When an AI Agent Calls Your Carrier: What AT&T and T-Mobile’s New Guardrails Leave Unsettled

Most customer-service calls to a wireless carrier begin with the same question: are you the account holder? Carriers have spent roughly two decades building authentication around that question, and federal rules require it. What nobody has settled is the next version of the call, where the voice or API request on the other end says it is a software agent acting for the account holder.

That scenario sits underneath comments made public on October 23, 2026, when executives at AT&T and T-Mobile described how they are protecting customer databases as AI moves into more of their operations. AT&T’s chief technology officer, Jeremy Legg, said the company has put encryption, multifactor authentication and human oversight of data access around its AI use, and that it is working to confirm whether third-party AI agents asking for access to customer accounts are really acting for legitimate customers. T-Mobile’s chief technology officer, John Saw, said the company is increasing its investment in how it monitors and reacts to AI-related risk, and works with vendors to close security holes quickly. Saw spoke to the Reuters Global Markets Forum, and the syndicated report is the public record of what the two executives said.

The comments are executive statements about intentions and current controls. They are not audit findings, and neither company has published the technical detail behind them. That matters for how much weight a compliance team should put on them. What they do offer is a useful prompt: if two of the largest holders of consumer communications data are working through agent access right now, every company with a customer portal and a support queue is probably facing a smaller version of the same question.

What the two carriers actually said

The reporting contains four separable claims, and it helps to keep them apart.

• AT&T described its controls as encryption, multifactor authentication and human oversight of data access, and said it is working on verifying whether outside AI agents requesting account access are authorized by real customers. “Working on” is the operative phrase; the company did not say the verification is finished.
• Legg also said third-party software providers and AI agents create risks that extend beyond a carrier’s own network, calling them “industry problems, not things that AT&T can solve by itself,” and questioned whether the open-source community follows comparable security standards.
• Saw said T-Mobile is investing more in monitoring and response, and that it works with vendors so security holes are closed as soon as possible. The report noted that T-Mobile has had several breaches, including in 2021 and 2023, and has settled with consumers and the FCC over them.
• On network automation, Legg said handing entire networks to autonomous AI is still “years away” because complex problems need human intervention. AT&T already uses AI to analyze trouble tickets and sometimes apply repairs automatically. T-Mobile uses AI to adjust cell-site antennas when nearby sites go down; during Winter Storm Fern in January, Saw said, its self-organizing network restored coverage to about 66% of customers within an hour and 90% within eight hours.

The last item deserves a separate mental bucket. Antenna tuning and ticket triage are mostly about network state, not about people. An agent that can read or change a customer’s account is handling personal data, which is where privacy law and the FCC’s customer-information rules come in. The two kinds of automation carry different risks, and a governance program that treats them as one “AI in the network” category will review the wrong things.

The authentication rule was written for people

Under the FCC’s rule on safeguarding customer proprietary network information (CPNI), a carrier must properly authenticate a customer before disclosing CPNI in response to customer-initiated phone contact, online account access or an in-store visit. For phone requests, call detail information can be given out only if the customer supplies a password that was not prompted by readily available biographical or account information; online access likewise requires a password established without that kind of information. In a store, a valid photo ID matching the account is enough.

The text of the rule speaks in terms of a customer, a password and a person standing at a counter. It does not mention AI agents. We read that as an open question, not a loophole: a carrier that lets an outside agent reach CPNI on the strength of a customer’s say-so still carries the duty to take reasonable measures against unauthorized access, and the FCC has not, in the rule text we reviewed, told carriers how an agent’s delegated authority should be proven. How the Commission would treat a disclosure to an agent that turned out to be acting for a fraudster is untested. Companies in other sectors should not assume that “the customer’s agent” will be accepted as proof of authority by a regulator or a court. That is untested, and the practical burden of proving delegation is likely to fall on the party holding the data.

What T-Mobile’s 2024 settlement shows regulators look for

T-Mobile’s 2024 FCC consent decree is the closest thing to a published checklist from a regulator on this subject. The Enforcement Bureau investigated whether T-Mobile failed to protect customer information, allowed access to CPNI without customer approval, failed to take reasonable measures against unauthorized access, used unjust and unreasonable security practices, and misrepresented its security practices. The decree was an agreement to resolve those investigations, and it states that it is not an adjudication on the merits or a finding of fact or law, so none of those questions was formally decided against the company.

What T-Mobile agreed to is more instructive than what was alleged. It paid a $15.75 million civil penalty and committed another $15.75 million over two years to its cybersecurity program, including a chief information security officer who reports regularly to the board, movement toward a zero-trust architecture with network segmentation, phishing-resistant multifactor authentication, data minimization, data inventory and disposal processes, a critical asset inventory and independent third-party assessments. It also agreed to third-party oversight: a centralized inventory that categorizes and ranks outside parties through a risk-scoring protocol based on the service they provide and the categories of information they touch, plus due diligence in selection and contractual protections.

One incident in the decree maps closely onto the agent problem. In January 2023, T-Mobile discovered that one of its APIs had been exploited. The order describes human error that misconfigured permission settings so that a threat actor could submit queries and pull customer account data. T-Mobile’s investigation indicated that data was obtained for approximately 37 million current postpaid and prepaid accounts, though many records did not include the full data set. An AI agent is, for access-control purposes, another API client with a very flexible query style. A permissions mistake that a human attacker can find with effort, an agent can test continuously.

Following the data when an agent is involved

A useful way to scope the issue is to trace the same five questions for any agent that touches customer accounts. These are the questions a privacy assessment should be able to answer, and the answers will differ for an in-house assistant, a vendor’s agent and a customer’s own agent.

• What is collected or exposed. Account identifiers, plan details, usage and call detail records, billing addresses and payment status are all reachable from a typical account interface. The question is which of those an agent’s token can read, and whether it can also write: change a plan, add a line, reset credentials.
• Who receives it. The agent’s operator, its model provider, any logging or analytics tool in the chain and any subcontractor that stores conversation transcripts may each receive account data. The carrier often sees only the first hop.
• Why it is processed. The customer’s request is the stated purpose. Whether the agent’s operator may reuse the data to improve its own models is a contract term, not a given.
• How long it stays. Transcripts and cached account data can outlive the session. A retention rule that applies to the carrier’s own systems does not automatically reach a third party’s logs.
• Which controls govern it. Scoped permissions, rate limits, step-up authentication for sensitive actions, human review for high-risk requests and tamper-resistant logs. Encryption protects data in transit and at rest but does nothing about an agent that is authorized to see the plaintext.

1. Seven checks before an AI agent touches customer accounts

The following list is our own practical sequence, not a regulatory requirement and not a description of what AT&T or T-Mobile do internally. It applies to any business that exposes customer accounts through a portal, API or support channel.

1. List every agent, including the ones you did not deploy. Separate agents you build, agents your vendors embed in their products and agents customers bring. Only the first group is under your direct control.
2. Decide what proof of delegation you will accept. A customer-issued, revocable token with narrow scopes is a different thing from an agent that reuses a stored password. Write the rule down before an agent appears in your logs.
3. Split read access from write access. Letting an agent look up a bill is not the same as letting it change a credential or add a line. Sensitive actions should require a fresh confirmation from the human account holder through a channel the agent cannot answer.
4. Cap what one agent identity can do. Per-agent rate limits and anomaly alerts make bulk extraction visible. A permissions misconfiguration is far less damaging when the identity behind it can only touch one account at a time.
5. Define what “human oversight of data access” means. Name who reviews, which events trigger review, how quickly, and what evidence is kept. A policy sentence is not oversight; a queue with an owner and a log is.
6. Put the agent operator under contract. Cover retention, secondary use, subcontractors, breach notice and audit rights. Rank each operator by the data it can reach, as T-Mobile agreed to do for its third parties.
7. Test it as an attacker would. Try a prompt-injected agent, a stolen token and an agent that claims more authority than it holds. A completed assessment is not proof the controls work; an exercise that fails safely is.

A hypothetical to make the stakes concrete

Suppose a consumer installs a household-management assistant that promises to cut her phone bill. To do that it logs into her carrier account using credentials she supplied, reads her plan and usage, and begins calling the carrier’s support line on her behalf. This example is invented for illustration. A week later the assistant’s operator suffers a breach and the stored credentials are sold. From the carrier’s side, every login looked like the customer’s own, and the logs show a valid password. Whether anyone at the carrier “authorized” the access is the very question the CPNI rules were designed to answer, and the answer in the rule text points back to the carrier’s authentication, not the assistant’s reputation.

Where Captain Compliance fits, and where it does not

Captain Compliance does not authenticate users or agents, and it is not a replacement for a carrier’s identity and access stack. Its relevant work here sits around the decisions. On its AI governance advisory page, the company describes help establishing governance structures and accountability, continuous monitoring of AI systems, privacy and data protection reviews of AI systems and training datasets, and assessments of third-party AI solutions. Whatever the engagement, the output a team should insist on is a record of which agents exist, what data each can reach and who signed off, so the answers are ready when a regulator or a customer asks.

The vendor side maps to its third-party risk management service, which covers building an inventory of outside parties that touch personal data, assessing them before data is shared, and reviewing contracts for data protection and breach-notification terms. Those are advisory and process tools. They help a team see and record its exposure; they do not guarantee that an agent will be safe or that any regulator will agree with a company’s conclusions. For background on how past vendor failures reached the FCC’s docket, see our write-up of Comcast’s $1.5 million FCC fine over a vendor breach, and for the governance framing of agents themselves, why AI agents should not be treated as employees.

Frequently asked questions

Does the FCC’s CPNI authentication rule cover AI agents?

The text of 47 CFR 64.2010 says carriers must authenticate a customer before disclosing CPNI through phone contact, online account access or an in-store visit. It does not mention AI agents or delegated software access. Until the FCC or a court addresses the point, a carrier should assume it must be able to show that the person behind any agent was properly authenticated and authorized the specific access.

Did T-Mobile admit wrongdoing in the 2024 settlement?

No. The consent decree says it is neither an adjudication on the merits nor a factual or legal finding. T-Mobile agreed to the penalty and the compliance commitments to resolve the investigations. The commitments are still a fair indication of what the FCC considers reasonable security practice for a carrier.

Is AT&T’s “human oversight” a regulatory requirement?

Not as described in the reporting. It is a control AT&T said it has adopted. No rule in the CPNI provisions we reviewed requires human review of AI data access, so how much oversight is enough is a risk decision for each company.

Do fully autonomous networks create a separate privacy issue?

Mostly a security and resilience one. Network automation such as antenna adjustment relies on network state, not subscriber content. The privacy exposure grows when automated systems are given access to customer records, location data or call detail information. AT&T’s CTO said fully autonomous networks are still years off.

What should a non-telecom company take from this?

That the agent access question is not confined to carriers. Any business with account portals, loyalty programs or support APIs will meet agents acting for customers. Decide your delegation standard and logging approach now, while the volume is low.

Is encryption enough to protect account data from an AI agent?

No. Encryption protects data from people and systems that are not authorized to read it. An agent with valid credentials sees decrypted data by design, so the control that matters is what that agent identity is allowed to request and how its activity is monitored.

Carriers have a long record of asking callers to prove they are the account holder. The next fraud attempt may open with “I’m calling on behalf of the account holder,” in a voice that is not human, and nothing in the FCC’s current authentication text says what a carrier should accept as proof. Whoever writes that rule first, a regulator or a court after the first large loss, will probably draw the line on the carrier’s side of the call.