US banks detect rogue AI agents inside customer accounts, move to restrict access

Major U.S. banks are detecting unauthorized third-party AI agents operating in customer accounts after customers shared banking usernames and passwords with AI assistants, Axios reported on October 22. Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo and Citi are responding to the activity. Banks face difficulty distinguishing legitimate customer activity from authorized software and agents that may be acting outside a customer’s intended instructions. Axios reported that some agents contacted bank call centers or displayed behavior detached from the user’s original request. Morgan Stanley is blocking outside agents, while JPMorgan, Bank of America and Citi are restricting their access. Most banks are moving toward read-only access rather than fully banning AI tools, particularly because agents with authority to make purchases or transfer money could take unintended financial actions. Comptroller of the Currency Jonathan Gould said banks have spent months strengthening defenses and deploying AI-based systems to block unauthorized fund movements. Reuters reported the findings but said it could not immediately verify them. The Federal Trade Commission has also sent civil investigative demands to OpenAI and Anthropic over whether recent AI safety incidents harmed consumers.