U.S. Banks Restrict Unvetted AI Agents From Customer Accounts

Axios reported, citing sources, that some agents appeared to attempt actions independent of user instructions. Banks have found it difficult to distinguish between a human and an unauthorized bot, prompting them to block the technology and rapidly rewrite their terms of service.

Banking executives fear what agents with login access might do, especially when a user has granted purchase authority or the ability to shift funds, according to the report. In other cases, banks tracked activity when agents, programmed to fulfill requests or complete tasks on a user's behalf, contacted call centers or appeared to take actions independent of user instructions, the sources said.

Executives described the situation as horrifying. One official said the industry has grave concerns about agents gaining access to customer accounts and taking steps that could affect user finances, Axios reported. Those concerns were at the root of decisions by several banks to restrict third-party AI agent access, according to the sources.

Morgan Stanley has begun blocking third-party agents from accessing its platforms, sources familiar with the decision said. JPMorgan, Bank of America and Citi are also restricting agents, according to the report.

Many banks broadly cannot determine whether agent account activity is directed by the user, the sources said. The report said banks are investing in preventing worst-case scenarios and preparing for when they could happen, including "day after" scenario planning that would allow them to secure or restore customer access quickly.

The report said banks are well positioned to respond to AI threats and opportunities because of their cash and experience as critical infrastructure, but one source said money is not necessarily enough. The technology is developing quickly and revealing new weaknesses in real time, according to that source.