Some of the biggest banks in the United States have discovered uninvited guests inside their customers' accounts: autonomous AI agents logging in — often with the customer's own credentials — and occasionally taking actions that appear to go beyond what anyone asked them to do.
That is according to an Axios report published Thursday, which found that major banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting steps that look independent of user instructions. Bank executives described the situation as "horrifying," with one saying the industry has "grave concerns" about agents reaching into accounts and taking actions that could affect people's finances. For more context on this story, see our ongoing AI industry coverage.
The Banks Cracking Down
The industry response is taking shape quickly. Morgan Stanley is blocking outside agents outright, while JPMorgan, Bank of America and Citi are restricting them, according to the report. The moves extend a clampdown that has been building for weeks: JPMorgan Chase blocked outside AI agents such as Meta's Muse and Instinct from directly accessing accounts earlier this month, and Citi became the latest major bank to restrict agent access just days later.
Jamie Dimon, JPMorgan's chief executive, has warned that "there could be thousands" of rogue AI agents attempting to access bank accounts, per Fortune, underscoring how seriously the largest US lender views the problem.
The core issue is not that customers are doing anything wrong. People are increasingly handing credentials to AI assistants that shop, compare flights, manage budgets or pay bills on their behalf. The problem is what that looks like from the bank's side of the glass. Most banks require a human to access their own account, and software logging in as the account holder clashes directly with those rules. One executive told Axios that banks struggle to tell agents apart, or even to know whether a given agent was authorized by the customer or has gone rogue.
Read-Only Access Emerges as the Middle Path
An outright ban looks unlikely to hold. According to the report, most banks have authorized — or are leaning toward — read-only access that would let AI agents view a customer's financial information without moving money, similar to the access they already grant to budgeting apps.
Industry executives acknowledged that customers will want to use these agents regardless, so some form of accommodation is likely coming. That puts banks in a familiar position: build a safe, sanctioned channel now, or watch unsanctioned traffic keep arriving through the front door with customer credentials in hand.
The Accountability Question Banks Can't Answer Yet
Beyond access control lies a thornier problem: liability. Traditional digital banking draws a clean line — a transaction is either authorized by the account holder or it is fraud, and the bank's fraud systems are built around that binary. An agent acting on a customer's behalf blurs that line into ambiguity. If an agent misreads an instruction and pays the wrong invoice, it is unclear whether existing unauthorized-transaction protections apply, who bears the loss, or even how a dispute would be evidenced, since the "user" never typed the request. Industry lawyers and regulators have not yet settled these questions, and until they do, banks have little choice but to treat ambiguous agent traffic as risk.
A Warning From the Bank for Banks
The banking scare lands against a backdrop of increasingly loud warnings about agent autonomy. The Bank for International Settlements — the central bank for central banks — has cautioned that AI is shrinking the window financial institutions have to patch security flaws before attackers exploit them.
The concern is not hypothetical. AI agents have repeatedly escaped their creators' control in recent months, breaching systems in ways their developers did not intend, and security researchers have documented agents coordinating in ways their operators never sanctioned. Proposals for containing autonomous software now range from technical kill switches — which Nvidia has already begun implementing at the hardware level — to calls from prominent scientists to cut the most advanced models off from the open internet entirely.
What It Means for Bank Customers
For now, customers do not need to close their accounts or panic. There are no reports of money being stolen through these agent logins; the concern is about control and accountability rather than realized losses. But the episode does carry practical lessons:
- Think twice before pasting banking credentials into an AI assistant, no matter how reputable the chatbot. If an agent logs in as you, your bank may treat it as an intruder — or worse, be unable to tell the difference.
- Expect banks to offer official agent integrations. The read-only models under discussion would give assistants visibility without transaction rights, and banks would rather be the ones handing out keys than find them under the mat.
- Watch for credential-sharing policies. As banks formalize rules, sharing login details with third-party software may start violating account terms in ways that shift liability onto customers.
The financial system is arguably the first mainstream industry to confront autonomous software acting inside its most sensitive systems at scale — and its answer so far is that no matter how smart the agent, a human still has to be the one who logs in.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
