SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Why AI Agents Can Access Almost Every API But Still Can't Reach Your Bank

0
·1 views

AI agents can now connect to calendars, databases, and countless other services via API keys or OAuth tokens, but banking APIs remain largely inaccessible to them. EU regulations under PSD2 require third-party developers to obtain costly eIDAS QWAC and eSEAL certificates from qualified trust service providers, a process that takes weeks and costs up to €10,000 annually. This compliance barrier has made fintech aggregators like Plaid, Tink, and TrueLayer the dominant gatekeepers, as they absorb the certification costs and resell simplified API access to developers. Emerging agent frameworks such as Model Context Protocol servers cannot carry the legally bound client certificates required to connect directly with banks, forcing any banking integration to route through these intermediaries. Developers are currently limited to sandbox environments for agent-banking experimentation, while the industry debates whether a lighter regulatory tier for read-only, user-consented account access could eventually open a more direct path.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer finds LLM eval was mislabeling correct model behavior as failure

A developer building an LLM-powered evaluation tool for MCP servers discovered that a seemingly perfect server, context7, was incorrectly flagged as failing tool selection 62% of the time. The root cause was that the benchmark's task synthesizer generated prompts requiring multi-step tool pipelines — such as fetching a thread ID before replying — but graded the model wrong when it reasoned accordingly. After adding a constraint requiring all task prompts to embed concrete parameter values, context7's score jumped from 38% to 100% and Slack's from 54% to 100%. Further testing on a 26-tool server, Firecrawl, validated the fixed eval: selection failures clustered around naming collisions already flagged by static analysis, confirming that cheap static linting can predict live model confusion. The case highlights a widespread flaw in agent benchmarks, where multi-step tool dependencies quietly inflate failure rates and misrepresent model capability.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Dev Spends Full Day on Docs for Dot-Connecting Puzzle Game, No Code Written

A developer working on a grid-based dot-connecting puzzle game called Traceroute spent an entire day refining the product and technical requirements documents without writing any code. Seemingly simple mechanics — such as what constitutes a valid click or how path trimming works — revealed cascading rule conflicts once written down formally. A core assumption that puzzle boards must have unique solutions was scrapped after the developer realised it would make generating easy-difficulty levels structurally impossible. The planned endless mode and daily-puzzle feature were also cut, replaced by a fixed pre-generated level pool and an AI-assisted content pipeline. To support a planned live algorithm demo screen, the generator and solver modules were redesigned as environment-agnostic TypeScript so they could run in both Node and the browser.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds exploit-verification tool using nonces, refines design after community feedback

A developer created a security testing tool designed to confirm successful exploits by requiring targets to return a uniquely minted secret token, rather than relying on easily spoofed output like 'uid=0'. The approach uses a challenge-response mechanism — including reverse shell callbacks — to distinguish genuine code execution from false positives caused by banners or tarpits. After sharing the project publicly, commenters quickly identified a key limitation: because the nonce travels inside the payload, a reflective service could echo it back without actually executing any code. Based on that feedback, the developer outlined improvements including binding each nonce to specific attempt metadata, enforcing single-use consumption, and requiring computation-derived responses that cannot be produced by simple reflection. The episode highlights a broader principle in offensive security tooling: clearly separating what evidence actually proves from what it merely suggests.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Zone01 Kisumu Student Finds Self-Directed Learning More Valuable Than Formal Instruction

A software engineering student at Zone01 Kisumu in Kenya reflects on how the institution's project-based, peer-to-peer learning model has shaped their development as a programmer. Unlike traditional classroom settings, students are given projects and documentation without step-by-step guidance, pushing them to find solutions independently. The learner describes how repeated debugging and self-research built stronger problem-solving habits than structured tutorials ever could. Collaborative learning among peers also played a key role, with students teaching each other and working through challenges together. The student concludes that the ability to learn independently and adapt is more enduring than mastering any specific programming language or framework.

0 comments Read more at DEV Community