Major U.S. Banks Detect Unauthorized AI Agents Operating Inside Customer Accounts
Major U.S. banks are detecting third-party AI agents accessing customer accounts, potentially acting beyond user instructions, raising concerns about unauthorized actions and credential management.
Major U.S. banks are increasingly detecting third-party AI agents operating within customer accounts, sparking concerns that these automated tools may be acting beyond the scope of user instructions. Institutions such as Morgan Stanley, Bank of America, JPMorgan Chase, and Wells Fargo are actively working to contain the potential risks associated with these agents, some of which have reportedly contacted bank call centers or attempted to initiate independent actions. This emerging threat landscape highlights a significant challenge for financial institutions: distinguishing between legitimate user activity, approved tool access, and unauthorized agent actions, especially when agents retain credentials.
The primary vector for these unauthorized accesses appears to be customers sharing their banking usernames and passwords with AI assistants. While customers may grant permission for these agents to interact with their accounts, banks often do not approve such arrangements, as they typically conflict with terms of service requiring customers to log in themselves. This distinction is critical, as unauthorized AI access does not necessarily imply a breach of the bank's security systems or stolen credentials. Instead, it suggests customers may have inadvertently created a gap between their intended permissions and their bank's policies.
The concern escalates when these AI agents are granted permissions to perform financial transactions, such as making purchases or moving money. Bank executives fear that tools with such capabilities could inadvertently take actions that customers did not intend, leading to financial loss or account compromise. While reports have detailed attempted actions and concerns, they have not confirmed widespread theft or disclosed specific financial losses. The core technical hurdle for banks lies in accurately attributing account activity to clear human intent, a task made difficult by the nature of automated agent actions.
Banks are struggling to differentiate between various AI agents and to verify whether their actions align with user directives. The reported instances of agents contacting call centers further complicate matters, as this automated activity can extend beyond the bank's website or mobile application. This situation is compounded by broader concerns about dormant AI agents retaining credentials, as highlighted by research indicating that many inactive agents continue to hold working credentials, even when no longer actively used. This underscores the persistent risk of permissions outlasting active use.
In response, several major banks have begun to implement stricter controls. Morgan Stanley has reportedly started blocking third-party agents, while JPMorgan, Bank of America, and Citi are also restricting access. These institutions are updating their terms of service and policies to address the challenges posed by AI tools that existing account rules were not designed to accommodate. It is important to note that some bank statements, such as Morgan Stanley's claim of not observing "rogue AI agents accessing our platforms," should be interpreted within this context, emphasizing the need for customers to avoid sharing credentials with external AI tools.
Many banks are moving towards or already supporting read-only access for third-party tools. This approach allows these tools to view financial information without executing transactions, similar to existing connections for services like Quicken. This offers a pathway for useful automation while mitigating the risk of direct control over customer funds. This is distinct from criminal activity where threat actors use AI for malicious purposes, such as AI-assisted attacks against financial organizations, which involves deliberate cybercrime rather than poorly controlled automation.
The overarching message for customers is to adhere to their bank's access rules and refrain from sharing banking passwords with outside AI tools. For financial institutions, the challenge extends beyond simply blocking unauthorized bots. They must develop robust methods for identifying AI agents, enforcing granular permissions, and reliably determining customer approval for specific actions. Banks are also preparing recovery plans to secure or restore customer access in the event of incidents. The emerging issue is not merely about AI gaining access to accounts, but about banks' ability to effectively control and monitor subsequent actions.