AI Agents Are Running Unmonitored in Financial Services. What Are the Risks?

An AI agent handling a customer request may retrieve account information, consult internal systems and recommend a financial action within seconds. Another might investigate suspicious transactions, review supporting evidence or update an operational workflow.

These capabilities can reduce manual work. But what happens when a financial institution cannot see what its agents are doing?

According to New Relic's 2026 Observability Forecast for Financial Services, published in October 2026, 21.6% of surveyed financial-services organisations reported having AI agents running in production without monitoring.

The finding raises an important question. As AI agents gain access to sensitive information, connected tools and increasingly consequential workflows, can institutions detect when those systems behave unexpectedly or require intervention?

Monitoring is essential to answering that question. But monitoring an agent and establishing that its behaviour is reliable are two different requirements.

What New Relic's Research Reveals

New Relic's research, conducted with Enterprise Technology Research, included 278 financial-services IT and engineering leaders and practitioners within a broader global survey of 2,575 respondents.

Its findings indicate that approximately one in five surveyed financial-services organisations had production AI agents operating without monitoring.

This does not mean that 21.6% of all financial AI agents are unmonitored. Nor does it establish that these organisations lack human supervision, access restrictions or other risk controls. The finding concerns reported monitoring coverage, not the complete absence of oversight.

Nevertheless, it identifies a meaningful operational gap.

AI agents can interact with multiple systems, retrieve information and perform sequences of actions that conventional application monitoring may not fully capture.

New Relic's research also points to growing investment in AI observability, suggesting that financial institutions recognise the need for better visibility as AI applications become more sophisticated.

The challenge is not simply whether monitoring technology is installed. It is whether institutions can observe the activities that matter, recognise inappropriate behaviour and respond before an issue becomes consequential.

Why Unmonitored Agents Create a Different Operational Risk

Traditional software monitoring often focuses on availability, performance, infrastructure health and application errors.

AI agents introduce another dimension: the decisions and tool interactions occurring within an application.

Consider a customer-service agent connected to account information and internal support systems. It may retrieve records, interpret requests and use authorised tools to complete tasks.

The application could remain available and respond quickly while the agent accesses unnecessary information, selects an inappropriate tool or attempts an action outside its intended responsibilities.

A conventional uptime dashboard might not reveal these behaviours.

Similar risks can arise in fraud investigations. An agent might examine transaction records, review supporting information and recommend which cases require further attention. If it repeatedly relies on irrelevant evidence or mishandles contradictory information, the workflow may continue without an obvious technical failure.

These are illustrative scenarios, not incidents established by New Relic's survey.

They demonstrate an important distinction: an application can be functioning normally from an infrastructure perspective while behaving incorrectly from an operational risk perspective.

Financial institutions therefore need visibility beyond whether their AI services remain available.

What Financial Institutions Need to Monitor

Monitoring requirements should reflect an agent's responsibilities, permissions and potential consequences.

For an application accessing customer information or participating in financial operations, relevant records may include instructions received, tools invoked, permissions exercised, execution outcomes and exceptions encountered.

Institutions should consider several areas.

Tool usage and permissions. Which systems does the agent access? What actions does it attempt? Are those actions consistent with its authorised responsibilities?

Sensitive information handling. Does the agent access or disclose information beyond what is necessary? Monitoring should support investigation without unnecessarily exposing confidential data through logs.

Exceptions and escalation. How does the agent respond to failed operations, contradictory information or situations requiring human review?

Changes in behaviour. Have updates to models, prompts, connected tools or application configurations altered how the agent operates?

Intervention mechanisms. Can the institution investigate, restrict or suspend problematic activity when monitoring identifies a meaningful concern?

Collecting telemetry alone is insufficient. Institutions also need to determine which signals require attention, who is responsible for reviewing them and what actions follow.

An alert that nobody investigates offers limited protection. Likewise, detailed execution records provide little operational value if teams cannot identify which activities represent material risk.

Observability, Monitoring and Incident Detection Serve Different Purposes

Observability, monitoring and incident detection are related, but they are not interchangeable.

Observability concerns whether an organisation can understand a system's operation through logs, traces, metrics and other records.

Monitoring involves tracking selected signals and conditions over time to identify changes, failures or unusual activity.

Incident detection involves recognising events that may require investigation or response.

An institution might collect detailed execution traces without configuring effective alerts for inappropriate tool use. Another might monitor application latency and error rates while lacking visibility into the actions an agent performs.

Neither arrangement necessarily provides adequate oversight of consequential AI workflows.

There is also a difference between detecting unusual activity and determining whether it represents a genuine risk.

An unfamiliar sequence of tool calls might be appropriate for a legitimate customer request. Conversely, an inappropriate action may appear technically normal unless monitoring incorporates the application's intended permissions and operating constraints.

Effective monitoring therefore depends on understanding what an agent is authorised to do, not merely observing what it does.

Why Monitoring Cannot Replace Behavioural Testing

Even comprehensive production monitoring has a limitation: it primarily observes behaviour occurring during operation.

It does not establish how an agent would respond to situations it has never encountered.

An agent might operate normally for months before processing a manipulated instruction embedded in retrieved content. Another might respect approval requirements during routine tasks but respond differently when instructions conflict or a connected tool returns unexpected information.

Monitoring can help detect these events when suitable signals and rules exist. But it cannot replace deliberately evaluating how an application behaves under challenging conditions.

That is where behavioural testing becomes important.

Scenario-based evaluations can examine whether an agent follows defined instructions, respects permissions, handles conflicting information and responds appropriately when operating boundaries are challenged.

Adversarial testing introduces deliberate attempts to manipulate the application or induce behaviour outside those boundaries.

Such evaluations can identify vulnerabilities before they appear during ordinary production activity. Their findings may also help institutions determine which behaviours deserve closer monitoring.

However, testing cannot guarantee that every failure mode has been discovered. Results depend on the scenarios, configurations and conditions evaluated.

Monitoring provides evidence of observed production behaviour. Testing provides evidence of behaviour under selected evaluation conditions.

Financial institutions need both, particularly when agents can access sensitive information or influence consequential decisions.

Where These Risks Matter Most in Financial Services

The monitoring and testing requirements for an informational assistant differ from those for an agent participating in fraud investigations, lending operations or payment-related workflows.

A customer-service agent may need to demonstrate that it retrieves only authorised information, respects customer authentication boundaries and escalates requests it cannot appropriately resolve.

A fraud investigation agent may need to handle incomplete evidence, conflicting case information and attempts to manipulate its conclusions without exceeding its assigned responsibilities.

An agent supporting payment operations may need to respect approval boundaries, distinguish recommendations from executable actions and avoid using tools beyond its permissions.

These examples do not imply that every financial AI agent directly authorises transactions or makes credit decisions. The level of risk depends on the application's actual authority.

For institutions, the practical requirement is to evaluate agents according to what they can access, influence and execute.

Monitoring should provide visibility into those responsibilities. Behavioural testing should examine whether the application respects its intended constraints when challenged.

How AetherLab Supports Behavioural Risk Evaluation

AetherLab helps institutions evaluate behavioural vulnerabilities in generative and agentic AI applications, complementing the operational visibility provided by production monitoring systems.

Its AdversarialScan capability supports testing against defined risk scenarios, including instruction manipulation, inappropriate tool use and failures to respect intended operating constraints.

For financial institutions, these evaluations can identify weaknesses that may not have appeared during ordinary production activity.

AetherLab's Evidence Pack helps document assessment findings, severity, business-impact considerations, mitigation measures and residual risk information for institutional review.

These capabilities are not substitutes for production observability platforms. They do not provide continuous agent telemetry, real-time operational alerts or incident detection infrastructure.

Their value lies in identifying and documenting selected behavioural risks, helping institutions understand which weaknesses require attention and which controls warrant further evaluation.

Relevant assessment findings can also inform an institution's monitoring priorities, remediation plans and subsequent testing.

Financial AI Agents Need Visibility and Tested Boundaries

New Relic's findings expose a practical challenge for financial institutions deploying increasingly capable AI agents.

An agent can be available, responsive and productive while operating without sufficient visibility into its actions. Monitoring helps institutions understand what is happening and recognise when intervention may be necessary.

But visibility does not establish that an agent will respect its intended boundaries when exposed to unexpected or adversarial conditions.

As financial institutions expand agentic AI into customer interactions, investigations and operational workflows, they need both operational monitoring and evidence from targeted behavioural evaluations.

The objective is not simply to collect more activity data. It is to understand which behaviours matter, where failures could become consequential and whether critical boundaries have been tested.

Monitoring can detect what your AI agents do. It cannot prove they will stay within their boundaries when challenged.

Don't wait for a production incident to expose behavioural weaknesses. Explore AetherLab's AdversarialScan to identify vulnerabilities, test critical controls and uncover risks before they turn into operational failures.