15Identity & fraudBelow the top 20
A joint account the agent treated as one person’s
CapabilityAffordanceImpact domainBoth
Statement (NASA form)
Given that household banking already collapses identities, there is a possibility of a partner locked out, or a partner draining it, with a nod from the bot resulting in shared money without shared control.
Likelihood
3Probable
Consequence
4Critical
Urgency
3Priority
Personal slice · money. Experimental household card. Not a certified finding.
Composite 15 = 3×4 + 3
Applicable mitigations
Controls · Short-lived, narrowly scoped tokens for every tool call · Mandatory secret scanning before a skill can be listed · No shared tool state across agent sessions · Out-of-band confirmation on a known number · Retire voiceprint as an authenticator · Real-time clone detection on high-risk lines