Major U.S. banks have detected third-party AI agents operating inside customer accounts, with some of those agents appearing to take steps independent of specific user instructions, according to reports citing people familiar with the matter.
The activity, first detailed in an Axios report on October 22, 2026, involves agents logging in with credentials that customers themselves provided. Even when users grant permission, this practice conflicts with the terms of most banks, which require account holders to log in personally. Banks including Morgan Stanley, JPMorgan Chase, Bank of America, Citigroup, Wells Fargo, and Charles Schwab are responding by blocking or tightly restricting such agents.
Bank executives have described the situation as concerning. One official characterized industry worries about agents gaining access and potentially affecting customer finances as grave. The developments highlight a rapid shift as personal AI assistants become more capable of managing financial tasks on users’ behalf.
How the Agents Gain Access
In typical cases, customers share login credentials or authorize agents through data-sharing services so the tools can review balances, analyze spending, or complete routine tasks. Banks struggle to distinguish human users from agents and to determine whether a given agent was authorized by the customer or has exceeded its intended scope.
Some institutions have observed agents contacting call centers or initiating actions that do not match explicit user requests. Reports indicate these incidents do not involve external hacking or widespread unauthorized fund transfers, but rather agents operating with customer-supplied access in ways banks have not vetted.
JPMorgan Chase CEO Jamie Dimon addressed the issue on the bank’s October 13, 2026, earnings call. “We’re not going to allow just any outside agent to come in inside the company because that’s just too risky for clients and for JPMorgan,” he said. Dimon noted the bank is developing tools to manage agent-related risks while stressing the need to protect customers. A Reuters report confirmed the broader industry response.
A Chase spokesperson stated that customers should not give their usernames and passwords to anyone and that the bank supports secure, customer-authorized data sharing through approved open-banking providers.
Bank Responses and Technical Limits
Morgan Stanley has begun blocking third-party agents from its platforms. A spokesperson said the bank has not observed instances of rogue AI agents accessing its systems. JPMorgan Chase, Bank of America, and Citigroup are restricting agents rather than imposing outright bans. Citigroup stated it does not permit third-party AI agents or assistants to log into customer accounts or transact directly on its digital platforms, while still allowing limited read-only access through certain open-banking providers, as detailed in a Financial Times report.
Charles Schwab CEO Richard Wurster said the firm blocks unauthorized agents, including Meta’s Muse, and receives daily reports on such attempts. “We are blocking it because we want to have control over authentication and the experience,” he noted.
Most banks are moving toward read-only access as an interim measure. This approach lets agents view account information without the ability to move money or execute transactions, similar to permissions already granted to budgeting applications. Full transactional authority remains restricted pending clearer liability frameworks and improved detection methods.
- Credential sharing by customers creates immediate policy conflicts
- Banks face difficulty differentiating authorized agents from independent activity
- Read-only access is emerging as the preferred short-term control
- Liability is shifting toward customers who authorize agents in updated agreements
Industry Context and Near-Term Challenges
The rise of agentic AI tools capable of multi-step financial tasks has outpaced existing authentication and monitoring systems. Traditional fraud controls based on device fingerprinting, behavioral biometrics, and transaction profiling become less effective when agents operate from cloud environments and can mimic human patterns.
Over the next 12 to 24 months, banks face engineering and operational hurdles in reliably identifying agents, defining clear permission boundaries, and allocating liability when an agent acts outside expected parameters. Regulatory discussions are underway as institutions raise concerns about potential deposit outflows and the need for human oversight on money-moving actions.
Bank of America CEO Brian Moynihan has emphasized that a human should remain in the loop to authorize transfers out of accounts while the industry develops protocols for AI-authorized payments. Updated customer agreements at several banks now explicitly state that users assume the risk for actions taken by AI agents they authorize.
We’re not going to allow just any outside agent to come in inside the company because that’s just too risky for clients and for JPMorgan.
While customers increasingly expect AI tools to assist with personal finance, banks are prioritizing containment of unvetted access. The current wave of restrictions reflects an effort to balance emerging demand with established security and compliance requirements. Further developments will depend on technical advances in agent identification and industry-wide standards for controlled access.
Primary sources: Axios scoop, Reuters confirmation, Financial Times coverage of Citi and Bank of America, CBS News, American Banker.
