US banks warn of unauthorised AI agents accessing customer accounts, report says

Major US banks are reportedly detecting unauthorised third-party AI agents operating inside customer accounts, raising concerns that automated tools could access financial information or attempt actions beyond what users intended.

According to Axios, which cited people familiar with the matter, Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are among the institutions working to contain risks linked to AI agents. Some tools reportedly accessed accounts using login credentials supplied by customers, while certain behaviour appeared to go beyond user instructions. Banks are now tightening controls, with some restricting third-party AI agents to read-only access. This allows them to view financial information without being able to move money or make purchases.

Why Are US Banks Worried About AI Agents?

Unlike traditional chatbots, AI agents can carry out tasks using connected applications and online services. Depending on the permissions they receive, they may be able to retrieve information or take actions on a user's behalf. That creates a potential problem when an agent has access to a bank account. Executives are concerned about what could happen if a tool attempts an unintended transaction, misinterprets an instruction or acts without the customer's knowledge.Banks are also reportedly struggling to distinguish human customers from AI agents and establish whether an agent has been authorised by the account holder. According to Axios, even when customers provide their login credentials voluntarily, using third-party tools in this way can violate banks' account-access rules.

JPMorgan, Bank Of America And Wells Fargo Tighten Controls

Several banks are reportedly limiting third-party AI agents to read-only access. Such restrictions can allow customers to use AI tools to review financial information while preventing those tools from directly controlling funds. The approach reflects the challenge facing financial institutions: customers may want AI assistants to help organise their finances, but banks must protect accounts from unauthorised access and potentially harmful actions. A Morgan Stanley spokesperson told Axios that the bank had not seen instances of “rogue AI agents accessing our platforms”. The investment bank is nevertheless among the institutions restricting third-party AI agent access, according to the report. The reported concerns do not mean that all AI agents are malicious or that customer funds have been stolen.

Could AI Agents Move Money Without Permission?

The key risk is what an AI agent might do when given permission to interact with financial services. An agent designed to help with spending or payments could pose a greater risk if it receives broader permissions than necessary. Banking executives are reportedly preparing for worst-case scenarios, including ways to secure or restore customer accounts if an AI tool behaves unexpectedly. For customers, the practical lesson is to be careful when connecting AI assistants to financial accounts. Avoid sharing banking passwords with third-party tools, review account permissions and enable transaction alerts where available. Banks and AI developers will need to establish clearer safeguards before automated assistants can safely handle more sensitive financial tasks.