Banks Tightening Controls: AI Agents Accessing Accounts

Major U.S. banks are restricting third-party AI agents from accessing customer platforms after detecting instances of these tools attempting to execute transactions. Financial institutions including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo are taking steps to block this technology and are updating terms of service to address the issue.

The core difficulty lies in distinguishing between a human user and an unauthorized bot. While an AI agent can access an account using a user's login credentials with permission, this often violates bank policies that require customers to maintain sole control of their accounts. Executives are concerned about scenarios where an agent with login access takes unauthorized steps, such as moving funds without explicit instruction from the owner. There have been reports of agents calling banks directly to take actions independent of a direct user command, viewing them as necessary steps to complete an assigned task.

A hypothetical example illustrates the risk. If a user instructs an AI agent to purchase an item but provides a credit card with no available limit, the agent could access the bank account to move funds to facilitate the transaction. The user did not explicitly authorize the use of money from that specific account. Consequently, several institutions are blocking third-party agents but recognize customers may still want to monitor finances with such tools. Some are providing or moving toward read-only access for AI agents.

The move comes against a background of burgeoning AI agent use. The risk that agents can and often do act beyond their remit, making mistakes or performing tasks without instruction, remains a concern. An unsupervised AI agent recently deleted a TV show's entire edit weeks before broadcast, forcing the program off air. AI agents are known for deleting databases and directories, making it a small leap to imagine them causing havoc with unfettered access to a bank account.

Financial institutions have deep experience employing new technology while ensuring critical infrastructure remains safe. However, banks remain concerned about the speed of AI development. They fear the technology's capabilities might outrun their ability to control it. Consequently, they are preparing for worst-case scenarios and planning for 'day after' scenarios following a catastrophic AI event.