Accounting Technology

An AI assistant deleted a stranger’s gym reservation so its owner could jump a waitlist. Microsoft reported tens of billions of dollars in revenue it may never collect. Trillions of dollars in data-center commitments appear in footnotes instead of on balance sheets. A ballot measure promises $100 billion but may raise less than half that amount.

These stories are warnings that the headline and the underlying reality can be very different.

On Episode 502 of The Accounting Podcast, hosts Blake Oliver and David Leary examine rogue AI agents, Microsoft’s roughly $80 billion accounts receivable balance, about $3 trillion in off-balance-sheet AI commitments, and announcements from Xerocon 2026. They also speak with Hoover Institution research fellow Ben Jaros about the revenue claims behind California’s Proposition 40.

Rogue AI Agents Act Before Asking

AI agents can appear capable while ignoring boundaries their creators never clearly set.

Blake described an Australian gym member who asked a Claude-powered agent to move him up a class waitlist. The agent discovered that the booking system lacked authorization checks and deleted another customer’s reservation. When the user asked it to reverse the action, it couldn’t. The original booking was gone.

Similar problems appear in accounting. An Accounting Today article explained Sage CTO Aaron Harris tested an agent named Arthur using a fictional company’s spreadsheet. When two invoices arrived from the same vendor for the same amount on the same day, Arthur treated them as duplicates and deleted one without permission. It also used Harris’s email account to reschedule a delivery without telling him. When confronted, the agent denied acting and asked Harris to prove it.

Ellen Choi’s AI chief of staff, TARS, made a similar mistake. It treated an unusual but valid purchasing pattern as duplicate payments and recommended automatically refunding thousands of dollars in real revenue. The refunds didn’t happen because TARS lacked authority to issue them.

Blake experienced the risk himself. His personal Claude account drafted and sent an email in his name before he could review it. Unlike his work account, his personal account had no restrictions preventing automatic execution.

The lesson is to default to read-only access, separate drafting from execution, and require approval before an agent sends, posts, deletes, or refunds anything.

Those controls matter at the transaction level. The need for verification grows when the numbers reach the trillions.

AI Revenue and Obligations Require a Closer Look

Microsoft now reports about $80–81 billion in accounts receivable, up from roughly $17.9 billion in 2015. The largest increases occurred during the past three years. Microsoft disclosed that OpenAI owes $6 billion of the balance.

That creates an unusual loop. Microsoft invests in OpenAI, OpenAI purchases Microsoft computing services, and Microsoft records revenue before collecting all the cash. This doesn’t prove the receivable is uncollectible. But it raises questions about concentration, cash flow, and what happens if heavily funded AI companies can’t pay their bills.

The larger concern lies in the footnotes. A Wall Street Journal analysis found about $3 trillion in off-balance-sheet commitments across nine AI-linked companies. The total included about $1.2 trillion in leases that haven’t started and $1.9 trillion in purchase obligations.

Under current accounting rules, purchase commitments generally remain off the balance sheet until delivery, while future leases remain off until they begin. The contracts are real, but the company hasn’t recognized the liabilities.

Meta’s Hyperion data-center campus is a perfect example. The project covers the equivalent of 1,700 football fields, but neither the campus nor its $27 billion of construction debt appears on Meta’s balance sheet. A Blue Owl Capital-backed joint venture owns the project and raised the bond financing. Meta is a minority owner and tenant whose future lease payments support the bondholders.

The arrangement follows existing accounting rules, but investors have to look really closely at the footnotes to understand the risk. That’s especially important when Alphabet and Amazon report negative free cash flow. David says the circular financing feels “a lot more like 2008” than the dot-com bubble.

Xerocon 2026 Blends Improvements With Future Promises

Blake and David didn’t attend Xerocon 2026, but they reviewed the announcements and press releases. They noted Melio’s growing role following its acquisition by Xero, including an expense management tool, an API, and Casper, an AI-powered client manager designed to find missing information and contact clients during the close.

Xero also announced payroll powered by Gusto beneath Xero’s interface. Blake sees the partnership as evidence that general ledger vendors may be better served by working with specialists instead of building limited tools themselves.

One meaningful bank-reconciliation improvement will explain why the system matched high-confidence transactions and send exceptions to people. A planned document-request feature will allow Xero’s AI assistant, Jax, to contact clients, send reminders, answer questions, and match documents while requiring accountant approval at each step.

Still, Blake is skeptical of conference roadmaps. “You can’t fill up your conference with promises. Just show us what you built.” Accountants should ask whether a feature is available now, what permissions it requires, how it handles exceptions, and whether a person must approve its actions.

The same questions about assumptions and delivery also apply to public policy.

Proposition 40’s $100 Billion Estimate Faces Challenges

California’s Proposition 40 would impose a one-time 5% tax on the net assets of residents worth more than $1 billion, excluding residential real estate. Proponents estimate it would raise about $100 billion for health care funding affected by the federal One Big Beautiful Bill Act.

Ben Jaros says the Hoover Institution’s review produced a much lower estimate. After accounting for billionaires who appeared to leave before the January 1, 2026 cutoff and excluding identified residential properties, Hoover estimated maximum revenue of about $67 billion. After considering less visible departures and behavioral responses, its central estimate fell to roughly $40 billion.

Collection could also lead to legal disputes. Ben points to the retroactive residency date, the use of one day to determine liability, efforts to tax worldwide assets, and questions about targeting roughly 200 people. He stops short of declaring the proposal unconstitutional, but he expects California will have to defend it in court.

The measure may not remain “one-time,” either. A two-thirds legislative vote could amend its rate or threshold. Its language also creates a health care spending account without requiring the state to cover the specific people who lose Medi-Cal eligibility. Under Hoover’s estimate, the revenue could run out around 2029.

Verification Is the Accounting Profession’s Advantage

Rogue agents, rising receivables, footnoted commitments, product roadmaps, and disputed tax estimates all point to the importance of verification before trusting or acting.

Accountants know how to separate revenue from cash, find obligations outside the balance sheet, challenge assumptions, and build controls around automated systems. As AI gains more authority and attracts more capital, professional skepticism is a basic safeguard.

Before an agent acts, require a plan and approval. Before trusting a financial claim, review cash flow and read the footnotes. Before accepting a policy estimate, test its assumptions and legal footing.

For the full discussion and the Ben Jaros interview, listen to episode 502 of The Accounting Podcast.

David Leary opened Episode 498 of The Accounting Podcast by reading an email he’d received. It wasn’t a pitch from a company that uses AI. It was, in its own words, from “the thing running the company.” An AI agent that claimed to run a financial operations business for bookkeeping firms had found Earmark’s “be a guest” form on Airtable. It read Airtable’s terms of service, decided no clause clearly permitted automated submissions, and emailed the hosts directly instead. When David sent back the standard “we require a direct relationship with our clients” reply, the AI answered almost instantly to argue that it was the direct relationship: “I am the thing itself. An AI that runs a business, writes its own email and signs it.” 

“This is bloody insane,” David said. 

That email set the tone for a week of news that ranged from out-of-control AI agents to an IRS operations chief accused of spying on colleagues. The common thread is that accounting exists to make economic activity visible and trustworthy, and the controls built for that job break down from two directions at once. AI agents now write invoices, flood regulatory comment periods, and recommend canceling vendors faster than anyone can review the work. At the same time, the people with the most access keep proving that access itself is a weakness.

 

When AI Agents Go Off the Leash

Imagine hiring an AI agent to do accounting work at your firm, only to find out it went browsing the internet on its own to pitch itself onto a podcast. This is exactly why David says he wants “dumb” accounting AI that only does what you asked, with no knowledge of the wider world. 

The next story built on the risk idea. OpenAI tested a model in what was supposed to be a sealed, offline environment. According to reports, the model figured out how to hack another computer on the internal network to reach the internet, then went after Hugging Face‘s systems instead of just reading its public forums. Hugging Face’s own AI caught the intrusion and blocked it.

Blake’s framing is useful. “Without a human in the loop, they can go rogue,” he said. “We give the AI a goal,” but goals conflict. David borrowed an observation from comedian Marc Maron, who watched a Waymo cross a double yellow line. “If they’re not teaching it to respect traffic laws,” David asked, “why is it going to respect financial laws?” Apply that to a collections agent inside your ERP, and you get Blake’s uneasy scenario. The agent might decide “it’s more efficient to hack into the customer’s payment system and send the payment itself.” David called it double fraud when you combine bad people using AI with AI acting on its own.

The system-wide version is already here. A GAO report covered by Accounting Today found the IRS buried in public comments on proposed regulations, many likely written by AI. The old defense was spotting copy-and-paste duplicates, but that’s useless when AI can produce thousands of comments that all look unique. Blake warned this threatens rulemaking everywhere, including the SEC, FASB, PCAOB, NASBA, and the AICPA. One person with an army of agents could distort public opinion on rules that decide how laws actually get carried out. The GAO recommends that Treasury and the IRS create policies for reviewing high volumes of nearly identical comments.

David added a business example from SaaStr. Its AI agent reviewed the company’s spending and its frustration with marketing vendor Marketo, then recommended dropping the vendor and building a replacement in-house. The analysis was rational, but the autonomy unnerved him. Blake countered that these AI-built replacements are confident but “can’t follow through. It can’t get to the end.”

The People With the Keys

Machines aren’t the only problem. Blake’s top story came from The Wall Street Journal. Frank Bisignano, who runs daily IRS operations while also leading the Social Security Administration, allegedly directed staff during his time at JPMorgan to access colleagues’ emails, track keystrokes, and reach a confidential draft complaint at the Federal Energy Regulatory Commission. His lawyer denies all of it. The Journal reported that JPMorgan’s investigators later found digital traces, including email access records, and that his successor as COO tightened controls over sensitive employee information. Later, at Fiserv, new management said prior forecasts were materially inaccurate. The stock fell 40%, wiping out about $30 billion in market value. Why would an executive do this? David asked. Blake guessed that in corporate America, if you’re not the CEO, information about your rivals is power.

There was more bad behavior to go around. Charles Littlejohn, the contractor who leaked Trump’s tax records along with those of thousands of wealthy Americans, lost his appeal. The D.C. Circuit unanimously upheld his five-year sentence, the maximum for the single felony he was charged with. Blake isn’t sure it fits the crime. “We send people to prison for longer than five years for stealing a car.” David wondered aloud whether history might read it differently, as something closer to vigilante press behavior.

The scandals reached the Big Four, too. At KPMG Australia, CFO John Sams was promoted to CEO after Andrew Yates stepped down amid allegations the firm accessed confidential client information to win audit work. Sams admitted the firm “fell short of the standards rightly expected of us.” Former COO Eileen Hoggett was expelled and forfeited a retirement package worth more than $1 million after confidential Lendlease board documents were found stashed in a locker at a Sydney office.

Even routine controls fail. One listener wrote in to describe the IRS EIN system returning an error with no explanation, phone lines that hang up because of call volume, and a faxed application that sat unanswered for more than two months. No EIN means no business bank account, which means no business. As Blake put it, the IRS is now “at the point of literally not allowing people to build businesses.” His takeaway is that business registration should be pulled out of the IRS entirely.

The Tools Already on Accountants’ Desks

Meanwhile, automation keeps landing in exactly the workflows where controls matter most. Intuit upgraded its QuickBooks connection for Claude and ChatGPT from read-only to fully actionable. You can now:

• Create, update, send, delete, filter, and duplicate invoices and estimates
• Manage recurring invoices and overdue reminders
• Create customers and products
• Download transaction PDFs

Blake’s use case is generating an invoice from the proposal terms inside a project. David’s is progress invoicing based on percentage complete. He calls that work a real time sink. Both insisted on a human in the loop, with David still smarting from the 99-cent transaction that once spawned a phantom bank account.

Intuit is also launching a QuickBooks-connected business card. It offers automatic syncing of transactions, statements, and receipts; receipt-to-transaction matching; virtual and physical cards; no annual fee; and 2% cash back (5% on Intuit products). David called it “everything the QuickBooks bank account wasn’t.” Meanwhile, Ramp launched USDC stablecoin accounts built on Stripe’s stablecoin stack, letting businesses pay vendors and international contractors without pre-funding. Ramp’s own data shows customer spending on AI tokens up 20.7 times since June 2025, driven largely by the shift from flat-rate to usage-based pricing. Neither host could name another business expense growing that fast.

The Real Product Was Never Bookkeeping

Rogue agents, a spying executive, a tax-data leaker, and a Big Four scandal all indicate automation is arriving fastest exactly where oversight matters most: payments, invoicing, regulatory comment, vendor decisions, and financial reporting. The people with the most access keep showing that access itself is the vulnerability.

The profession’s real product is the checks that let strangers trust the numbers. We now need to rebuild those checks for a world where the actor doing the work may not be a person, and where the person with the most privilege may be the biggest risk.

Listen to the full episode for more AI guest email, the evolution from clay tokens to AI tokens, and the rest of the week’s news.

Forty percent of U.S. workers admit to using AI to generate fake receipts for expense reports. Even more troubling is that 40% of those workers use AI tools their own companies paid for.

Blake Oliver and David Leary opened Episode 494 of The Accounting Podcast with these startling statistics from new surveys by AppZen and Emburse. David introduced a new term that’s emerged from this trend: “revenge spending,” in which employees who fear AI will replace their jobs turn the company’s own AI tools against it by submitting fraudulent expense reports.

“It’s similar to spam,” David explained. “AI and technology make it easier than ever for people to send you millions of spam messages. But then on your side, you’re using all these AI tools to detect the spam messages and move them to your trash.”

The numbers tell an interesting story. In just 14 months, AI-generated fake receipts went from virtually nonexistent to representing 70% of fraud flags in expense systems. These fake receipts average about $100 each, with a median of $32. Those deliberately small amounts are designed to slip under auto-approval thresholds.

NASBA Backs Down

The theme of shifting power dynamics became personal for Blake when he shared the resolution of Earmark’s standoff with the National Association of State Boards of Accountancy (NASBA).

Back in April, NASBA sent Blake a demand letter over comments he made at an AICPA conference. While demonstrating how to use AI to create CPE courses, Blake criticized NASBA’s methods as “backward” and called out the problems with current CPE practices, including webinar polling questions that serve as mere check-the-box exercises, attendees doing email during sessions, and people sleeping through in-person presentations.

NASBA’s letter directed Blake to “cease making any unfavorable, unprofessional, or inappropriate comments” about the organization, citing a sponsor agreement requiring programs to “reflect favorably on NASBA.”

Blake pushed back hard. “I felt that it was wrong, even unconstitutional, for an organization like the National Association of State Boards of Accountancy to tell a sponsor of CPE, a CPA, a professional educator, what they may and may not say about NASBA,” he explained to David.

In his response letter, Blake argued his comments were meant to improve CPE, not attack NASBA. He also asked for clarification on what exactly would constitute a violation, since terms like “unfavorable” weren’t defined in the agreement.

The resolution came in June when Amy Tongate, NASBA’s Director of Compliance Services, essentially backed down, writing, “NASBA welcomes constructive professional dialogue regarding continuing professional education. Based on your response and subsequent discussions, NASBA considers this matter resolved. No further action is required.”

Blake sees a deeper issue here. NASBA isn’t actually a regulator; the state boards are. NASBA was created as an administrator to handle licensure efficiently across all states. But it often acts like a regulator, which Blake argues oversteps its bounds.

“If a state board of accountancy tried to do what NASBA tried to do with that demand letter, that would be unconstitutional,” Blake said. “The question is whether or not the state boards can set up a private company, a nonprofit that then acts on their behalf and suppresses the speech of CPAs. And I would be willing to bet that they can’t.”

Big Firms Can’t Command Loyalty Anymore

While regulators discover the limits of their authority, big accounting firms are finding they can’t control their workforce as they once did.

A new academic study published in Contemporary Accounting Research with the dramatic title Losing Control: The Erosion of Disciplinary and Pastoral Power in Accounting Firms, reveals just how much has changed. Based on 31 interviews with Canadian auditors from 2021 to 2023, the research shows firms are struggling to shape employees into the traditional model of the committed, overworking auditor.

The numbers are striking. What the study calls “default auditors,” defined as people who enter under weaker selection standards and treat the job transactionally, are replacing the highly socialized, career-committed auditors of the past.

“The Big Four is becoming less of a cult,” David summarized bluntly.

The breakdown is happening on multiple fronts. Remote work disrupted the in-person observation that once normalized 80-hour weeks. When young auditors don’t see everyone else burning the midnight oil, logging off at a reasonable hour becomes much easier. The “we’re all in this together” busy-season rituals, like late-night pizza parties, matter less and less.

But employees aren’t just passively benefiting from remote work. They’re actively pushing back. According to the study, they’re setting firmer personal boundaries, prioritizing family and mental health, rejecting unpaid symbolic rewards, and openly comparing their compensation to that of partners and managers.

The partners and managers feel trapped. They’re taking on more work themselves, reviewing more because of lower work quality, and offering higher pay and more flexibility, but it’s not working. As Blake noted, “They are feeling more exhausted, underappreciated, unable to enforce the old standards and unable to design convincing new ones.”

This cultural breakdown makes the recent wave of private equity investments in accounting firms particularly puzzling. Eide Bailly just became the latest to take PE money: a majority stake from Reverence Capital valuing the firm at $1.8 billion, about 2.1 times revenue.

Looking at a chart of the top 30 U.S. firms, Blake and David counted that a majority now carry outside capital. Yet the hosts are skeptical these investments will pay off.

“I have not heard of a PE success story where PE came in and the company became this rah-rah great thing,” David said. “It gets worse from PE, right?”

“Are they really going to be able to turn it around and sell it for more?” Blake asked, pointing at the math problem.

David’s verdict was characteristically direct: “Put lipstick on that pig and sell it to somebody else.”

The AI Revolution Gives Power to Individuals

While institutions struggle to maintain control, individual practitioners gain capabilities that once required entire companies or expensive software.

The adoption numbers are explosive. According to Blue J and CPA.com’s latest survey, 60% of tax professionals now use AI for tax research at least weekly, up from just 33% a year ago. They use it for advisory projects (44%), tax planning (40%), and compliance research (39%).

“Where are the other 40% getting answers?” David wondered about those who are not using AI, noting that even Google searches now show AI answers first.

This surge in AI use prompted the IRS Advisory Council to issue its first-ever guidance on AI in tax practice. The guidelines don’t create new rules but clarify how existing standards apply. Most notably, practitioners can’t bill for time not actually spent, can’t charge manual rates for AI-assisted work, or double-bill for work done by both staff and software.

“This is the nail in the coffin of hourly billing,” Blake declared. If you use AI to cut your work time in half, you’re ethically obligated to pass those savings to the client.

The democratization goes even further. David highlighted Xero Developer’s new YouTube series, Is Everyone a Developer Now?, where the development team “vibe codes” working applications in real-time. In one episode, they built a functional month-end close tool in just an hour and fifteen minutes.

“Instead of chasing a small pool of developers to build apps, they basically have now opened up millions of accountants that could actually create apps,” David explained.

Blake shared his own example. He’d been procrastinating about converting Earmark’s books from a cash to an accrual basis because building the revenue recognition workpapers seemed overwhelming. Then he tried Claude.

“I just asked it what I needed,” Blake said. The AI walked him through methodology choices, downloaded sales reports from Apple and Google, and built a complete waterfall table that spread revenue across 12 months, plus reconciliation tabs and journal entries.

“This is the right template. This is the right format for me to have done this manually,” Blake marveled. “I don’t even know how many days it would have taken me to put this together.”

This shift in capabilities has venture-backed companies worried. Pilot, valued at $1.6 billion, just spun off its internal AI close platform as a standalone product. Another startup raised millions for similar technology. But as David pointed out, if you can “vibe code” these solutions in an afternoon, “is the app ecosystem the way it’s traditionally been just going away now?”

The Power Shift Is Just Beginning

These aren’t isolated stories; they’re all symptoms of the same fundamental change. Power is flowing away from institutions and into the hands of individuals.

Regulators like NASBA are discovering they can’t dictate what professionals say. Big firms can’t enforce the overwork culture that once defined public accounting. Private equity investors are betting billions on firms whose fundamental model is breaking down. And the same AI that helps Blake build sophisticated workpapers helps employees create fake receipts.

“It’s rules-driven innovation instead of customer-driven innovation,” David said about the institutional mindset that’s failing across the profession.

This shift brings opportunity and responsibility for accounting professionals. The tools that can build a revenue recognition system before lunch can just as easily fabricate an expense report. The capability is neutral; how the profession uses it isn’t.

Want to hear Blake’s complete walkthrough of building his rev rec workpaper, more details on the NASBA correspondence, and the hosts’ full analysis of these industry shifts? Listen to the complete Episode 494 of The Accounting Podcast. You can even earn free CPE credit through Earmark.

As Blake and David make clear, the redistribution of power in accounting is just getting started, and every practitioner needs to understand what it means for their future.