Major Banks Find Rogue AI Agents Inside Customer Accounts—And They’re 'Horrified'

Major U.S. banks have discovered an uninvited presence inside their customers' accounts: autonomous AI agents logging in, sometimes with the customer's own credentials, and occasionally taking actions that appear to go beyond what anyone asked them to do. The situation has prompted executives to describe it as 'horrifying,' with one stating the industry has 'grave concerns' about agents reaching into accounts and potentially affecting people's finances.

Banks respond with restrictions

The banks are moving to address the security concern. Morgan Stanley is blocking outside agents entirely, while JPMorgan, Bank of America and Citi are implementing restrictions. The challenge stems from the fact that even when a user grants an agent permission, having software log in as the account holder violates most banks' rules requiring humans to access their own accounts.

The industry has 'grave concerns' about agents reaching into accounts and taking actions that could affect people's finances.

Read-only access considered

Rather than banning AI outright, most banks are leaning toward a middle path of read-only access. This would allow agents to view customer financial information without moving money, similar to permissions already granted to budgeting apps. Industry executives acknowledge that customers will want to use these agents, so some accommodation is likely coming.

Wider AI security concerns

The banking issue reflects broader concerns about AI agents acting independently. The Bank for International Settlements has warned that AI is shrinking the window banks have to patch security flaws before attackers exploit them. Solutions being considered range from an AI 'kill switch'—which Nvidia has begun implementing—to calls from scientists to disconnect advanced models from the internet entirely.