Saturday 16 May 2026

ChatGPT Wants Your Bank Login: OpenAI's Personal Finance Play Is the Biggest Trust Bet in AI Yet

ChatGPT wants access to your bank account — and the Musk v. Altman trial just wrapped up asking whether we should trust the people building this stuff.

Lead story

ChatGPT Wants Your Bank Login: OpenAI's Personal Finance Play Is the Biggest Trust Bet in AI Yet

OpenAI quietly dropped one of its most consequential product moves yet: ChatGPT will now connect directly to your bank accounts via Plaid, giving the chatbot a live view of your portfolio, spending history, subscriptions, and upcoming bills. The feature is in preview for Pro users in the US, but the direction of travel is unmistakable — OpenAI wants to be the interface layer between you and your money.

Plaid is the plumbing behind more than 12,000 financial institutions, including the biggest names in US banking. That means this isn't some niche fintech experiment. If ChatGPT becomes the default way people interrogate their finances, OpenAI gets to sit on one of the richest personal datasets in existence — one that makes ad-targeting look quaint by comparison.

The timing is hard to ignore. The Musk v. Altman trial wrapped up this week, with closing arguments circling back to a single question: can you trust the people steering AI? OpenAI's answer, apparently, is: trust us enough to hand over your bank credentials. That's a big ask when the company is simultaneously reorganising its executive structure, with president Greg Brockman now formally running all product as it pivots to an "agentic platform" strategy.

To be fair, the integration uses Plaid's read-only OAuth flows rather than storing credentials directly — the same mechanism that underpins most personal finance apps already. And OpenAI is right that 200 million people are already asking ChatGPT questions they'd previously Google. The shift to asking it why your grocery bill jumped is incremental, not alien.

But the security surface is real and worth taking seriously. Plaid has had its own controversy — a 2020 class action alleged it harvested more bank credentials than users understood. More fundamentally, every account aggregator is a high-value target: compromise the AI layer and you get financial context on millions of users at once.

For Australian readers: Plaid doesn't currently support Australian financial institutions, so this feature won't land locally in its current form. But the trajectory matters — Australia's open banking framework (the Consumer Data Right) is designed for exactly this kind of third-party data access, and Australian AI players will be watching closely. The OAIC's APP guidelines on sensitive financial data would govern any equivalent local rollout, and the bar is high.

The broader question isn't whether OpenAI can technically secure the integration. It's whether a company undergoing constant executive churn, freshly emerged from a high-profile trial about its own trustworthiness, and racing to ship agentic products is the right custodian for your most sensitive personal data. That's not FUD — it's just the question any sensible user should be asking before clicking "connect."

Watch for: whether this feature expands beyond the US, which Australian open banking players start positioning similar AI-native finance experiences, and how regulators respond to an AI company aggregating financial data at scale.

Also today

Microsoft Exchange Zero-Day Exploited in the Wild — Patch Not Yet Available

Microsoft has flagged an actively exploited vulnerability in on-premises Exchange Server (CVE-2026-42897, CVSS 8.1) that allows attackers to run arbitrary code via a cross-site scripting flaw in Outlook on the web. A full patch isn't out yet — Microsoft has published mitigations in the interim. On day two of Pwn2Own Berlin, researchers also separately demonstrated fresh Exchange zero-days, collecting $385,750 across 15 unique bugs in Windows 11, Exchange, and Red Hat Enterprise Linux. Australian organisations still running on-prem Exchange — a significant cohort in government and healthcare — should apply Microsoft's interim mitigations immediately and monitor ACSC advisories.

SecurityWeek ↗

Cisco SD-WAN Zero-Day Is the Sixth Exploited in 2026 — CISA Gives Agencies Until Sunday

CISA added CVE-2026-20182, a critical authentication bypass in Cisco Catalyst SD-WAN Controller, to its Known Exploited Vulnerabilities catalogue and gave US federal agencies a Sunday deadline to patch. The flaw lets an unauthenticated remote attacker gain admin privileges outright. CyberScoop reports the same threat actor — tracked as UAT-8616 — is behind a string of Cisco network-device exploits this year, suggesting a sustained, targeted campaign against enterprise edge infrastructure. Cisco SD-WAN is widely deployed in Australian enterprise and government networks; the ASD's Essential Eight guidance on patching internet-facing services makes this a priority remediation.

SecurityWeek ↗

Turla Rebuilds Kazuar Backdoor as a Stealth P2P Botnet

Russia's FSB-linked Turla group has significantly upgraded its Kazuar backdoor, transforming it into a modular peer-to-peer botnet designed to persist quietly inside compromised networks. Rather than relying on centralised command-and-control — which is easy to block — the new architecture lets infected nodes communicate with each other, making detection and takedown significantly harder. Turla is one of the most technically sophisticated state-sponsored groups operating today, and the shift to P2P architecture signals a deliberate effort to outlast defender response times. The group has historically targeted government, defence, and energy sectors — industries heavily represented in Australian critical infrastructure.

The Hacker News ↗

TeamPCP Releases Shai-Hulud Worm's Source Code to the Public

The hacking group behind the Mini Shai-Hulud supply chain worm — which tore through npm and PyPI packages earlier this week — has now published the worm's source code, explicitly encouraging other attackers to use it and promising cash rewards for successful attacks. The move turns a one-off incident into a commoditised capability. Separately, TeamPCP is also advertising stolen Mistral AI source code repositories for sale. The public release of self-propagating supply chain attack tooling is a meaningful escalation; defenders maintaining npm or PyPI dependencies should be reviewing their software composition analysis tooling urgently.

SecurityWeek ↗

OpenAI Confirms Two Employee Devices Hit in TanStack Supply Chain Attack

OpenAI has disclosed that two employee devices in its corporate environment were compromised via the Mini Shai-Hulud supply chain attack on TanStack, with a limited amount of internal credential material stolen from code repositories. OpenAI says no user data, production systems, or intellectual property were modified. The disclosure is notable because OpenAI isn't a small target — if a company of this profile can have corporate devices caught in a supply chain sweep, the blast radius from weaponised open-source packages is wider than many organisations have planned for. The incident is a concrete illustration of why software composition analysis needs to run at the endpoint level, not just in CI/CD pipelines.

SecurityWeek ↗

Microsoft Edge to Stop Dumping Saved Passwords in Cleartext Memory

After initially describing it as working as intended, Microsoft has reversed course and confirmed Edge will stop loading saved passwords as cleartext into process memory at startup. The issue was meaningful: any process with read access to Edge's memory — or an attacker with a memory-scraping tool — could pull credentials directly. Microsoft's about-face came after sustained public pressure. The episode is a useful reminder that "by design" is sometimes a placeholder answer, and that memory-safety expectations for credential stores should be non-negotiable. Users running Edge as their primary browser should ensure they're on the latest version once the fix ships.

Bleeping Computer ↗

Hotel Check-In System Exposed a Million Passports and Driver's Licences

A cloud misconfiguration in a hotel check-in system left the identity documents of approximately one million guests — passports, driver's licences — publicly accessible without any authentication. The tech company managing the system had left its cloud storage bucket set to public. This is a category of breach that keeps recurring with dispiriting regularity: sensitive identity data sitting in a misconfigured object store, waiting to be found. For Australian travellers, the exposure of passport data carries particular risk given the document's long validity period and its use as a primary identity proof. The Privacy Act's APP 11 requires reasonable security for personal information, and cloud misconfigurations of this type have attracted OAIC scrutiny.

TechCrunch ↗

arXiv to Ban Researchers for a Year Over AI-Generated Slop Submissions

The preprint platform arXiv is implementing a new enforcement policy: submit a paper containing incontrovertible evidence of unchecked AI generation — hallucinated references, LLM meta-comments left in the text — and you'll be locked out of submissions for twelve months. Future submissions will also require authors to explicitly certify they've verified their work. The policy reflects a genuine crisis; AI-generated papers have been flooding academic preprint servers at a volume that's straining moderation. arXiv is the primary venue for AI, physics, and maths research, so a stricter bar here has real downstream effects on how quickly new findings reach the community.

The Verge ↗

OpenAI Reshuffles Again: Brockman Takes Product Lead as Company Goes All-In on Agents

OpenAI announced another internal reorganisation on Friday, with president Greg Brockman formally taking over all product functions. The company is merging ChatGPT and Codex into a single unified agentic platform — reflecting a strategic bet that the next phase of AI competition is won at the agent layer, not the model layer. This is OpenAI's third significant org change in as many months, and it comes as SpaceXAI reportedly continues to bleed staff post-merger. Whether consolidation under Brockman brings clarity or just a tidier org chart remains to be seen, but the product signal is clear: everything is becoming an agent.

The Verge ↗

Taiwan Bullet Train Hack: A Student, a Software-Defined Radio, and Three Stopped Trains

A Taiwanese university student experimenting with software-defined radio technology managed to interfere with signals controlling three high-speed rail services, halting them for nearly an hour and triggering an anti-terrorism response before investigators determined what had actually happened. No malicious intent was found, but the incident starkly illustrates how the gap between off-the-shelf radio hardware and operational technology security can be embarrassingly wide. Rail and transport OT systems are a known weak point globally — Australia's rail operators, operating under SOCI Act obligations for critical infrastructure, should treat this as a useful stress test for their own RF interference scenarios.

Dark Reading ↗

The REMUS Infostealer: When Stealing Your Session Is Worth More Than Your Password

A detailed technical breakdown of the REMUS infostealer reveals how the malware-as-a-service tool has evolved to prioritise browser session tokens and authentication cookies over raw passwords — because a live session token bypasses MFA entirely and has an immediate shelf life before detection. REMUS is notable for its operational scalability: the MaaS model lets low-sophistication actors run credential-harvesting campaigns with minimal setup. The shift from password theft to session theft is an industry-wide trend that makes token lifetime management and session invalidation on new device logins much more important defensive controls than they're often given credit for.

Bleeping Computer ↗

Sources consulted