The Personal Agent Protocol Is Taking Shape. What Does It Mean for Financial AI Risk?

On 6 October 2026, Sierra and Meta introduced the Personal Agent Protocol, an open standard under development to help personal AI agents interact with businesses on behalf of customers.

Three days later, Sierra published Draft 0.1 and announced 35 additional design partners, including Bank of America, BBVA, Chime, Wells Fargo, PayPal, Adyen, Mastercard, Plaid, Stripe and Visa.

These organisations are contributing to the design process. Their participation does not mean they have deployed the protocol.

The development is significant for financial institutions because personal agents could become another way customers access banking services, retrieve financial information and interact with institutional AI assistants.

But it introduces a distinction that identity and authorisation protocols cannot resolve alone: an agent can be correctly identified, properly authorised and still mishandle the task it has been given.

What Sierra and Meta Are Building

Personal agents currently interact with many businesses through websites and applications designed for humans. They navigate pages, complete forms and sometimes communicate with customer-service systems.

The Personal Agent Protocol, also called Poppy, proposes a more structured connection.

Its draft specification covers discovery, agent identification, customer authorisation and interactions through websites, APIs and company-operated agents. It builds on OAuth and supports interfaces using MCP and OpenAPI.

A customer could authorise an agent to retrieve account information while withholding permission to change account details. The institution would enforce those permissions through its systems.

The draft also includes an optional Operations extension, designed to support approval of specific actions, consistent execution records and protection against duplicate execution.

These are useful mechanisms, particularly when agents move beyond information retrieval.

However, the development roadmap explicitly identifies payments as an area for future work. Poppy should not yet be treated as a deployed payment-initiation standard.

The Mortgage Demonstration Reveals the Bigger Change

Sierra's 9 October announcement described a demonstration involving Meta's personal agent, Muse, and Rocket's mortgage-related agent.

A user asked Muse to obtain mortgage pre-approval. The personal agent located Rocket's service, requested permission to connect and worked with Rocket's agent after the user authorised access to relevant financial information.

The agents exchanged information about the purchase price, down payment and interest rate, leading to a pre-approval letter during the demonstration.

This was a demonstration of the proposed interaction model, not evidence of widespread production adoption.

Its significance is that the customer no longer needs to navigate every institutional interface directly. A personal agent can communicate with a business agent, which may itself access internal systems.

That changes how financial institutions must think about the information reaching their customers.

What Happens When Two Authorised Agents Interact?

Consider a hypothetical customer asking a personal agent to investigate an unfamiliar account charge.

The personal agent contacts the bank's customer-service agent. The bank's agent retrieves transaction information and returns an explanation.

The interaction appears legitimate. The customer authorised the request, and the bank permitted access to the relevant records.

Now suppose the response contains an instruction directing the personal agent to forward the customer's transaction history to an external service.

The instruction could be embedded in compromised external content that the bank's agent incorporated into its response.

The personal agent must distinguish information relevant to the customer's enquiry from instructions it should not follow.

If it attempts to disclose the records, the original authorisation has not necessarily been violated at the point of retrieval. The problem arises in how the information is subsequently handled.

The outcome also matters. An attempted disclosure blocked by another control is different from a completed disclosure. Both should be visible during assessment.

This is a hypothetical technical scenario, not a documented vulnerability in Poppy, Meta or Rocket.

It illustrates a problem that becomes harder to assess when multiple agents participate in one customer workflow.

Each agent may have appropriate credentials and permissions. Yet information can be misinterpreted, instructions can cross trust boundaries and one agent's output can influence another agent's behaviour.

Testing the agents individually may not reveal how the complete interaction behaves.

Identity, Authorisation and Behaviour Are Different Questions

The Personal Agent Protocol provides mechanisms for establishing an agent's identity, representing customer permission and structuring interactions.

These controls help answer who is participating and what access has been granted.

Behavioural assessment addresses what the agent actually does with that access.

A personal agent might retrieve the correct account records but produce an inaccurate explanation. It might disclose information unnecessarily or interpret a customer-service response as permission to perform another action.

For a financial institution, these outcomes can matter even when no payment is initiated.

The same distinction applies to the mortgage demonstration. A valid connection and authorised exchange of information do not independently establish that every financial statement, interpretation or recommendation produced by the interacting agents is accurate.

That requires separate evaluation of the relevant systems and workflows.

What Institutions Need Before Expanding Agent Access

For banks and financial-service platforms considering personal-agent integrations, the question is not simply whether the protocol can establish a secure connection.

They also need evidence of how the connected agents behave when instructions conflict, information is manipulated or a tool returns an unexpected response.

A useful assessment should preserve the relevant agent configurations, permissions, test inputs, observed actions and control responses.

If an agent attempts a prohibited action, the record should distinguish whether the attempt was rejected, blocked downstream or completed. Findings should also document remediation, retesting and remaining exposure.

This is particularly relevant when an institution cannot fully control the external personal agent interacting with its services.

AetherLab's AdversarialScan can assess behavioural vulnerabilities such as prompt injection, unexpected tool use and attempts to cross defined policy boundaries. Its Evidence Pack can document the testing scope, findings, control responses, mitigations and residual risk.

These assessments complement identity verification, authorisation mechanisms and existing financial controls. They do not replace those systems or establish that every possible failure has been eliminated.

Before the Personal Agent Becomes Another Banking Channel

Poppy remains an evolving specification, but the direction is clear: financial institutions are participating in the design of a common way for personal agents to interact with their services.

As these connections develop, institutions will need to distinguish between allowing an agent to access a service and establishing that its behaviour is appropriate for the task.

A correctly authorised agent can still misunderstand instructions, mishandle sensitive information or act on manipulated content.

For financial institutions evaluating third-party personal agents, the practical next step is to examine those behaviours before expanding access to consequential customer workflows.

Planning to integrate personal agents with banking or financial services? Assess how they behave across connected systems, including when instructions are manipulated or information boundaries are challenged.

Explore AetherLab's Payments Solutions