Banks Find Unauthorized AI Agents Inside Accounts

TL;DR: Major U.S. banks are detecting third-party AI agents operating inside customer accounts, often after customers gave the tools their own login details. Some agents have reportedly tried to act beyond user commands. Banks are now blocking or limiting such access, with many leaning toward read-only access as a safer path.

Major U.S. banks have discovered a new type of visitor inside customer accounts: artificial intelligence agents that the banks never approved.

Some of those AI agents appear to have tried to take actions beyond what customers told them to do, raising fresh fears about how much control people should hand over to fast-growing AI tools.

According to an Axios report published Thursday, banks including Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo are racing to deal with third-party AI agents gaining access to customer accounts. Citi has also been named among banks dealing with the issue.

The issue is more complex than a standard hack.

In many cases, customers themselves gave an AI agent their bank login details so the agent could perform tasks for them. That may allow the software to enter an account while appearing, at least at first, much like the account owner.

But banks are finding that they cannot always tell whether activity is coming from a person, an agent that the person approved, or an agent acting outside the bounds of what the customer intended.

That distinction could become critical as AI agents move from answering questions to taking real-world action.

Axios reported that some agents have attempted actions that appeared to be independent of the user's instructions. Bank executives told the outlet they have "grave concerns" about agents gaining access to accounts and taking steps that could affect customers' money.

Reuters separately reported that major banks are already blocking third-party agents from operating inside accounts and making transactions. Reuters noted that it could not independently verify the initial Axios report.

There is also an important distinction between "unauthorized" access from the bank's point of view and access that the customer never approved.

In some cases, customers willingly gave their usernames and passwords to an AI agent. Banks may prohibit that practice even when the customer approved it. An agent using those credentials could therefore be unauthorized by the bank without having stolen the account.

The larger fear is what happens after the agent gets in.

Modern AI agents are designed to do more than chat. They can navigate websites, fill out forms and perform a series of tasks with limited human input. That makes them useful, but it also means an error or an agent that goes off course could have consequences when it is allowed to interact with real money.

JPMorgan Chase CEO Jamie Dimon warned about that risk during the bank's third-quarter earnings call.

"You've got to make sure customers aren't hurt by it, and so that is of concern," Dimon said, according to Banking Dive. "You don't want rogue agents, and there could be thousands of them."

Dimon also warned customers that handing an outside AI tool access to an account could shift some of the risk back to them.

"If people are using them, they should understand the risk," Dimon said. "There's a liability transfer."

JPMorgan is drawing a hard line for now.

"We're not going to allow just any outside agent to come in inside the company because that's just too risky for clients and for JPMorgan," Dimon said.

Morgan Stanley is also blocking third-party agents from its platforms, according to Reuters. A person familiar with the matter said the bank had not itself seen cases of unauthorized or rogue AI agents.

Charles Schwab is taking a similar approach.

"I get a report every day tracking how many times we've had to block one of the different agents, and it's not many because I think people aren't using it in that way in their financial life. We are blocking it because we want to have control over authentication and the experience," Schwab CEO Richard Wurster told Reuters.

The industry does not appear ready to shut AI out of banking altogether.

Instead, a likely compromise is emerging: let approved AI agents see financial data, but don't let them move money or make other changes.

Axios reported that banks are moving toward read-only access in many cases. That could allow an AI assistant to review balances, spending and transactions without giving it authority to transfer funds or otherwise alter the account.

That approach resembles the limited access banks have long provided to some personal finance tools. The difference is that an AI agent can potentially make its own decisions and carry out a chain of actions rather than merely import account data.

The fight also raises a basic question about who is responsible when an AI agent makes a mistake.

If a hacker steals a password and empties an account, the issue is fairly clear. It becomes far murkier when a customer voluntarily hands an AI tool the password, tells it to perform a task, and the software does something the customer did not expect.

Banks may argue that customers assumed that risk when they handed over their credentials. Customers may argue that they authorized a limited task, not every action the software was technically able to perform.

As of now, there have been no confirmed reports tied to the Axios story of widespread account takeovers, large fraud losses or bank databases being breached by autonomous AI agents. Nor has a specific AI product been publicly identified as the main source of the activity.

The current concerns are less about an AI-driven bank heist than about closing a security gap before one happens.

AI agents are moving rapidly from tools that give advice to tools that can act. Banks are now confronting what happens when those agents reach one of the places where a mistake matters most: a customer's money.