BNP Paribas has signed a five-year partnership with Google Cloud as it moves from generative AI assistants towards agentic workflows inside Corporate & Institutional Banking. The bank says the agreement expands access to Gemini models, Gemini Enterprise and Google Cloud infrastructure while preserving its existing multi-cloud and multi-model approach.

The first planned CIB use cases include agents to assist with corporate credit memos, with further applications across sales, trading, research and structuring. Gemini models are also due to be integrated into LLM@CIB, the bank's internal generative AI assistant, which BNP Paribas says is available to more than 65,000 employees. At Nickel, its payment-account business, Gemini already underpins an assistant used by 200 customer advisers.

The useful detail is in the control model. BNP Paribas says each agent will be authenticated, restricted to the resources needed for its assigned task, and monitored when connecting to group systems. It also says some categories of data will not be stored in a public cloud environment. Those are company statements, not an external assurance, but they move the discussion beyond generic claims of responsible AI. For banks, the emerging design question is no longer whether agents can produce work. It is how identity, permissions, data boundaries and human review are enforced around that work.

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what’s actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute’s recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of “guardrails” language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab’s own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK
Share this post
The link has been copied!