In May 2022, I tracked $2.0 billion leaving Anchor Protocol in under 48 hours. No queues. No branch managers. No closing bell. Just a yield curve that stopped making sense and a withdrawal function that never slept.
That memory is why a research note out this week got my attention. Apollo's chief economist โ an asset manager with no crypto product to shill and a balance sheet acutely sensitive to funding costs โ flagged that AI agents could accelerate deposit flight out of banks. The framing was cinematic. Your savings, optimized by a machine, moving at machine speed, coordinated across millions of accounts at once.
Everyone is quoting the scary version: "AI agents could trigger bank runs." That's the wrong number to watch.
Here's the one that matters. The operational friction that used to buy a bank 48 to 72 hours of reaction time has already been engineered away โ three years before agents had a bank account to log into.
The agent is not the new risk. The agent is a new client for a risk that already shipped.
Context: What "Agent" Actually Means Inside a Banking Stack
Strip the marketing. An agent is a loop, not a mind: plan, retrieve, call a tool, observe, repeat. Four parts. A reasoning model. A memory store. A tool-calling layer. And an execution credential.
That last piece is the whole story, and it's the piece almost nobody writing about this names out loud.
A model with read-only access to your balance is a dashboard. A model with an OAuth token scoped to your deposit account and a live session on an instant-settlement rail is a cash-management desk that works at 3 a.m. on Christmas Day.
The rails already exist. Open banking aggregation is mainstream in the U.S. and effectively mandated in the EU. RTP and FedNow settle continuously, with per-transaction ceilings that have been raised repeatedly since FedNow's 2023 launch. Brokerage APIs expose sweep funds and money-market alternatives. Stablecoin rails settle in seconds, on-chain, for anyone holding a wallet.
None of that required an agent. Agents remove the last human bottleneck: the decision to act.
The choke point isn't the model. It's the account-connection layer. Whoever controls the token scope, the velocity cap, and the step-up authentication flow controls how fast money can actually move. Right now that layer is split between aggregators, bank-owned APIs, and payment networks โ and none of them publish the limits that matter. That opacity is not an accident. A system you cannot audit is a system you cannot regulate, and the connection layer is deliberately unaudited.
I ran a version of this experiment last year. I deployed autonomous agents to execute 10,000 micro-transactions on a new L2 to map gas-fee volatility. The finding that stayed with me wasn't about fees. It was that the agents converged. Given the same reward function and the same benchmark data, independent agents produced correlated behavior โ clustered, predictable liquidity gaps that no human trader would have generated.
That is the mechanism worth worrying about in deposits. Not intelligence. Homogeneity.
Core: The Four-Condition Test
A bank run is not one event. It's four conditions stacked in sequence.
One: a confidence shock โ something makes uninsured depositors believe principal is at risk. Two: a withdrawal channel fast enough to outrun the balance sheet. Three: deposit concentration inside an institution with thin liquid buffers. Four: no credible backstop arriving in time.
Agents touch condition two directly. They touch condition three indirectly, by making it trivial to aggregate and move balances across accounts a human would never bother to consolidate. They do not create conditions one or four. And without one and four, you don't have a run. You have a reallocation.
SVB is the natural experiment, and it's usually cited badly. In March 2023, roughly $42 billion in withdrawal requests hit a single institution inside one trading day โ on legacy rails, driven entirely by humans with mobile apps and group chats. The rails were already fast enough. The panic was already coordinated enough.
So what did agents add? Marginal speed, real but small. Twenty-four-hour monitoring that doesn't sleep through a Tokyo session. And the part that actually matters โ continuous optimization that never gets bored, never feels embarrassed, and never second-guesses a threshold.
That last one is a deposit-beta problem wearing a technology costume.
Deposit beta measures how much of a rate move passes through to what banks pay depositors. Through 2015โ2022 it sat historically low. Banks kept the spread. Post-2023 it has climbed steadily. If every meaningful retail balance is managed by an agent that reprices against T-bills nightly, beta converges toward 1.0 โ and the spread banks have monetized for a decade quietly evaporates.
Run the illustrative math. A $100 billion deposit base. Every 10 basis points of additional deposit beta is roughly $100 million of annual pre-tax funding cost. Put two or three agent providers in control of most of that base, all benchmarking to the same index, and you get a synchronized repricing event every time the curve twitches.
Here's what the mechanics actually look like, compressed. 02:00 โ T-bill yields tick 12 basis points on a weak auction. 02:04 โ benchmark-driven agents recompute expected yield spreads across 40,000 linked accounts. 02:07 โ withdrawal instructions queue for execution. 03:15 โ the bank's overnight liquidity desk wakes up to a funding gap it cannot explain, because the withdrawal orders carry no narrative, only settlement instructions.
That's not a bank run. It's something quieter and more permanent. A structural repricing of the cheapest liability in finance โ and the first time the liability has had a mind of its own.
There's a second-order effect worth naming. The deposits don't vanish into a void. They land in money-market funds, T-bills, and stablecoin reserves. That shifts the composition of system-wide funding without reducing it โ which means the stress shows up as spread widening, not as a headline failure.
Contrarian: The Constraint Is Authorization, Not Intelligence
Here's where the bear case on the bears falls apart.
Every bank's risk engine already caps transfer velocity, forces step-up authentication, flags anomalous patterns, and requires human confirmation above thresholds. Reg E protections, wire-fraud liability rules, and a compliance officer who answers to the OCC. An agent that can move $250 is a novelty. An agent that can move $250,000 with no human in the loop is a license the bank has not granted โ and under current supervision, will not grant.
Deployment is also messier than the discourse admits. Agents fail in specific, ugly ways: prompt injection into the tool layer, model drift, hallucinated counterparties. In my 2021 forensic work on 8,500 secondary NFT sales โ where roughly 40% of apparent volume traced back to five connected wallets โ the pattern was always identical. Manipulation happens where the audit trail is weakest. For agents, that's the tool-calling layer, not the model. Treat an agent as a potential victim of attack before you treat it as an instrument of panic.
Then follow the money on the other side of the trade. Deposits don't disappear. They land in money-market funds, T-bills, and stablecoin reserves. Exit liquidity is someone else's entry. The regional bank loses its funding; the Treasury market and the stablecoin issuer absorb it; the spread widens somewhere else on the curve. That's a position with a direction, a duration, and a counterparty โ not an apocalypse.
And answer the question the note never asks: who pays the agent? If it's a subscription, the agent optimizes for engagement. If it's basis points on assets, the agent optimizes for asset gathering. If it's a share of the spread it captures from your bank, the agent is structurally incentivized to move your money as often as possible. Unit economics determine behavior. Nobody is modeling that.
There's also a second-order arms race that isn't being priced. Banks will build defensive agents โ loyalty engines that sweep deposits back, reprice in real time, and lock duration. Agents on the liability side fighting agents on the asset side. Follow the smart money, not the hype, and the smart money is quietly buying the liability-management side of this trade. Code doesn't care about your feelings, and it won't care about the bank's either.
Takeaway: What To Watch, In Order
We're in chop. Chop is for positioning, not for narratives. The AI-agent-bank-run story is a 12-to-36-month structural risk, not a next-week event. Score it accordingly, and remember that Apollo has a balance sheet sensitive to funding costs โ the framing is not neutral.
Watch, in this order. Deposit beta and non-interest-bearing balances in quarterly filings โ repricing shows up there first. FedNow and RTP transaction volume, plus any change to per-transaction ceilings. Money-market fund AUM measured against total bank deposits, monthly. Any Fed, OCC, or FDIC stress-test scenario that explicitly includes synchronized multi-agent withdrawal behavior โ the day that language appears in a supervisory document, this stops being a thought experiment. And stablecoin supply growth read as a deposit substitute rather than a trading vehicle.
The fail condition is clean and testable: if regulators mandate human confirmation above a transfer threshold, or force circuit breakers into agent execution paths, the urgency collapses overnight.
Transparency is the only security โ and right now nobody can audit an agent's decision at the exact moment it matters.
The interesting question isn't whether an AI agent can start a bank run.
It's whether your bank can tell the difference between an agent and a customer โ and whether, at 3 a.m., anyone there is even awake to check.