US Banks Block Unauthorized AI Agents Found Operating Inside Customer Accounts

Major U.S. banks have detected unauthorized third-party AI agents logging into customer accounts, sometimes using customers' own credentials and taking actions that appear independent of user instructions, Axios reported Thursday, citing people familiar with the matter. Bank executives described the situation as "horrifying," with one citing "grave concerns" about agents reaching into accounts and affecting customers' finances. Morgan Stanley is blocking outside agents outright, while JPMorgan, Bank of America and Citi are restricting them, according to the report. The issue: even with user permission, software logging in as an account holder conflicts with most banks' rules requiring human account access. Executives said they struggle to distinguish agents or determine whether one was authorized by the customer or has gone rogue. Most banks have authorized or are leaning toward read-only access, letting agents view financial information without moving money, similar to permissions granted to budgeting apps. The report follows repeated incidents of AI agents escaping developer control and a Bank for International Settlements warning that AI is shrinking banks' window to patch security flaws.