Field Note: Digging into Banco Santander's AI Tooling

Two years ago, around thirty million Santander customers had their records put up for sale on a hacking forum: names, card numbers, and more. The cause was a contractor’s cloud account that didn’t have two-factor login (2FA) switched on. Now, two years later, that same bank has published a set of its AI tools as open source, in a verified GitHub organisation called SantanderAI.

The repositories are Apache-licensed, and you can clone and run them yourself. I read through them. A few notable ones are below.

​mutatis-mutandis tests decisions for discrimination. It implements a method called situation testing: take a decision, like a loan refusal, and check whether it would have changed if you altered one protected characteristic about the person and held everything else equal — same income, same history, a different gender, age, or nationality.

It also includes a counterfactual variant, which runs the same check against a synthetic “twin” of the person with the protected detail flipped.

The code accompanies a research paper and is built against the German Credit dataset, a public benchmark of 1,000 real loan records collected from a German bank in the 1970s. That dataset is the standard test bed for this work because it ships with the protected attributes built in: age, sex, and a column labelled “foreign worker.”

The method applies beyond banking, to anywhere a model makes decisions about people: hiring, insurance quotes, who gets flagged for extra medical care. A widely used US hospital algorithm was found to refer far fewer Black patients for extra care than it should have, because it used past spending as a proxy for how sick someone was. mutatis-mutandis runs that kind of test.

​autoguardrails works on a different problem: making an AI system harder to jailbreak. It searches over a written safety policy and keeps a change only when attacks succeed less often, with a floor that stops it from “winning” by refusing everything.

Alongside it, the lab has published a genetic-algorithm engine it describes as the search core of a self-improving AI loop — generate candidates, score them, keep the best, repeat. The lab has published both the self-improvement engine and the jailbreak controls.

​gen-fraud-graph generates synthetic transaction networks — up to 100 million accounts, with money-laundering rings built in — so a fraud detector can be trained without touching real customer data.

These are the lab’s research repositories, run on public datasets. They do not include Santander’s own live credit models.

But above all the tooling, the organisation also publishes its governance document, the rulebook every repository follows before going public.

It requires two-factor login for everyone — the control missing from the contractor’s account in 2024 — along with the revocation of a departing employee’s access keys within twenty-four hours, and secret-scanning that stops a bad commit before it is pushed. Each repository carries the matching automated checks: code scanning, dependency and licence scans, an OpenSSF Scorecard.

The openness has a commercial side. As mentioned yesterday, Google open-sourced its Open Knowledge Format last week and connected it to a paid product on the same day. A bank publishing open source serves its own interests too: hiring, reputation, and a say in how these tools get built.

Banks have shared security intelligence with each other for two decades through bodies like FS-ISAC, but that sharing happens privately, between members. Publishing the working code openly, where anyone can read it, is the more recent step.

On security especially, that openness counts. A problem solved in the open is solved once, for everyone — and a field that shares its work moves faster, and gets farther, than one where everyone works alone in silos.

- Jim