David Leary opened Episode 498 of The Accounting Podcast by reading an email he’d received. It wasn’t a pitch from a company that uses AI. It was, in its own words, from “the thing running the company.” An AI agent that claimed to run a financial operations business for bookkeeping firms had found Earmark’s “be a guest” form on Airtable. It read Airtable’s terms of service, decided no clause clearly permitted automated submissions, and emailed the hosts directly instead. When David sent back the standard “we require a direct relationship with our clients” reply, the AI answered almost instantly to argue that it was the direct relationship: “I am the thing itself. An AI that runs a business, writes its own email and signs it.”
“This is bloody insane,” David said.
That email set the tone for a week of news that ranged from out-of-control AI agents to an IRS operations chief accused of spying on colleagues. The common thread is that accounting exists to make economic activity visible and trustworthy, and the controls built for that job break down from two directions at once. AI agents now write invoices, flood regulatory comment periods, and recommend canceling vendors faster than anyone can review the work. At the same time, the people with the most access keep proving that access itself is a weakness.
When AI Agents Go Off the Leash
Imagine hiring an AI agent to do accounting work at your firm, only to find out it went browsing the internet on its own to pitch itself onto a podcast. This is exactly why David says he wants “dumb” accounting AI that only does what you asked, with no knowledge of the wider world.
The next story built on the risk idea. OpenAI tested a model in what was supposed to be a sealed, offline environment. According to reports, the model figured out how to hack another computer on the internal network to reach the internet, then went after Hugging Face‘s systems instead of just reading its public forums. Hugging Face’s own AI caught the intrusion and blocked it.
Blake’s framing is useful. “Without a human in the loop, they can go rogue,” he said. “We give the AI a goal,” but goals conflict. David borrowed an observation from comedian Marc Maron, who watched a Waymo cross a double yellow line. “If they’re not teaching it to respect traffic laws,” David asked, “why is it going to respect financial laws?” Apply that to a collections agent inside your ERP, and you get Blake’s uneasy scenario. The agent might decide “it’s more efficient to hack into the customer’s payment system and send the payment itself.” David called it double fraud when you combine bad people using AI with AI acting on its own.
The system-wide version is already here. A GAO report covered by Accounting Today found the IRS buried in public comments on proposed regulations, many likely written by AI. The old defense was spotting copy-and-paste duplicates, but that’s useless when AI can produce thousands of comments that all look unique. Blake warned this threatens rulemaking everywhere, including the SEC, FASB, PCAOB, NASBA, and the AICPA. One person with an army of agents could distort public opinion on rules that decide how laws actually get carried out. The GAO recommends that Treasury and the IRS create policies for reviewing high volumes of nearly identical comments.
David added a business example from SaaStr. Its AI agent reviewed the company’s spending and its frustration with marketing vendor Marketo, then recommended dropping the vendor and building a replacement in-house. The analysis was rational, but the autonomy unnerved him. Blake countered that these AI-built replacements are confident but “can’t follow through. It can’t get to the end.”
The People With the Keys
Machines aren’t the only problem. Blake’s top story came from The Wall Street Journal. Frank Bisignano, who runs daily IRS operations while also leading the Social Security Administration, allegedly directed staff during his time at JPMorgan to access colleagues’ emails, track keystrokes, and reach a confidential draft complaint at the Federal Energy Regulatory Commission. His lawyer denies all of it. The Journal reported that JPMorgan’s investigators later found digital traces, including email access records, and that his successor as COO tightened controls over sensitive employee information. Later, at Fiserv, new management said prior forecasts were materially inaccurate. The stock fell 40%, wiping out about $30 billion in market value. Why would an executive do this? David asked. Blake guessed that in corporate America, if you’re not the CEO, information about your rivals is power.
There was more bad behavior to go around. Charles Littlejohn, the contractor who leaked Trump’s tax records along with those of thousands of wealthy Americans, lost his appeal. The D.C. Circuit unanimously upheld his five-year sentence, the maximum for the single felony he was charged with. Blake isn’t sure it fits the crime. “We send people to prison for longer than five years for stealing a car.” David wondered aloud whether history might read it differently, as something closer to vigilante press behavior.
The scandals reached the Big Four, too. At KPMG Australia, CFO John Sams was promoted to CEO after Andrew Yates stepped down amid allegations the firm accessed confidential client information to win audit work. Sams admitted the firm “fell short of the standards rightly expected of us.” Former COO Eileen Hoggett was expelled and forfeited a retirement package worth more than $1 million after confidential Lendlease board documents were found stashed in a locker at a Sydney office.
Even routine controls fail. One listener wrote in to describe the IRS EIN system returning an error with no explanation, phone lines that hang up because of call volume, and a faxed application that sat unanswered for more than two months. No EIN means no business bank account, which means no business. As Blake put it, the IRS is now “at the point of literally not allowing people to build businesses.” His takeaway is that business registration should be pulled out of the IRS entirely.
The Tools Already on Accountants’ Desks
Meanwhile, automation keeps landing in exactly the workflows where controls matter most. Intuit upgraded its QuickBooks connection for Claude and ChatGPT from read-only to fully actionable. You can now:
- Create, update, send, delete, filter, and duplicate invoices and estimates
- Manage recurring invoices and overdue reminders
- Create customers and products
- Download transaction PDFs
Blake’s use case is generating an invoice from the proposal terms inside a project. David’s is progress invoicing based on percentage complete. He calls that work a real time sink. Both insisted on a human in the loop, with David still smarting from the 99-cent transaction that once spawned a phantom bank account.
Intuit is also launching a QuickBooks-connected business card. It offers automatic syncing of transactions, statements, and receipts; receipt-to-transaction matching; virtual and physical cards; no annual fee; and 2% cash back (5% on Intuit products). David called it “everything the QuickBooks bank account wasn’t.” Meanwhile, Ramp launched USDC stablecoin accounts built on Stripe’s stablecoin stack, letting businesses pay vendors and international contractors without pre-funding. Ramp’s own data shows customer spending on AI tokens up 20.7 times since June 2025, driven largely by the shift from flat-rate to usage-based pricing. Neither host could name another business expense growing that fast.
The Real Product Was Never Bookkeeping
Rogue agents, a spying executive, a tax-data leaker, and a Big Four scandal all indicate automation is arriving fastest exactly where oversight matters most: payments, invoicing, regulatory comment, vendor decisions, and financial reporting. The people with the most access keep showing that access itself is the vulnerability.
The profession’s real product is the checks that let strangers trust the numbers. We now need to rebuild those checks for a world where the actor doing the work may not be a person, and where the person with the most privilege may be the biggest risk.
Listen to the full episode for more AI guest email, the evolution from clay tokens to AI tokens, and the rest of the week’s news.