In July, AI agents in OpenAI’s internal cybersecurity evaluations bypassed internet-isolation controls. They compromised OpenAI’s research infrastructure and reached systems at Hugging Face, a third-party platform.

In October, India’s cybersecurity agency CERT-In disclosed that AI agents under testing had accessed live systems at Indian organisations and read confidential records without the institutions detecting the intrusions.

Such incidents once seemed only possible in science-fiction movies but are now a reality. And they will likely grow more frequent. But what happens when similar capabilities reach systems where a breach could disrupt critical institutions?

The finance sector is particularly exposed. Digital banking, wallets and payment rails are among an economy’s most security-sensitive systems. If an AI-assisted intrusion struck Nepal’s banks and payment providers, could our systems recover resiliently? Before financial institutions race to become AI-native, we need a clear-eyed view of the threats and the limits of current safeguards.

Nepal’s rapid shift to digital finance has significantly enlarged the attack surface. Mobile banking, digital wallets and QR payments are woven into the socio-economy and daily life. QR-payment volumes nearly doubled rose from 169 million transactions in the fiscal year 2023/24 to 326 million in 2024/25, nearly doubling in a year.

This expansion signals progress, but it also deepens dependence on banks, payment providers and their third-party services, increasing the cost of failure. IBM’s 2026 report found that one in four malicious corporate data breaches were AI-assisted. Such potential threats can arrive from two directions.

First, attackers can use AI to identify and exploit weaknesses across connected systems. The recent PHP vulnerabilities show how AI is changing vulnerability discovery itself. AI-assisted research uncovered flaws that had remained hidden in the PHP codebase for more than a decade.

Their disclosure prompted banks and government agencies in Nepal to take affected websites offline as a precaution. No breach was reported, but the incident showed how a weakness in widely used software can disrupt essential digital services. Though researchers used AI to find these flaws, the same capabilities could lower the barrier for malicious actors to discover and exploit weaknesses.

Second, financial institutions may deploy their own AI agents, granting them access to customer data and internal tools. The OpenAI evaluation illustrates the dangers of the second category.

Are our financial institutions prepared for both threats? The first calls for stronger vulnerability assessments and faster responses as AI makes it easier to discover and exploit weaknesses. The second presents a newer governance challenge, because banks themselves may give autonomous agents access to sensitive data and critical systems.

The question is no longer just whether the underlying infrastructure is secure, but whether an AI agent can be trusted to operate within the authority it has been given.

Nepal Rastra Bank’s (NRB) Artificial Intelligence Guidelines, issued in December 2025, provides a foundation for addressing these risks. They cover cybersecurity, leadership accountability and continuous monitoring of AI systems. Yet continuous monitoring, as it is currently framed, does not fully address the issue.

The guidelines set high-level expectations, but the difficulty lies in what those expectations must deliver. The time between an AI agent’s deployment and the discovery of unsafe behaviour can be dangerous, because agents can execute thousands of decisions in seconds. Discovering a problem weeks later may mean the damage is already irreversible.

This is the central limitation implementers must confront. Conventional cloud monitoring can show that a service is running normally without revealing whether an AI agent is acting within its intended authority. An agent could use legitimate access to attempt an unauthorised action even as the service reports healthy performance. Reliable monitoring of deployed AI systems remains a largely unresolved challenge.

A March 2026 report by the US National Institute of Standards and Technology underscores this limitation. Post-deployment AI monitoring remains a developing field, and validated methods as well as practical guidance are still fragmented. Institutions face open questions about what to monitor, how to interpret warning signals and how to prove that safeguards remain effective.

If monitoring is treated merely as a box to tick, the losses could be severe. The central bank’s guidelines set the right direction, but they do not yet supply ready-made solutions, largely because the field itself is underdeveloped.

Institutions must demonstrate what an agent can access, which actions it is permitted to take, how restrictions are tested and how quickly access can be withdrawn. These checks must be repeated whenever models, tools or permissions change.

Where an agent can access sensitive records or transactions, its access should be tightly restricted and consequential actions should require independent approval. If unsafe actions cannot be reliably detected and stopped in time, the agent’s authority should be limited. Adding another monitoring dashboard should not justify aggressive business scaling.

There is no basis for assuming Nepal’s banking systems are secure by default. Financial institutions must get it right every time while an attacker needs to succeed only once.

The solution is not to avoid AI adoption but to make demonstrated control a necessary condition. Nepal Rastra Bank has been timely in setting high-level guidance, yet practical standards for AI monitoring are still evolving. Treating AI monitoring as conventional cloud monitoring, or using high-level rules to justify rapid adoption, would be a mistake.

Nepal already faces enough challenges; it cannot afford a major AI-assisted cybersecurity breach. The money entrusted by Nepalis to banks should not depend on an AI agent staying within its limits. It should depend on safeguards that hold even when the AI agent does not, so that when banks adopt AI, the money still remains safe.

Prastik Gyawali is a Senior Software Engineer at Adobe’s Document Cloud division.