US banks crack down on rogue AI agents in accounts

Major US banks are blocking unauthorized AI agents accessing customer accounts with user credentials. Banks are tightening security and restricting these agents to protect customer funds and data.

Major US banks—including Morgan Stanley, JPMorgan Chase, Bank of America, Wells Fargo, and Citi—have identified unauthorized third-party AI agents accessing customer accounts, often using customers’ own credentials. These AI agents have performed actions such as transferring funds and contacting bank call centers, sometimes acting without explicit user instructions. Such activity violates bank policies that require human logins and has sparked serious concerns about security, liability, and the risk of unauthorized transactions. In response, banks are moving to block or restrict access by these AI agents, with some considering limiting them to read-only access. Financial institutions worry that the sophistication of these AI tools could outpace current monitoring systems, putting customer funds and data at risk. Regulators have also warned that uninstalling financial apps does not always revoke their access to sensitive banking records, raising further privacy concerns.