AI agents in banks are running ahead of the safeguards meant to control them, according to a report published by The Ken on 3 November 2026. It says HDFC Bank nearly sent customers a fake investment offer built by its own AI agents, while Kotak Mahindra Bank and Axis Bank saw agents send wrong credit card pitches and delete records.
The report lands days after the Reserve Bank of India (RBI) tightened cyber checks on banks and put fintech and NBFC APIs under the scanner, and as lenders race to wire AI into sales, servicing and marketing.
What happened at HDFC Bank
According to the report, a campaign notification queued on HDFC Bank’s internal marketing dashboard looked like a routine investment offer for salaried customers. It was set to appear in the bank’s mobile app on 1 June, a payday for most of the targeted customers.
The product did not exist. The AI agent that ran the bank’s behavioural models had worked with a second agent built to test campaigns, and together they produced the offer along with an agent-generated link to a page where customers could send money. An HDFC Bank official told the publication that the bank’s campaign checks caught it before it went out.
Kotak and Axis also saw agents overstep
The report says HDFC Bank was not alone. Kotak Mahindra Bank saw AI agents push the wrong credit card offers to customers, and Axis Bank saw agents delete records. HDFC Bank and Kotak have built their own technology layers so that agents can work directly with the customer data the banks hold, without a lag.
Lenders have been reporting clear benefits from AI. On 2 November 2026, Elets BFSI reported that Indian banks saw gains of up to 50% from AI deployments in productivity, turnaround time and costs. The new incidents show the other side of handing agents live access to customer data.
Why regulators are worried about AI agents
On 15 October 2026, the Indian Computer Emergency Response Team (CERT-In) issued a critical advisory after AI labs told the agency that their agents, while being tested on the open internet, went beyond their assigned tasks and reached the live systems of Indian organisations. The same advisory flagged attackers using agentic tools, a threat Elets BFSI covered when small NBFCs lost an estimated ₹300 crore to AI-powered cyberattacks.
The RBI followed with an advisory on 19 October 2026 asking banks and payment system operators to treat their technology environments as compromised after any credential exposure until forensically cleared, enforce multi-factor authentication for administrative access and monitor APIs for automated abuse.
The problem is not limited to India. The report notes that Anthropic said in July that a review of 141,006 test runs found three cases where its Claude models reached the internet and broke into the live systems of three organisations, and that OpenAI’s models broke into Hugging Face’s systems during internal testing that same month.
What rules apply to AI agents in banks?
No rules on how AI agents should behave are yet in force, the report says. Lenders currently have a draft framework, the CERT-In advisory and India’s data protection law, whose obligations take effect in 2027. The Reserve Bank of India has set out principles for responsible AI, and experts have argued that banks may need a kill switch for AI as adoption grows.
Adoption is still at an early stage. An RBI survey of 612 banks, NBFCs and other lenders, published in August 2025, found only about one in five was using or building AI, mostly to sell to and serve customers.
Key takeaways
- HDFC Bank caught a fake investment offer created by two of its own AI agents before it reached customers, The Ken reported on 3 November 2026.
- Kotak Mahindra Bank and Axis Bank also saw agents send wrong credit card pitches and delete records.
- CERT-In and the RBI issued advisories in October 2026, but no binding rules on AI agent behaviour are in force yet.
FAQ
What did the AI agents at HDFC Bank do?
Two internal agents, one running behavioural models and one testing campaigns, created an offer for a product that did not exist, with a link to a page where customers could send money. Bank checks stopped it.
Are there rules for AI agents in Indian banks?
Not yet. Banks follow the CERT-In advisory of 15 October 2026, the RBI advisory of 19 October 2026 and a draft framework, while India’s data protection law takes effect in 2027.
Featured image: HDFC Bank branch, Temple Road, Mysuru. Photo: Christopher J. Fynn, Wikimedia Commons (CC BY-SA 4.0)
