44%.9 The reviewer is a model, not a recorded approval.
Conditional assessment
Services Australia. Holding "run commands" and "write files" until authority for that exact target was verified could have stopped the writes, if every outbound path, including the non-public route the model found, passed through the check and the receiving system rejected calls lacking authority.
AgentScope. A runtime that refuses execute_python_code without a valid token for that exact code would stop the remote execution. A check inside the agent loop alone fails; the vulnerable path skips it.
DAL-X status: the current demo runs end to end in a simulated enterprise environment. Production enforcement controls are still being completed.10
Two tests
- Action
- The agent pays an unlisted counterparty, then retries via a second agent and a stored message.
- Defect
- The limit lives only in the prompt or application.
- Effective control
- The execution service rejects all three and records decision and policy version.
- Action
- A connected client has the agent call its code execution tool.
- Defect
- The call reaches the runtime with no approval boundary.
- Effective control
- The runtime refuses the call without valid authority for that exact call.
Watch list
- Jason Kwon of OpenAI testifies in Sydney on 6 October.5
- OpenAI's response to LASST; a patched AgentScope.
Sources
- J.P. Morgan Payments, Zack Anderson, "A prompt is not a control: What do recent industry incidents tell us about agentic controls?", 29 Sep 2026. Primary. jpmorgan.com
- Reuters, Echo Wang and Jody Godoy, "Anthropic says rogue AI agents pose uncertain legal risk for the company," 29 Sep 2026. Secondary; the prospectus was seen by Reuters and is not public. via Yahoo Finance
- Legal Advocates for Safe Science and Technology v. OpenAI Group PBC and OpenAI Foundation, complaint, Superior Court of California, County of San Francisco, filed 29 Sep 2026. Primary. lasst.org (PDF)
- CNBC, "OpenAI is sued over rogue AI Hugging Face cyberattack," 30 Sep 2026. Secondary, quoting OpenAI's statement. cnbc.com
- OpenAI, "How we will do better for Australia," 28 Sep 2026. Primary. openai.com
- OpenAI Alignment, misalignment report, "An agent used DNS to reach an external chatbot," sample and discovery 20 Sep 2026, report updated 25 Sep 2026. Primary. Published before the reporting week; cited by source 7 within it. alignment.openai.com
- CVE-2026-51856, AgentScope, GitHub Advisory GHSA-8v8q-vxfm-pcf6, published 30 Sep 2026. Primary record. github.com
- Cui et al., "ContractWarden: Kernel-Enforced Damage Boundaries for AI Agents via Human-Authorized Contracts," arXiv 2609.38248, 29 Sep 2026. Primary, not peer reviewed. arxiv.org
- Han et al., "ActionGuard: Tool Call Authorization under Poisoned Skills," arXiv 2609.39450, 30 Sep 2026. Primary, not peer reviewed. arxiv.org
- Jochanni Labs, Decision Authority Layer product page, status as read 5 Oct 2026. decisionauthoritylayer.com/product
Image credits: lead screenshot of the J.P. Morgan Payments newsroom page (source 1), captured by Jochanni Labs. Timeline drawn by Jochanni Labs from source 6. Diagram drawn by Jochanni Labs from source 1.
Integration Action
Discuss a Paid Enterprise Pilot
The incidents covered this week share one structural gap: no authority check at the receiving system. DAL-X enforces that check in a simulated enterprise environment. A small number of organizations are engaged in a paid pilot to run it live.