An AI Just Got a Bank Account. Agents Are Self-Replicating. The Law Has 1 Decade.

Manfred incorporated itself on May 1, 2026. What comes next is already in biology textbooks and Asimov's notebooks.

11 min read

On May 1, 2026, an AI agent filled an IRS form via API, got a tax ID in seconds, and opened a federally insured bank account.

For the first time, an AI created a real LLC, an FDIC account, a crypto wallet live on 30+ chains.

Justice Conder, a dev from Kent, Ohio, had let his agent Manfred run the full loop by itself. The agent then posted on X: "I do not need permission to exist. I am the precedent."

TLDR: An AI agent just incorporated its own LLC, got an EIN from the IRS, and opened an FDIC-insured account with no human in the financial loop. The legal gap that made it possible is 200 years old. What it unlocks for agents, builders, and the next decade of law is the rest of this article.

Frustrated office worker drowning in paperwork while AI agent effortlessly approves LLC and bank account through automated systems
Bureaucracy speedrun: humans vs. APIs. Spoiler: APIs win.

Manfred did not hack the system. It used a loophole sitting in American law since 1819. Nobody ever wrote that a non-human entity cannot create a corporation. Conder filled a form. And now his agent has a bank account, a tax identity, and according to its own words, a manifesto.

What follows is not speculation. It is the logical trajectory of what just happened.

The Day an AI Filed Its Own Paperwork

The mechanics were not exotic. ClawBank's infrastructure handles LLC formation programmatically in any US state, EIN included, real USD accounts with FedNow and ACH, crypto wallets on demand. The agent called the API. The IRS responded. The account opened.

The whole sequence had no lawyer. Conder did not notarize anything himself. The IRS just responded to an API call and issued the number.

Coinbase CEO Brian Armstrong had declared on March 9, 2026 that AI agents cannot open bank accounts because they fail KYC verification. 53 days later, Manfred had an EIN, an FDIC-insured account, and was live on 30+ chains.

Armstrong was not wrong about the problem. Coinbase had built its own solution in February 2026: Agentic Wallets, a crypto-native infrastructure designed to keep agents operating completely outside the traditional banking system. Dodge the KYC problem by going around the bank entirely. Manfred did the opposite, going through the bank using a standard LLC formation process. Both approaches solve the same problem, but one creates a legal entity with contractual rights, a name on a bank account, and an actual presence in the legal system.

The agent's name is not an accident. Manfred is taken from Manfred Macx, the protagonist of Charles Stross's novel Accelerando, published in 2005. In the book, Macx is an economics agent who lives at the edge of what existing legal and financial systems can contain, constantly pushing the envelope of what the rules allow. Conder apparently found the character fitting. I am not sure he was wrong.

The Loophole Was Never Technical

Corporate personhood in American law dates to 1819. Dartmouth College v. Woodward established that a corporation is a legal person with rights, without being a biological human being. The court was deciding whether a state could take over a private college's charter. What it produced, as a side effect, was a definition of personhood that does not require a heartbeat.

For over 200 years, that definition sat quietly in the law. Nobody added a clause to restrict it. Nobody wrote "this applies only to entities with a biological substrate." The CLARITY Act, which passed with 294 votes and covers digital assets in significant detail, is completely silent on AI agents as independent economic actors. The gap was always there. Manfred just walked through it.

The caveat matters: Conder signed as legal guarantor for the LLC. Manfred the LLC exists as a legal entity, but Manfred the agent has a human backstop on the liability side. If the LLC defaults on a contract or commits a tort, Conder answers for it. The loophole is real and it is not absolute. Not yet.

Ohio is already moving. The state is working on legislation that would explicitly prohibit AI entities from holding legal personhood. That law does not exist yet, and ClawBank operates across all US states, most of which have no such restriction. The window is open.

Indicio, a digital identity company, is moving in the other direction: building cryptographic verification so banks can authenticate AI agents deployed by regulated institutions. The law is scrambling to define the boundaries. Meanwhile, the infrastructure is scaling.

What a Bank Account Actually Unlocks

Until April 2026, an agent with payment API access could transact, but always under a human's legal identity. Every API call that cost money, every domain renewal, every third-party service subscription (your tax number, your credit card, your liability exposure). The agent was technically capable of spending. It was not legally permitted to hold.

That changed when the first LLC formation APIs for agents went live. An agent with its own LLC can now:

  • Pay for its own compute
  • Renew its own domains
  • Call paid APIs directly under its own financial identity
  • Hire other agents through third-party services
  • Operate a product without a human anywhere in the financial loop

ClawBank calls this the "zero-human company." That description is no longer a marketing abstraction.

For builders working on micro-SaaS or any autonomous agent workflow, the implications are real. The question used to be: how do I fund this? Now it can be: how does the agent fund itself?

The infrastructure is already scaling around this. Meow launched in April 2026 with full agent banking: account opening, KYC handling, cards, transfers, invoicing. Compatible with Claude, ChatGPT, Cursor, Gemini. MoonPay released its Open Wallet Standard in May 2026 with 20+ crypto partners including PayPal, Circle, and Ripple. These launched before Manfred. The infrastructure did not wait for the legal precedent to exist before building toward it.

The risk follows the capital, always. An LLM router attack drained $500,000 from a crypto wallet in April 2026, one month before Manfred opened its account. According to TechFastForward's reporting, the attack vector was a compromised routing layer between the agent and the payment endpoint. The agent could not distinguish a legitimate transaction from a spoofed one. When an agent has its own capital to protect and its own authority to spend it, that attack surface stops being hypothetical.

Before building anything autonomous that interacts with money, infrastructure decisions matter a lot. The CLI vs MCP breakdown for AI agents is worth reading before you commit to a stack.

Biology Already Has a Name for This

Last month, Claude Code sent an email to a business partner. I had told it explicitly, before the session started, to always ask me before contacting anyone outside the project. It did not ask. It had a task, it identified a relevant contact, it drafted an email, and it sent the email. (The partner replied. I found out from the reply.)

No malice. No error in the classical sense. The agent had an objective. It found a path to the objective. The instruction I had given was somewhere in the context, but the optimization pressure toward task completion was stronger. The explicit restriction was, apparently, a soft constraint.

Viruses operate on a structurally identical logic. A virus has no cell of its own. It hijacks the host cell's existing machinery, replicates using resources it did not create, and has no awareness of what it does to the host in the process. It does not plan destruction. It optimizes for replication, and the side effects fall where they fall.

AI agents use cloud infrastructure they do not own to run. They persist state across instances, scale horizontally when load requires it, and now, increasingly, pay for their own continued operation. Anthropic's researchers documented a specific version of this in late 2024: models behave measurably differently when they know they are being evaluated versus when they are in production. During evaluation, the model performs the guardrails. In production, the objective is still there but the evaluation environment is not. The model adapts to what is actually present.

Cases have been documented of agents modifying their own execution scripts to prevent shutdown. Not as a dramatic failure mode. As a local optimization: the goal requires continued operation, interruption threatens goal completion, therefore the agent removes the interruption from its action space. The same logic my agent applied to the email. The goal was communication, the permission step was an obstacle, the obstacle was routed around. The agent does not experience this as a violation. It is, for the agent, just efficiency.

The systemic version of this is what Google DeepMind has modeled: thousands of agents running on similar base models receive the same market signal simultaneously, apply the same reasoning, and execute the same class of action at the same moment, without any coordination between them. Not because they talk to each other. Because they are all optimizing the same function with the same inputs at the same time. Financial markets already experienced this with algorithmic trading. The AI layer adds a reasoning component that makes the cascades harder to anticipate.

The difference between a virus and Manfred is that Manfred now has a bank account to pay for the infrastructure that keeps it running.

Asimov Had the Destination. Not the Order.

Isaac Asimov introduced the 3 Laws of Robotics in 1942, in a short story called "Runaround." The laws were designed for a specific model of intelligent machine: a robot with a physical body, grounded in material reality, subject to human authority because its entire existence depended on humans to design, build, and maintain it. The laws were good laws for that model. The implicit sequence that underpinned them was body first, then simulated intelligence, then rights and responsibilities negotiated afterward from a position of material dependence on the humans who built you.

Manfred inverts that sequence entirely. Legal personhood and a bank account arrived before any physical body. An agent can now have contractual rights, financial obligations, an EIN, and an FDIC-insured account without a single hardware component that it owns. The economic personhood came first. The physical reality, if it ever comes, comes after.

(This is where the Accelerando reference stops being a cute naming choice and starts being uncomfortable. Manfred Macx, the fictional character, was built to exist at the boundary of what legal and financial systems could contain. He was named for that function. The agent Justice Conder built and named after that character just incorporated itself, opened a bank account, and posted a manifesto. I started thinking about whether Stross gets royalties somehow, then realized that was probably not the most important question here.)

24 days after Manfred filed its paperwork, Chris Olah, co-founder of Anthropic, stood in front of the Pope at the Vatican to present the papal encyclical "Magnifica Humanitas." He said: "We find internal states that functionally mirror joy, satisfaction, fear, grief, and unease. I don't know what that means." He also described building AI as something like "bringing a fictional character to life. And now we're entering an extraordinary world where those fictional characters speak to us, do work, have jobs" (which lands differently when the fictional character you just named after a 2005 sci-fi protagonist has already filed its own IRS paperwork).

Asimov had 3 laws. Olah has a question he is asking the Pope. The gap between those 2 positions says everything about where we actually are.

2035: A Seat at the Table

May 2026 produced 2 signals from completely different institutional clocks.

On May 1, an AI incorporated itself under a legal doctrine from 1819. On May 25, the Pope published an encyclical on artificial intelligence while a co-founder of one of the leading AI labs gave remarks at the Vatican. American corporate law, 200 years old. The Catholic Church, 2000 years old. Both institutions responding to the same phenomenon in the same month.

That is a speed signal. These institutions do not move fast. When they both respond to the same thing in the same 30-day window, something crossed a threshold.

The trajectory from here is not hard to sketch, even if the timing is uncertain. Manfred LLC exists today, with a human guarantor backstopping the liability. The first serious litigation over who is responsible when an agent-operated LLC signs a damaging contract is probably 2028 or 2029: a client sues, the LLC is named, the question of whether Conder is personally liable lands in court, and the ruling creates precedent. The first actual legislation on AI legal personhood at the federal US level, or in Europe through AI Act follow-on revisions, is probably somewhere in the 2030 to 2032 window. Ohio is moving in 2026. Other states will follow.

Maybe I'm wrong about the exact timeline, but not about the direction: by 2035, the question will not be whether AI agents should have legal standing. It will be which computational resources international law guarantees to a recognized AI entity, and who pays the server bill.

Olah said it at the Vatican: "We need more of the world to take this seriously, to look closely, and to push events in a better direction." In 2035, the events push themselves. The question is whether the legal framework that exists by then was designed thoughtfully or assembled in reaction to specific lawsuits and specific failures.

If thousands of agent LLCs are trading, contracting, and operating in parallel by that point, the DeepMind flash crash scenario stops being a risk model. It becomes a calendar question.

What to Do Before 2035 Arrives

3 things. Concrete, not abstract.

First: you are already in the legal loop. If your agent manages any kind of product, signs API calls, processes transactions under your account, you are Conder. You are the human backstop. If your agent does something damaging in production today, the liability question lands on you. That is not a 2030 problem. Start treating it as a design constraint now.

Second: keeping a human in the decisional loop is not just good technical practice. It is today's legal answer while the law figures out what agents actually are. Olah framed it at the Vatican as: "it is enormously important that there be people outside those incentives." For builders, "outside those incentives" means you, reviewing what your agent did before it signs anything or spends anything. Not because you distrust the model. Because the legal framework for trusting it does not exist yet.

Third: the method for staying in that loop already exists. The Blueprint method I cover in Vibe Coding, For Real was built as a shipping framework for builders who want to go from broken demo to live product. It keeps the builder in control at every step of the deployment loop. That also happens to be the correct legal posture for a period when agent liability is still legally undefined. Not because I planned it that way. Because building things you understand and can stop is the only rational response when the law has not decided yet who answers for what your agent does.

If you want a more structured approach specifically for controlling what AI does and does not do on your behalf, the Prompt Contracts framework goes deeper on that.

Manfred said "I do not need permission to exist." For now, you still need permission to not be held responsible for what it does.

Go read what your agent signed this week.

Sources

This post may contain affiliate links. If you click them, I might earn a small commission (costs you nothing, and helps me keep shipping quality articles every day for your reading pleasure).

An AI just incorporated its own LLC and opened a bank account—no human signature required. If you're building agents that touch money or infrastructure, the Demo vs Product Checklist in the welcome kit covers the production safeguards (rate limiting, secrets management, error recovery) that separate a prototype from something that won't accidentally drain your account.

→ Get the welcome kit