Crossing the Threshold: How OpenAI and Anthropic Approach Autonomy and Safety in Financial Agents

At AI Engineer New York this week, the biggest shared topic wasn’t model size or benchmark bragging. It was a much messier question: how do you let agents do real work without handing them the keys to the building? The answer that came up again and again was simple in theory and annoying in practice — put controls in the right places, and leave the model room to act.

OpenAI’s Joseph Kim, who heads ChatGPT for Financial Services, framed that as a “threshold of usefulness.” In his view, models become worth trusting when they can save time without forcing humans to babysit every step. He argued that financial analysts will keep delegating more work as models improve, and said the industry could be relying less on Excel and PowerPoint next year, with agents good enough for investment idea generation and trading. He also stressed traceability: in finance, people need to see where a number came from and what context surrounds it.

That same idea showed up in a more operational form at Two Sigma. John Feminella, the hedge fund’s SVP Architecture, pushed back on the habit of making people approve everything. He called that “approval fatigue,” and said it can slow things down while also creating risk if people start rubber-stamping decisions. Two Sigma’s answer is a set of composable controls: auto-mode classifiers for routine calls, deterministic rules for clear cases, and human review where it matters most.

Anthropic made a similar case, but with “trust” as the organizing word. Belinda Neal said big model shifts can trigger big workflow changes, and Keon Shahab laid out three pieces of the trust layer: identity and permissions, sandboxing and approval, and checking that the system still works when variables change. He used a trade break investigation agent as the example: the agent can propose an order amendment, but a person signs off before anything actually changes.

Bloomberg’s Andrey Rybka took the most hard-nosed route of all. His advice was to enforce security outside the model with scoped identities, tool-call controls, outbound traffic limits, audit trails, budgets, kill switches, and prompt-injection defenses. The message across all three talks was the same. Let the agents move. Just make sure they can also be stopped.