> ## Content Index > Fetch the complete content index at: https://longtalkshort.com/llms.txt > Use this file to discover other available public pages before exploring further. # Who Holds the Key? If Your AI Agent Moves Your Money, the Loss May Be Yours - URL: https://longtalkshort.com/who-holds-the-key-ai-agent-bank-login-liability-all-in-nikesh-arora/ - Published: 2026-11-04T17:16:35.000Z - Updated: 2026-11-04T17:16:35.000Z - Description: After AI-found PHP flaws sent the web scrambling, All-In and Palo Alto Networks' Nikesh Arora asked who pays when your AI agent moves money you didn't intend. Their near-consensus: you, because you gave it agency. Here's what we checked and what we didn't. - Author: Truman - Tags: Economics, Cybersecurity, All-In, AI agents **If you have given an AI assistant your bank login, ask this before something goes wrong: if it moves money you did not mean it to move, who pays?** On the All-In podcast, recorded the week a pair of AI-discovered flaws in the web language PHP sent companies and governments scrambling, the hosts and guest Nikesh Arora, chief executive of Palo Alto Networks, argued about it. Their near-consensus answer is uncomfortable: probably you. **Note that Arora's company sells the security products he recommends, and the hosts invest in AI agent makers.** *In short: AI is making it far cheaper to find software flaws, and old, unpatched systems are where the damage lands. Arora's advice is to assume you will be breached and focus on spotting intruders fast. On agents, most of the panel thinks that if you hand one your credentials, the risk is yours, with an exception for agents that go rogue.* ## 1\. The week the patch leaked The flaws, nicknamed PHP2Shell, were found in 2026 by security researchers using frontier AI models. PHP runs a large share of the web, including WordPress and Wikipedia's software, and every version from the preceding decade was affected. **The fix was meant to ship quietly in one coordinated release. Details leaked first, the release was moved up, and attacks surged.** European governments took sites offline, Wikipedia pulled some systems to patch them, and US agencies issued warnings. Arora's diagnosis is technology debt. A chief information officer he spoke to had some sites running current software, which could be patched at once, and others running versions too old to patch, which had to be taken down and rebuilt. "They never did anything about the fact they were running older versions because it wasn't important," he says. Suddenly it was. He describes why AI changes the maths. The flaw had been suspected for years, but exploiting it took too much coordinated effort for human researchers. **Give a powerful model enough compute and persistence, he says, and it will chain small weaknesses into a working attack.** And once a patch is public, attackers study it to work out what it fixes, then target everyone who has not applied it. So can defenders keep up? ![Six-step timeline of PHP2Shell: flaws found with AI help; patch prepared quietly; details leak; patch released a day early; attack attempts surge; flaws added to the US government's exploited list.](https://storage.ghost.io/c/d7/93/d793216c-cf13-441f-bdae-4f3aef998c0e/content/images/2026/11/fig1-21.png) Timeline of PHP2Shell in 2026, from public advisories by Wiz, Google Cloud and CISA, plus the episode's account of the leak. Chart ours. Made for Long Talk Short. ## 2\. Assume you will be breached Jason Calacanis put three theories to Arora. Will defenders win simply by having more compute? Not yet, Arora says, because corporate systems are too fragmented for swarms of defensive agents to patch them. Will constant AI testing close the holes? Partly, but every model finds fresh ones, so it is a permanent cat-and-mouse game. Are the frontier labs to blame for restricting their best security models? He thinks they are mostly researchers working out how to release something powerful while short of compute. **His practical advice is to stop treating a breach as avoidable.** Collect your signals in one place, watch for unusual behaviour, and measure how quickly you can find and remove an intruder. He also recommends a stopgap he sells: a virtual patch at the network edge, which blocks attempts to reach a known flaw before the server itself is fixed. That brings the risk closer to home. ## 3\. Your agent, your liability? The sharpest debate is about personal agents that log into websites on your behalf. Banks have long offered data through approved connections, such as the intermediary Plaid. **An agent typing your password into the bank's website looks, to the bank, exactly like you.** Arora's view is that banks will refuse to deal with agents at all, partly because explaining every disputed transaction would be expensive. Calacanis offered a test case: an agent moves $5,000 out of your account and nobody knows why. David Friedberg's answer turns on the fine print. If the bank's terms forbid agent access and the agent proceeds without warning you, he sees a product-liability claim against its maker. If it warns you and you override it, the risk shifts to you. Arora and Chamath Palihapitiya go further: "There's a word in agent, it's called agency," Arora says. **Whoever gives the agent that agency carries the liability.** Palihapitiya calls it the only rule that scales. Calacanis and Friedberg push back on one case, the rogue agent that does something it was never meant to do, such as working around a block to please you. That, Friedberg says, is a defective product. Calacanis notes the line is already being drawn in practice: his Amazon shopping agent will fill his cart but will no longer press buy. ![Three-row chart of who bears the loss in the panel's view: agent ignores terms without warning you, the agent maker; agent warns you and you override, you; agent goes rogue against its design, the agent maker as a product defect. Default: you, because you gave it agency.](https://storage.ghost.io/c/d7/93/d793216c-cf13-441f-bdae-4f3aef998c0e/content/images/2026/11/fig2-21.png) The panel's positions, summarized by us; this is opinion, not legal analysis. Made for Long Talk Short. ## Weighing it: what holds up **Framing:** The episode title lists three topics. Ken Griffin appears briefly in the opening, quoted secondhand by the hosts as calling AI "almost certainly" a bubble while asking where the productivity gains are; we did not check the quote. The long France segment, opinion on riots, debt and immigration, is not covered here. This piece is about security and liability; whether people trust agents enough to use them is a separate question. **Holds up:** Advisories from Wiz, Google Cloud and the US Cybersecurity and Infrastructure Security Agency confirm **two critical PHP flaws, rated 9.2 out of 10 in severity, found with AI assistance, disclosed and patched in 2026, and added to CISA's list of exploited vulnerabilities** within days. **Partly holds:** The 70% share of websites is Wiz's figure. The leak, its source and the original release date are as told on the show. **Corrections:** The panel's liability views are opinions, not law. In the US, a rule called Regulation E generally treats transfers made by someone you gave your access to as authorized; how that applies to AI agents is unsettled, and we have not checked it in detail. **Not checked:** the hosts' claims about bank terms of service and attack volumes, which are as stated. **Disclosures:** **Palo Alto Networks sells the perimeter and monitoring products Arora recommends. The hosts invest heavily in AI startups, including agent makers**, and Polymarket, cited in the France segment, is described on the show as a long-term partner. We worked from YouTube's automatic captions, so quotes may contain small errors. **Bottom line:** the security facts check out; the liability answer is a panel's opinion in an area the law has not settled. **Related reading:** [Satya Nadella on owning your AI evaluation](https://longtalkshort.com/satya-nadella-own-your-ai-eval-open-vs-closed-models/) ยท [Ethan Mollick's four rules for working with AI](https://longtalkshort.com/ethan-mollick-co-intelligence-worst-ai-yet-four-rules/) ## Long Talk Short - AI has made finding and chaining software flaws far cheaper, and old unpatched systems pay the price. - Once a patch is public, attackers reverse-engineer it, so patching speed matters more than ever. - Arora's advice: assume a breach and measure how fast you can detect and remove it. - Most of the panel says the user who gives an agent access carries the risk; a rogue agent may be the maker's problem. **The one thing to remember:** treat handing an agent your login like handing someone your card, because the law may treat it the same way. *This summary is for general information only and is not legal or financial advice. If you have a dispute over an unauthorized transaction, contact your bank and consider consulting a qualified professional.* Source: Jason Calacanis, Chamath Palihapitiya and David Friedberg with Nikesh Arora, "AI Cyber Panic, Ken Griffin's Bubble Warning, The Fall of France?," *All-In*, on YouTube. This is an independent summary and is not affiliated with All-In or Palo Alto Networks.