Threat modelling for agents: four questions before the AI reaches the bank account

This episode is made without Jens for once, but with two recurring guests. The starting point is a use case of the kind found in many small offices: the monthly bookkeeping is to be automated, invoices arrive by email, plus a bank statement and a PDF export. The question is whether OpenClaw or Craft Agents is the right tool for it.

The answer is a well-founded “it depends”, and the interesting part sits behind it.

Tool choice without a terminal

Craft Agents enters as a graphical alternative to Claude Code, built on the Claude SDK. No terminal, but MCP connections, skills and tasks that keep running when the application is closed.

This last property is in practice the decisive difference. An agent that only runs while a window is open is fine for interactive work. An agent working through assignments over hours needs execution that is independent of the screen.

The everyday examples in the episode are tellingly unspectacular: a Notion token that has to be re-authenticated constantly, and an application for audio transcription for colleagues who have nothing to do with IT. Neither is a software project, they are points of friction somebody removes.

What is remarkable is what has emerged across the tools in the process. Skills, plugins, hooks and evaluations appear in comparable form in Claude Code, OpenCode and OpenClaw. A common pattern book is emerging before there is a standard. Anyone who has understood the terms in one tool finds their way around the others.

When the agent reaches the account

It gets serious at the point where the agent is to be given access to bank data or the inbox. The panel discusses sandboxing, network segmentation and zero trust principles, and the tone stays pleasantly level-headed.

The core statement is not a warning about the technology but an observation about the users: many simply do not know what a token is. Precisely that becomes the security risk. Anyone who does not understand that a string in a configuration file carries the same rights as their own password treats it accordingly.

For practice it is worth keeping to the order. Anyone starting at question two collects horror scenarios with no relation to the system. Anyone starting at question three buys measures against threats they do not have.

What that does to software architecture

The second large block concerns team structures. Klaus reports how his earlier purism has softened: strictly native iOS in Swift, strict Kotlin for Android, no cross-platform. That stance was justified as long as native code was expensive and cross-platform tools forced compromises.

By now agents produce native code for both platforms, and the team boundary between iOS and Android development is blurring. What originally justified the separation was specialisation in one language and one framework. If that specialisation loses weight, the separation loses its reason too.

From this arises the further question the episode discusses and does not answer conclusively: does the classic application split into frontend team, backend team and app team still hold at all? It is drawn along technology boundaries, and precisely those boundaries are becoming permeable.

Note what does not disappear in the process. Knowledge of the platform, its release processes, its peculiarities and its failure patterns remains necessary. Somebody has to be able to assess what an agent produces.

Conclusion

The episode delivers a practical order of steps for anyone wanting to let an agent near real data.

Clarify first whether the tool executes tasks without an open window. That determines whether you are automating at all or merely assisting.

Second, work through the four questions before you store credentials. That takes twenty minutes and is the only step in this list nobody catches up on once they have skipped it.

And third, make sure everyone working with such tools knows what a token is and what rights hang on it. That is not a training course but a sentence in the induction, and it prevents more damage than any additional software.

The tone of the episode is the model here: no panic about agents hacking everything, but the sober observation that ignorance is the actual risk.