🧠 Finance is entering its mod era

Brainfood got another sponsor, and I obviously adore this one 🐟 . The team is cookin with its agents and its new research lab. If you’re doing anything with risk, fraud or AML, make them your first call.

AI brings zero new capabilities to fraud detection.

But it does change how much of our platform you can actually use. No human has time to read every doc, learn every data schema, or wire up every feature.

Agents do. They have infinite capacity for that work. Sardine’s AI Agents open up our entire platform, so everyone is a power user. The payoff is fraud prevention at machine speed, tighter compliance controls, more approved transactions, and support for more payment rails.

Everyone’s asking what new fraud detection capabilities AI brings to the table. But the better question: is your fraud team working at its full potential?

Unlock Agentic Fraud Ops with Sardine.

In a packed arena in Austin, Texas, ZywOo is the last player alive on his team, with two opponents still hunting him down. His team has just lost the opening round of the deciding map, and now he has to find a way to win.

Against the odds he wins the round, and his team goes on to win the championship. The game he’s playing is Counter-Strike and the final has nearly 1.8 million viewers at its peak and $1.25 million in the tournament’s prize pool. This story is improbable enough on its own, but the story of the game he played is even more so.

Counter-Strike began as a free mod for Half-Life, made by players who wanted to turn a game they loved into something else. Half-Life creator Valve turned it into a commercial release in 2000, and by July 2026, GameDiscoverCo estimates Counter-Strike 2 is generating $220 million in gross Steam revenue in a single month.

I keep thinking about that as my entire timeline explodes with people reverse-engineering home appliances, rebuilding Adobe software, and my favorite, mashing up video games.

Take the chap who reverse-engineered his air conditioning and built a little status-bar app because he kept losing the remote. You can see how this starts: something annoys you enough, and now fixing it doesn’t need to become a whole project.

We’ve got people playing Bloodborne on PC through emulation, putting a Skate 3-inspired engine in a browser, and playing Mario 64 with friends. And possibly my favorite: Grand Theft Auto with Spider-Man’s movement.

Of course, the software companies might find it less charming when people start rebuilding the things they charge for. PhotoCraft, for example, describes itself as an open-source, clean-room rebuild of Photoshop. I suspect Adobe is enjoying this particular part of the timeline rather less than I am.

Mods aren’t new. People have been doing this for decades. What’s changing is how much easier it is to investigate software, understand how it works, and build something you want from it. Tools like REA (Reverse Engineer Anything) let an agent inspect software without its original source code, explain what it finds, and help build a version for your own project.

If you use something every day and it annoys you, fixing it yourself starts to feel like a reasonable option.

Which made me wonder. What happens when this comes to finance?

Will we all get to build our perfect financial stack just by wishing it into existence with an agent?

Parts of it, yes. You can already.

I do most of my expenses and invoicing via Ramp or Mercury. My agents have scoped access to a separate Gmail account that sees copies of finance-related emails. They can pick up expenses and file them, or prepare the records I need for tax. I get a little report to review.

Earlier this week, a head of product at another fintech reached out for feedback and asked, “What one thing should we ship first?”

I said, “MCP server.” Seriously.

I think personal agents become the primary way an important subset of people interacts with finance. Over time, they become a main channel, in the way mobile did. You don’t need everyone to make the switch on the same day for that to matter.

And you don’t need everyone to become a programmer. Most people who played Counter-Strike didn’t build it. They used something other people had made, because it was good.

Last night at dinner, one exec shared with me a story of a bank CEO who said “people love our mobile app, look, they can freeze their card in just 3 clicks.” To which they replied “why do they need the app for that if the agent can do it?” Cue blank looks.

Your customer might love your account, your card, or your lending product.

They might also want their agent to do the work of using it.

For those customers, the one-size-fits-nobody banking app stops being the default.

If a customer’s chosen agent can get a refund, deal with a warranty, or find a better deal while they’re doing something else, that’s a fairly compelling proposition. A provider that makes those tasks easier becomes more useful to that customer. One that makes them unnecessarily difficult gives the agent a reason to look elsewhere.

Gaming is giving us a preview. Valve gives people tools to make mods and lets creators earn money from videos of its games. Someone else changes the experience, or broadcasts themselves playing it, and the publisher can still benefit.

You can build something that looks like DocuSign. Getting an enterprise to trust it with its contracts is another job. You can build a CRM that suits you beautifully, then discover how much of your company and its data is already connected to Salesforce. Microsoft Office is plumbed into so much of the working day that replacing it involves more than making a nice text editor.

The buttons and features can be copied. The reasons people trust you, and the things they rely on you to provide, still matter.

But there’s a lot of room between “you can remix our software with your agent” and “help yourself to the whole business.”

The perfect metaphor for this comes from the livestreaming world, where gamers will play through an entire video game watched by millions of consumers, and as far as the brands are concerned this is a good thing. Similarly, football creator Mark Goldbridge is broadcasting Bundesliga games on YouTube through a rights deal with the league, so fans can watch along with him. The IP holder still owns the rights. The audience gets another way to enjoy the content. Someone else’s experience can make what you own more valuable.

I think finance is heading the same way. Customers bring their own experience. You give them a reason to keep using your service.

Or are we opening ourselves up to a cybersecurity nightmare of epic proportions?

Potentially. But we don’t have to.

Reverse engineering your app doesn’t automatically give an attacker access to the bank’s internal systems, APIs or credentials. The bank still controls what it accepts.

That’s why giving customers and their agents a proper way in matters.

There’s a small patchwork of protocols emerging to make this possible.

These pieces could (and should) work together.

The important new piece here is x401. Proof, an identity provider, checks identity to NIST’s Identity Assurance Level 2 (IAL2). The promise is reusable proof, without uploading your documents to every service. No selfies or annoying head turning required before your agent can do a thing. And because FinCEN’s recent guidance allows digital credentials within banks’ customer identification programs, this is a lot more bank-ready than a basic handshake protocol alone.

How KYC and KYA (Know Your Customer and Know Your Agent) work together deserves its own piece. I’ll come back to that.

If my cards get stolen, I want my agent to contact my banks and freeze them. Each bank needs to know it’s my agent and that I’ve authorized that action.

Liability already exists but there are some grey areas.

In the US, Regulation E protects consumers in covered electronic fund transfers, including rules for unauthorized transfers and resolving errors. That won’t go away, and gives at minimum a lot to think about for anyone who moves money.

However, Reg E’s official commentary distinguishes stolen access from access deliberately given to another person with authority to make transfers. If that person goes beyond the authority given, the commentary says the consumer is liable unless they’ve notified the institution that the person is no longer authorized. How “person” applies to an agent remains to be seen.

So suppose I give my agent a $200 limit and it asks to move $2,000. I’d like the system executing the payment to reject that, before we have to argue about whose fault it was. I’d also like to see what I authorized, what the agent requested, and what the bank did. And if I turn its access off, I want that to mean something.

That’s an experience you don’t want to mess up.

The customer needs to understand what they’re allowing, be able to stop it, and know where to go when something goes wrong.

Which sounds lovely until you have to do something. So where do you start?

I’d start with the customers who already want to use an agent with your service ( 👋 if you’re watching UK neobanks). Give them useful, limited access and see what they try to do. Make the permissions understandable, make them enforceable, and give people a way to turn them off.

Then pay attention to what those customers build.

This changes the product team’s job too. Product engineers will spend more time making the service useful to software other people bring. Fraud, compliance, and support need to help decide what that software can do and how to put things right. Your own app still matters. So does the experience of a customer who rarely opens it.

Treat it with the seriousness you’d give mobile, while the experiments are still small enough to learn from.

Yes, for most people AI is still a slightly better Google. That can make all of this feel a world away. But what I’m seeing is people discovering that the software they use doesn’t have to stay the way it arrived.

Sometimes that means swinging through GTA like Spider-Man. Sometimes it means never having to find the bloody air-conditioning remote again. And sometimes it means getting your finances to work the way you want them to.

I’d quite like to see what people make.

ST.

Remember, if you're enjoying this content, please do tell all your fintech friends to check it out and hit the subscribe button :)

Want more? I also run the Tokenized podcast and newsletter.

(1) All content and views expressed here are the authors' personal opinions and do not reflect the views of any of their employers or employees.

(2) All companies or assets mentioned by the author in which the author has a personal and/or financial interest are denoted with a *. None of the above constitutes investment advice, and you should seek independent advice before making any investment decisions.

(3) Any companies mentioned are top of mind and used for illustrative purposes only.

(4) A team of researchers has not rigorously fact-checked this. Please don't take it as gospel.

(5) Citations may be missing, and I’ve done my best to cite, but I will always aim to update and correct the live version where possible. If I cited you and got the referencing wrong, please reach out