AI in corporate finance in 2026: what changed in security one year on

Yes, using AI inside a company’s finance function can be safe in 2026, provided the architecture is designed for it. What changed in a year was not the intelligence of the models, it was the path to the data: there is now an open standard for connecting assistants to systems, scope-based authorization and a public catalogue of risks for agents. With that design, AI reads and analyses the numbers. People still decide and approve.

It is 8:40 on a Monday and the treasurer of a group with four legal entities has to tell the CFO how much cash there is across all of them before the 9am meeting. She already uses an AI assistant to review contracts and build spreadsheet formulas. For this question, she does not. She opens four accounts, exports four statements and adds them up by hand.

The reason is neither laziness nor ignorance. In 2025, connecting AI to a company’s banking data meant improvising: pasting statements into a chat, handing an assistant credentials that were far too broad, or wiring a model straight into internal systems with no clear rule about what it could do. Being wary of letting AI near the money was reasonable.

A year later, the question is the same but the answer has changed. What follows is what matured in protocol, in security and in the models themselves, and what remains the company’s responsibility.

Why the question about AI in finance changed between 2025 and 2026

The question changed because the 2025 problem was never model capability, it was the absence of a safe path to the data. In 2026 that path exists: standardised protocols, scope-based authorization and public risk catalogues for agents.

In 2025, the debate about AI in financial services revolved around a binary dilemma. Either the company kept AI away from financial data, in which case it only handled generic tasks, or it opened up broad access and hoped nothing went wrong. There was no well established technical middle ground.

In 2026, the middle ground became the standard. The useful question is no longer “can AI get close to finance?” but something far more operational: with what scope, with whose credentials, with what audit trail, and with whom making the final call.

That shift has a practical consequence. Companies that still treat AI in finance as a yes or no question tend to stall or improvise. Companies that treat it as an architecture decision can start small, with reading, and expand under control.

How Brazilian banks are handling AI in finance in 2026

Brazilian banks have started treating AI as infrastructure rather than as an experiment. The same surveys that show rising AI investment also put cybersecurity at the top of the priority list, which suggests adoption is arriving alongside control.

According to the Febraban Banking Technology Survey 2026, conducted with Deloitte and released in August 2026, Brazilian banks plan to invest roughly R$ 3 billion in artificial intelligence, analytics and big data over the course of 2026, 8% more than in 2025. In the same survey, 76% of the banks consulted point to internal process automation as a use of intelligent AI agents.

The figure that matters most to a corporate finance team sits right beside those numbers. The survey shows that 88% of banks already integrate their cybersecurity, fraud prevention and anti money laundering teams. The sector with the most to lose from an AI mistake is also the one accelerating its use of agents, and it is doing so with the risk functions in the room.

For a company wondering whether it is too early, the signal is clear. The financial system is already running agents in internal processes. The task is to adopt with the same criteria banks apply: defined scope, security alongside, and human decisions at the sensitive points.

What changed in architecture: standardised protocols such as MCP

The main architectural change between 2025 and 2026 was the consolidation of an open protocol for connecting AI agents to external systems, MCP (Model Context Protocol). Instead of improvised integrations, a system publishes described tools, with authorization and scope, and any compatible client can use them.

MCP was introduced by Anthropic as an open standard in November 2024. On 9 December 2025 the protocol was donated to the Agentic AI Foundation, a Linux Foundation fund co-founded by Anthropic, Block and OpenAI. On the same date, the official MCP blog recorded more than 97 million monthly downloads of the development kits and around 10,000 active servers, with support in clients such as ChatGPT, Claude, Gemini, Microsoft Copilot and Visual Studio Code.

For finance, three characteristics of MCP matter more than the adoption numbers:

• Described tools. The server states exactly what the agent can do, tool by tool. If there is no tool for creating a payment, the agent does not create payments.
• OAuth-based authorization. The 25 November 2025 revision of the specification strengthened authorization with scope-based consent and updated the security best practices. It is the same family of standard that underpins Open Finance.
• Vendor neutrality. An MCP server works with whichever assistant the team already uses. The company does not have to bet on a single AI model in order to connect its data.

The practical consequence is that integration stopped being a bespoke project for each assistant. The company evaluates one server, understands the scope of its tools and decides who may use it, exactly as it would with any other access to the financial system.

What matured in AI models, and what did not

The AI models of 2026 got better at something that matters a great deal in finance: working with tools and showing what they consulted. They still make mistakes, but the mistakes became more visible and easier to check.

An assistant answering from memory and an agent that calls a tool, reads the statement and returns the figure with its origin are different things. The first can invent a plausible number. The second shows which tools it used, with which parameters, and which entries support the answer. Whoever checks the work does not need to trust the model, they need to check the evidence.

The way risks are described also matured. On 9 December 2025, the OWASP GenAI Security Project published its Top 10 for agentic applications, built by more than a hundred specialists. The listed risks include agent goal hijacking, tool misuse, and identity and privilege abuse. A public risk catalogue does not solve the problem, but it gives security teams a shared language for assessing vendors.

What has not matured enough deserves to be said just as plainly. A model can still misread an instruction, and malicious content hidden in documents or web pages can still try to divert an agent’s behaviour. That is why the most important question is not “does the model make mistakes?” but “if the model makes a mistake, what is it able to do?”.

A year ago, we wrote here about the dangers of AI in financial services

In September 2025 we published AI in financial services: a dangerous shortcut? on the Trio blog. It listed five risks of putting AI inside financial operations: privacy, security, overreliance, regulation and explainability, and ethics. The conclusion was that the risk lay in ungoverned use, not in the existence of the technology.

All five risks remain real. What changed in a year is the structure available to deal with each of them. In 2025, the answer to almost all of them was “avoid”. In 2026, for most of them, there is an architectural answer.

Risk flagged in 2025	What changed in 2026	What stays with the company
Privacy of financial data	Access through a protocol, limited to the session’s credentials and to the organisation’s own data, with sensitive fields masked	Deciding who may use the agent and which AI client the company approves
Security and attacks aimed at releasing money	Read-only tools: with no payment tool, there is no payment by the agent	Keeping approval rules and strong authentication for any movement of money
Overreliance on invented answers	The number does not come from the model’s memory: the agent queries the source system and returns the entry that supports the answer, with amount, date and identifier	Connecting the agent to the system of record rather than to statements pasted into a chat, and checking the evidence on higher-impact decisions
Regulation and explainability	A trail of which tools were called and with what data; LGPD in force and Brazil’s AI bill still under discussion	Answering for decisions, which remain human
Ethics and inappropriate recommendations	The tool scope sets the limit: the agent explains criteria and shows the data, with no tool to grant credit, collect from a customer or recommend an investment	Writing down which decisions are never delegated and keeping one person accountable for each of them

The table reads in one direction. Risks that depend on the agent doing something, such as moving money, were solved by removing its ability to act. Risks that depend on interpretation, such as trusting an answer, were reduced with evidence. And risks that depend on accountability remain, correctly, with people.

Reading, analysis and decision: delegating the analysis, not the authority

Delegating the analysis and not the authority means letting the AI agent read and interpret financial data, while authorisation for any movement of money stays with whoever holds approval rights in the company. It is the design that makes AI in finance useful without making it dangerous.

Reading answers what happened: balances, statements, payments, receipts, invoices. Analysis answers what it means: what did not reconcile, what is outside the usual pattern, how much went to a supplier over the quarter. Decision answers what the company will do: pay, hold, renegotiate, approve.

These are three layers with very different risk profiles. An error in reading or analysis shows up during review and costs a few minutes. An error in decision can cost a transfer to the wrong account. That is why it makes sense to open the first two layers to the agent and keep the third with people.

That is the design we adopted in Trio MCP, Trio’s MCP server. It connects Claude, ChatGPT and other MCP-compatible clients to the corporate account through 16 tools, all read-only. The agent queries the organisation’s balances, statements, payments, receipts and cards, always with the credentials of whoever authenticated the session and with card numbers masked. Payments are still created and approved in the account, through its approval rules.

A hypothetical example makes the difference visible. A receivables operation reconciling 1,200 instant payments a day used to spend Monday morning investigating weekend discrepancies. With a read-only agent, the question “which weekend receipts do not match the ERP?” returns a list with the identifier of each entry. The investigation gets shorter, and nobody had to give the agent the power to move a single cent.

What is still unresolved in AI security for finance

Security for AI in finance has advanced, but three points remain open in 2026: attacks that try to manipulate an agent’s behaviour, the specific regulatory definition for AI in Brazil, and internal governance over who may use what.

The first is technical. Malicious content embedded in documents, emails or web pages can try to make an agent act outside its original objective. OWASP ranks this as the first risk on its list for agentic applications. The most effective defence in finance remains architectural: an agent with only read tools can be tricked into reading something, but not into paying something.

The second is regulatory. Brazil’s data protection law, the LGPD, has been in force since 2020 and applies to any personal data processed by an agent, including data on individual customers and suppliers that appears in a bank statement. Brazil’s AI framework bill, approved by the Senate in December 2024, was still under review in the Chamber of Deputies as of October 2026. The text under discussion treats financial services as a high-risk use, with governance and human oversight requirements. Companies designing adoption with human decisions at the sensitive points are already aligned with what is likely to come.

The third is internal. An agent reads whatever the session’s credentials allow it to read. If access to the account is too broad, so is the agent’s. It is worth repeating that responsibility for the use of data and for decisions remains with the company, regardless of the platform or assistant chosen.

How to start using AI in finance safely

Starting safely means starting with reading, with a defined scope and defined people, and expanding only afterwards. Three steps any finance team can apply without hiring a consultancy:

1. Start with what already eats a full day of work, not with curiosity. The highest-value questions are the ones your team already answers by hand every week: the consolidated cash position across all entities before the meeting, the weekend discrepancies between the bank statement and the ERP, how much went to one supplier over the quarter, which entries this month fall outside the usual pattern in amount or timing. In Gartner’s AI in Finance survey, conducted with 183 CFOs and senior finance leaders between May and June 2025 and published in November 2025, error and anomaly detection ranked among the three most adopted AI use cases in finance functions, at 34%, behind knowledge management (49%) and accounts payable automation (37%). These are reading tasks: high value for the operation and low risk, because any error surfaces during review.
2. Ask for the list of what the agent is able to do, one line per action. An AI agent does not do whatever it wants. It only performs the actions the system has released to it, and those actions fit in a simple list: check balance, check statement, check card. Ask your vendor for that list before connecting anything. If any line creates or approves a payment, ask why it exists and who has to authorise it. Then decide who in the company gets to talk to the agent, using the same criteria you apply to who gets access to the account.
3. Insist on “where did this number come from” and change nothing about approvals. A good agent answer comes with its origin: what it queried and which entries support the figure. When a decision involves money, look at the origin before you look at the number. And leave the approval path exactly as it is today. Even if the agent flags a payment to be made, that payment is still created and approved by whoever holds the authority, with strong authentication.

Frequently asked questions

Is it safe to connect an AI agent to a company’s bank account?

It can be, if the agent has read-only permission, uses the credentials of whoever is in the session, and has no tool capable of creating or approving payments. In that design, the worst-case error is a wrong answer, which surfaces during review, not an improper transfer.

What is MCP and why does it matter for finance?

MCP, or Model Context Protocol, is an open standard for connecting AI assistants to external systems through described and authorised tools. It matters for finance because it makes explicit what the agent can do, uses scope-based authorization, and works across different AI assistants.

Can AI approve payments on its own?

Technically, an agent with payment tools could execute transactions. The recommended practice for companies is not to grant that capability: the agent analyses and suggests, and the payment is created and approved by people, through the account’s approval rules, with strong authentication.

Does the LGPD apply to the use of AI in finance?

Yes. Brazil’s data protection law applies to any processing of personal data, including processing carried out by an AI agent. Data on individual customers and suppliers appearing in statements and payments is personal data, and the company remains responsible for the legal basis and for the security of that processing.

What changes with Brazil’s AI framework bill?

The bill was approved by the Senate in December 2024 and was still under review in the Chamber of Deputies as of October 2026. The text under discussion classifies financial services uses as high risk, with governance, documentation and human oversight requirements. The rules only apply after final approval and sanction.

Where should a finance team start with AI?

With what already consumes a day of work a week: the consolidated cash position across entities, discrepancies between statement and ERP, the composition of an invoice, and entries that fall outside the month’s pattern. Error and anomaly detection is among the most adopted AI use cases in finance, according to Gartner research published in November 2025. These are reading tasks, high in value and easy to verify.

The danger was never AI, it was AI without architecture

In 2025, recommending caution with AI in finance was the responsible position, because there was no standardised, governed way to connect models to a company’s data. In 2026 that way exists. Open protocols, scope-based authorization, agents that show their evidence and a public risk catalogue changed what can be done safely.

Our reading is that corporate finance will follow the same path as the banks: AI enters through reading and analysis, where the time saved is large and the risk is controllable, and the decision stays human. Trio positions itself as the new generation of corporate account, infrastructure that finance teams operate, developers integrate and AI agents query. Agents query, analyse and explain. People approve.

To go deeper, read MCP for companies: Trio MCP connects AI agents to your corporate account, which details the tools and the governance, and The CFO of the future. If you would like to see an agent reading your own operation’s data, talk to Trio.