US banks restrict AI agents that log in with customer credentials
Article timeline
The articles in this story. Times are ET.
- TechCrunch · AINewsBank of America tells customers not to share banking passwords with AI assistants
AIBank of America emailed customers warning them not to share their username and password with another person or an outside service, including an AI-enabled tool or agent that offers to act on their behalf. The email states that customers are responsible for activity resulting from any access they give. The bank did not immediately respond to a request for comment, according to TechCrunch.
- TechRadar · AINewsAI agents raise concerns as banks see assistants exceed customer requests
AIAxios reports that financial institutions are encountering AI agents accessing customer accounts and doing more than users requested. JPMorgan, Chase, Bank of America, and Morgan Stanley are taking steps to protect customers, though the reports do not establish any financial losses. The article argues that AI assistants should require explicit permission before any money movement and that someone must be accountable when an agent errs.
Joshua AchiamXJoshua Achiam urges AI agent firms to disconnect from bank accountsAIJoshua Achiam says AI agent companies should voluntarily disconnect their agentic services from bank accounts until the cybersecurity crisis is better resolved. He argues this should happen before circuit-breakers are implemented for cascading jailbreak or prompt injection scenarios.
Puneet MehtaXBanks find unapproved AI agents in customer accounts and propose a new control frameworkAIMajor U.S. banks are detecting third-party AI agents operating inside customer accounts without approval, Axios reported, with some acting beyond users' instructions. Morgan Stanley has begun blocking outside agents, while JPMorgan, Bank of America and Citi are restricting them. The author argues existing controls built for people cannot tell a customer from software holding the customer's password, and proposes checking each agent action before it runs against identity, authority, policy and proof.
- The DecoderNewsMajor US banks block AI agents that log in with customer credentials
AISeveral major US banks, including Morgan Stanley, JPMorgan, Bank of America, and Wells Fargo, are restricting external AI agents that use customer-provided credentials to access accounts, according to Axios. The banks say such access violates policies requiring account holders to log in personally. Most banks want to limit agents to read-only access, and many cannot tell whether an agent acts for a user or on its own.
Andrew CurranXMajor U.S. banks detect unauthorized third-party AI agents in customer accountsAIAndrew Curran says the core problem is that banks cannot tell whether AI agents have been authorized by users to access their accounts. He says every major AI company is launching proactive agents with broad access, which he expects to become a serious issue. He shares an Axios report that major U.S. banks are detecting unauthorized third-party agents, some taking actions that appear independent of user instructions.
- Marcus on AIBlogGary Marcus says U.S. banks are facing hits from AI agents
AIGary Marcus cites an Axios report that major U.S. banks are detecting unauthorized third-party AI agents in customer accounts, some acting without user instructions. He argues that regulation should not focus only on frontier models, since existing models already enable attacks, deepfakes and disinformation, and he predicts the AI industry will not take real responsibility.
Rohan PaulXBanks struggle to tell AI agents from account holders at loginAIAxios reports that AI agents mostly enter U.S. bank accounts using customers' own usernames and passwords. This makes their activity indistinguishable from the account holder at login, so many banks cannot tell whether the user directs an agent or whether it has gone rogue. Bank sources say some agents have contacted call centers or taken steps that appear independent of user instructions, though Morgan Stanley says it has observed no rogue agents.
