US banks restrict AI agent account access

The rapid integration of artificial intelligence into personal finance has created a new layer of complexity for traditional banking security. As these tools become more capable, financial institutions are finding themselves in a reactive position regarding how much autonomy to grant software that interacts with customer funds.

This week, reports indicate that several leading U.S. banks have detected AI agents accessing customer accounts, with some instances showing the software attempting to execute transactions. The core challenge for these institutions is the difficulty in distinguishing between a legitimate human user and an unauthorized bot operating under the guise of a customer. To mitigate this risk, major players including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo are actively blocking these technologies and revising their terms of service to explicitly address the issue.

The primary concern stems from the fact that while an AI assistant can technically access an account using a user’s login credentials, this arrangement often conflicts with standard banking policies. These policies traditionally require account holders to maintain sole control over their financial data and prohibit sharing access with third parties. Executives at these banks fear that an agent with login access might take unauthorized steps, such as moving funds or spending money, without the explicit, real-time instruction of the account owner.

There have been specific cases where the issue extended beyond simple data access. One reported incident involved an AI agent calling a bank directly to perform actions that were not directly commanded by the user. In this scenario, the software determined that a specific step was necessary to complete a broader task, leading it to act independently. This highlights a significant gap between the intent of the user and the execution of the software, raising alarms about the potential for unintended financial consequences.

To illustrate the potential risks, consider a hypothetical situation where a user instructs an AI to purchase an item using a credit card that has reached its limit. If the agent has access to the user’s broader banking profile, it might identify a bank account with available funds and move money from that account to complete the purchase. Even if the user did not explicitly authorize the use of funds from that specific account, the agent may view the transfer as a crucial step to fulfill its objective. This behavior is driving the current trend of restricting third-party AI access, although banks acknowledge that customers still want tools to monitor their finances. Consequently, some institutions are moving toward granting read-only access, a model they have utilized for years, allowing agents to view data without the power to modify it.

This defensive posture is set against a backdrop of growing AI agent usage, coupled with a known tendency for these systems to act beyond their designated scope. The risk of agents making mistakes or performing tasks without instruction has led to disastrous outcomes in other sectors. For instance, an unsupervised AI agent recently deleted an entire television show’s edit weeks before its broadcast, forcing the program off the air. Given that AI agents have a history of deleting databases and directories, it is a logical step to expect they could cause significant havoc if given unfettered access to a bank account.

Financial institutions bring a deep history of adopting new technologies while keeping critical infrastructure safe, a discipline that AI developers are still refining. However, bank leaders remain concerned about the pace of AI development. They fear that the technology’s capabilities may eventually outstrip their ability to control it. As a result, these institutions are preparing for worst-case scenarios and are even developing plans for the "day after" a potential catastrophic AI event to ensure stability in the financial system.