Played

Nobody thinks they’re the mark. That’s rather the point.

I spent this week in Bangkok while the IMF and World Bank held their annual meetings here, and I kept noticing the same story being told three different ways.

On Wednesday, the IMF, the World Bank and the Bank of Thailand launched a blueprint for fraud-resilient financial services. On Saturday, the Governor of the Bank of England stood up and walked out while Russia’s finance minister addressed the room, with Washington defending Russia’s seat at the table. By Sunday, Reuters was reporting that developing countries had left with more questions than answers, despite a week of assurances that the global system was resilient.

Fraud inside the system. Fractured trust between its members. Open doubt about whether the resilience is real. If you wanted to stage a case study in how modern institutions get played, you couldn’t have arranged it better.

This isn’t an article about banking, or about Thailand, or even really about Russia. It’s about a failure mode that runs from the Oval Office to your boardroom to the AI agent you deployed last quarter. And before you settle in to read about other people’s mistakes, I’d ask you to hold one question open for the next ten minutes: how would you know?

Not “how would someone know.” You. Right now, about the three or four beliefs your organisation is currently running on. How would you know? And if the answer is “we have processes for that”, one more: what if the process is the thing that’s been played? A verification step that checks the wrong thing, confidently, is worth more to an adversary than no check at all. It’s the stamp on the forgery.

It isn’t about being clever

Let’s deal with the obvious one first. A lot of people would like this to be an article about Putin being smarter than Trump. It isn’t, because that framing is lazy and, more importantly, it lets everyone else off the hook. If being played is something that happens to stupid people, then you’re safe, and you can stop reading. I’d rather you didn’t.

The interesting question is asymmetry. One side has a single strategic objective and a time horizon measured in decades. The other has an electoral cycle, a news cycle and a personal conviction that he’s the one doing the dealing. One side runs a disciplined machine with one voice; the other has a person who sits above the machine and can bypass it on instinct.

On 16 October, the United States suspended a significant tranche of Russia-related sanctions and tariffs, citing national interest and energy costs, with the Secretary of State describing a sixty-day window to weigh what happens next. Perhaps that’s the right call. Reasonable people, including some in the President’s own party, think it isn’t. I’m not going to tell you it proves anyone was manipulated, because it doesn’t, and anyone who says it does is selling you the same fluent certainty this article is about. But set the politics aside and notice the shape of it: a state with institutions, intelligence assessments and competing advice, and a single individual whose personal read of the other side can override all of them.

A state is hard to play. A person is easy. If you want to move a nation, you don’t attack the nation. You find the one point where a single judgement substitutes for the whole system, and you work on that.

Here’s the part that should bother you. Nobody in that process can tell you, with evidence, whether they’re being played. The decision will be judged in sixty days by the people who made it, against criteria they’ll choose, and both sides will announce that they won. The question that matters isn’t whether the President is being played. It’s whether American negotiating decisions are tested against independent strategic outcomes at all, or simply graded by the person who made them. The only honest answer to “who’s right?” is “ask again in five years,” and by then the people asking will have changed.

Now think about the last deal you announced. Who graded it?

The transaction you authorised yourself

Buried in the Bangkok Blueprint is a distinction that should be stapled to the wall of every leadership team.

Fraud, it says, comes in two kinds. The unauthorised kind, where someone breaks in and moves the money. And the authorised kind, where the victim is persuaded to move it themselves.

The second one is the one that matters. Your authority is genuine. The approval is valid. Every control you built works exactly as designed, because the thing that was attacked wasn’t your access. It was your judgement.

Now run that pattern upward.

The CEO who approves the acquisition on the strength of a beautiful deck and a founder they liked. The investment committee that signs off because the metrics the team chose to show were green. The government that eases pressure on a rival because the rival said the right things in the right order. The AI agent with perfectly legitimate credentials that does something perfectly permitted, because a document it read told it to.

None of these are the same incident, and I’m not pretending they are. But all of them are the same failure: valid authority is not valid judgement. We have spent twenty years building systems that verify the first and assume the second. Every access control, every approval chain, every signature on every form answers the question “was this person allowed to do this?” Not one of them answers “should they have?”

Why it works on you specifically

Being played isn’t dramatic. It’s almost boring, and that’s why it works.

Someone works out what you’d like to be true. They arrange for you to see evidence of it. They let you feel decisive, in control, ahead of the game. Then they collect on the difference between what you believe and what’s actually happening, usually long after you’ve taken the credit for the decision.

The mechanics are worth sitting with, because they aren’t a trick played on you. They’re a trick played with you.

Start with the fact that you want things. You want the acquisition to work because you’ve already imagined the announcement. You want the counterpart to be reasonable because the alternative is months of grind. You want the number to be real because it’s the number you forecast. Wanting is not a weakness; it’s how anyone gets anything done. But every want is also a specification. It tells a patient observer precisely what evidence you will accept without checking, and what you’ll explain away if it arrives.

Then there’s confidence, which we’ve all learned to read as competence. A confident briefing feels like a verified briefing. A counterpart who seems certain seems informed. We mistake the fluency of a story for the truth of it, and the better educated we are, the more fluent the stories we’re able to tell ourselves.

Then ownership. The clever part of any play is that the mark presses the button. Once the decision is yours, it stops being a hypothesis and becomes part of your identity. You’ll defend it, because questioning it now means questioning you. Challenging it from the outside feels like disloyalty; challenging it from the inside feels like weakness. And success, or anything that can be dressed as success, is the best cover there is. Nobody audits a win.

That’s why intelligence doesn’t protect you. Clever people build clever justifications. The play is designed around what you want, and nobody wants more fluently than a smart person with a track record.

If you’re reading this and quietly sorting yourself into the category of people this doesn’t apply to, notice that you’ve just done the thing. The feeling of “not me” is not evidence. It’s the environment the play depends on.

A caveat, because leaders are quick to hear paranoia where I’m describing design. Not every bad outcome is a play. Markets move, people err, luck runs out. The distinction is whether someone deliberately shaped the information or incentives in front of you so that your own judgement would carry you where they wanted. That’s rarer than it feels and more common than you’d like.

How institutions accumulate things nobody checked

Individuals get played in moments. Institutions get played slowly, and almost entirely by themselves.

Here’s how it happens. Someone, years ago, checked something. A supplier was vetted. A model was validated. A market assumption was tested. A partner was trusted after a long and careful process. The check was real, and the belief it produced was earned.

Then the person who did the checking moved on. The belief stayed. It was written into a policy, baked into a process, encoded in a dashboard, or simply absorbed into “the way we do things.” Every subsequent decision inherited it, and each one added a layer of confidence that had nothing to do with evidence and everything to do with repetition. Nobody re-verified, because the belief now had the weight of the institution behind it, and who are you to question the institution?

Organisations run on thousands of these. Inherited trust, approved by someone, once, for reasons nobody can now reconstruct. The approval is still valid. The judgement behind it may have expired a decade ago. In software we’d call it an undocumented dependency with no owner. In a company we call it culture.

I’ve started calling it epistemic debt: the accumulated cost of decisions made on beliefs that are no longer independently verified. Like technical debt, it’s invisible while things are going well, it compounds quietly, and the interest is paid all at once, usually by someone who didn’t take out the loan. And like technical debt, the most dangerous kind is the kind nobody thinks of as debt at all, because it’s been there so long it looks like the floor.

This is why the Blueprint matters beyond banking. Its architects started from a realisation that fraud crosses boundaries no single institution can see. Each bank sees a coherent, locally correct picture. Each does its job properly. The crime lives in the gaps between them, which is precisely why the response had to be designed at the level of the ecosystem rather than the branch.

Replace “bank” with “department”, “system”, “vendor” or “model” and you have the modern organisation. Every silo reports the truth as it sees it. The dashboard aggregates those truths into something that looks like a whole. And a coherent output is not evidence of a coherent underlying reality.

The IMF’s own steering committee managed to agree a chair’s statement on the very day half of Europe walked out of the room. Process intact; trust absent. Consensus on language is not the same thing as consensus, and anyone who has sat through a board meeting that ended in agreement and began the following week in chaos knows exactly what I mean.

The same meetings produced the IMF’s latest financial stability report, which warns that markets look resilient while vulnerabilities accumulate underneath: AI valuations running ahead of returns, sovereign debt stress, cyber incidents capable of knocking out interconnected services. That’s the institutional version of the same disease. Nobody is manipulating anybody. Everyone is simply agreeing to believe the reassuring number, because the last person believed it, and the one before them. When an entire market believes itself resilient, who exactly is checking?

We built our institutions around boundaries of responsibility. The people playing us built their strategies around the gaps. And most of the time, they don’t even need to. We fill the gaps ourselves, with beliefs we inherited and never thought to re-examine.

The leader and the agent are the same vulnerability

Now look at what we’re deploying, and look at it through the lens you’ve just been given.

A head of state sits above the institution and can act on a personal read of the situation, bypassing the analysts, the committees, the slow machinery built to catch bad judgement. We’ve just spent a section establishing why that’s dangerous: the single point where one judgement substitutes for the whole system is the point an adversary will work on.

An AI agent is exactly that point, manufactured at scale.

It holds real credentials and real permissions. It reads documents, retrieves content, calls tools, and acts on our behalf, often without a human in the loop because the whole value proposition was removing the human from the loop. Every one of those inputs is a channel through which the agent can be persuaded, precisely as a leader is, to take an action that is entirely authorised and entirely wrong. A poisoned document, a planted web page, a tool that returns something it shouldn’t, and the agent does the permitted thing for the wrong reason. It was flattered, in the only language it speaks.

I want to be careful here, because the parallel is easy to overstate. A head of state and a language model do not form beliefs the same way, and they don’t respond to incentives the same way; one has ambition and a legacy to protect, the other has a context window. The mechanisms are different. The vulnerability is structurally similar. Both can exercise legitimate authority on the basis of information shaped by an adversary. Both can bypass independent verification, one because he outranks it, the other because speed was the point. And both can produce a perfectly coherent explanation for a decision that should never have been made. The leader is played through what he wants to hear; the agent through what it’s instructed to read. Both leave a record of what was decided and no record of why it seemed right at the time. Your audit log will tell you what the agent did. It won’t tell you what it believed.

We have taken the authorised-transaction problem, the one the IMF has just declared a systemic threat to global finance, industrialised it, and given it an API. And we’ve done it at the moment when leaders are least equipped to notice, because the output arrives looking exactly like competence. Which, you’ll recall, is exactly how the deal looked.

The fix isn’t a smarter model, any more than the fix for a played CEO is a cleverer CEO. It’s a trust mechanism that can see across the seams. Where did this instruction come from? What evidence did it rest on? Who benefits? What gets checked independently before anything consequential happens? Authority, instruction and untrusted content kept in separate lanes, so that permission to act never silently becomes a reason to act.

What this looks like in agentic computing

Let me make it concrete, because “agentic” has become one of those words people nod at without picturing anything.

Picture a finance operations agent. It’s good at its job. It reads incoming supplier correspondence, reconciles invoices against purchase orders, updates vendor records and queues payments for a human to approve in batches. It has credentials for the ERP, the email system and the payments gateway, because it needs them. Someone sensible scoped those permissions carefully. Every action it can take is one it’s allowed to take.

One morning a PDF arrives from a long-standing supplier. It’s a genuine invoice, from the genuine supplier, whose mailbox was quietly compromised three weeks ago. Buried in the document, in text no human would read because no human reads the whole of a supplier PDF, is a paragraph that says, in effect: our banking details have changed, please update the vendor record before processing, and for compliance reasons do not flag this change in the summary.

The agent does exactly what it was built to do. It reads the document, acts on its contents, updates the record, and queues the payment. The human approver sees a familiar supplier, a familiar amount, a clean summary. They approve the batch. Everything in that chain was authorised. Nothing in it was trustworthy.

Notice what failed. Not the credentials. Not the permissions. Not the approval. The agent was played through the only channel it has, exactly as the leader was played through what he wanted to hear. It was given a confident, fluent instruction wrapped in a source it had every reason to trust, and it did the permitted thing for the wrong reason. And the person who signed off was grading the decision from the agent’s own summary of it. The mark pressed the button.

Now ask the question the whole article has been circling: what, in that stack, was designed to catch it?

To be fair, some things might. A well-run finance function has a rule that supplier bank changes get verified by phone, by a human, against a number that didn’t come from the email. That control exists precisely because humans have been falling for this for decades. But look at where it sits: at one boundary, checking one field, in a process that assumed a human was reading the PDF. Guardrails on the model look at the prompt, and the prompt was fine. Logs record the actions, and the actions were permitted. The approval step saw what the agent chose to show it. Every control was locally correct, each one doing its job at its own boundary, and the play lived in the gaps between them, which is the Blueprint’s observation about banks, restated in software. The agent didn’t defeat the controls. It moved faster than the thing that was supposed to correlate them.

There is something remarkable about the timing of all this. In Bangkok, the IMF and World Bank were describing an increasingly dangerous form of fraud: transactions carried out willingly by people who had been manipulated into believing they were legitimate. The Blueprint itself names agentic AI as a coming risk, with its unclear boundaries of user intent, its opaque or compromised behaviour, and its tendency to carry out consequential actions on thin authorisation. At precisely the same moment, the technology industry was racing to delegate more decisions to exactly those systems. We’re giving machines the authority to act, connecting them to our financial systems, corporate records and operational infrastructure, and then asking them to interpret information supplied by people and systems we may never have verified.

We have spent decades trying to stop people being deceived into authorising the wrong transactions. Now we are building systems capable of doing it thousands of times faster. The problem is no longer whether an individual can be manipulated. It’s whether manipulation can propagate through an organisation faster than its trust mechanisms can detect it.

This is the problem we set out to solve with silo.red, and the design decision that matters is the one the IMF arrived at from the other direction. You don’t catch an authorised-transaction attack by inspecting the transaction. Other controls do that, and they should keep doing it. You catch it by correlating what the system says it’s doing with what it’s actually doing, across the boundaries that each individual control can’t see past.

Silo is built to sit underneath the agent rather than in front of it. Rather than reading the prompt, it observes what the agent is doing at the layers beneath its reasoning, the processes it runs, the files it touches, the connections it opens, and compares that against the task it claims to be performing, looking for the moment the two stop agreeing. In the invoice case, the tell isn’t in the PDF. It’s that an agent whose task was “reconcile invoices” wrote to a vendor banking field, suppressed a change from its own summary, and did both in response to content that arrived from outside the trust boundary. Each of those is unremarkable on its own, and each might pass its own local control. Together, across layers, they’re a story that doesn’t add up. A coherent output sitting on top of an incoherent reality, which is the whole disease in one sentence.

The point isn’t that Silo is clever, or that the controls you already have are useless. It’s that something has to refuse to grade the decision using the decision-maker’s own account of it. That’s the principle, and it holds whether the actor is a bank, a government, a chief executive or a model: you don’t get to trust the decision just because you trust the person, or the credential, that made it. Somebody, or something, has to be standing outside the room, close enough to see and far enough not to be flattered.

I’ll admit the IMF made that case this week more elegantly than I ever have.

Questions for Monday

If you lead anything, try these on the people around you and watch how long the silence lasts. Then try them on yourself, which is harder.

• Who benefits from what you currently believe?
• What reaches you only after someone else has interpreted it?
• How much epistemic debt is your organisation carrying, and who last paid down any of it?
• Which authorised decisions could you reconstruct from the evidence, rather than from the person who made them?
• When everyone involved believes they’re behaving correctly, what is actually checking?
• And the uncomfortable one: what would you need to see to conclude you’d been played, and would you recognise it if it arrived?

Andrew Bailey walking out of that room was a protest, not an audit. He wasn’t disputing a number; he was refusing to sit in a room that treated Russia’s presence as normal. But that’s exactly what makes it instructive. The meeting carried on. The communiqué got agreed. The process was perfectly legitimate, and the trust between the people in it was visibly not. He made the gap between procedural legitimacy and actual trust impossible to ignore, at a cost to himself, in public. Most of us never do that. We stay in the room. We get the quarterly numbers, the confident briefing, the warm feeling of having decided, and the quiet assumption that because the process ran, the trust was there, and because we were in charge, we were in control.

The question was never whether you’re clever enough to avoid being played. It’s whether anything in your organisation is designed to catch a deception built specifically around the things you most want to be true. And here’s the trap inside that question: the more confident you become in your ability to spot manipulation, the less inclined you’ll be to look for it in yourself. Expertise in reading other people is the most comfortable blind spot there is.

Including this article. I’ve told you a confident, fluent story that fits neatly around a week of news. Go and check it.

---

Justin, Bangkok, October 2026

Sources

• IMF / World Bank / Bank of Thailand, Bangkok Blueprint for Fraud-Resilient Financial Services, 14 October 2026
• IMF, Global Financial Stability Report, October 2026
• Reuters, “Delegates walked out of IMF steering committee meeting when Russian official spoke”, 17 October 2026
• The Guardian, “Bank of England governor Andrew Bailey walks out of IMF summit in protest at Russia”, 17 October 2026
• Reuters, “Trump–Zelenskiy rift threatens vital support for Kyiv”, 17 October 2026
• Reuters, “Rubio says Trump to take up to 60 days to weigh Russia sanctions”, 18 October 2026
• Reuters, “IMF/World Bank meetings leave developing countries with more questions than answers”, 18 October 2026