TL;DR — Key Takeaways
- Major U.S. banks are restricting third-party AI agents over concerns about account security, customer consent and potential financial losses.
- Customer permission does not necessarily mean bank approval. Agents using credentials supplied by customers may still violate bank policies.
- Controlled, read-only access offers a potential compromise, allowing agents to analyze financial information while preventing money transfers and other transactions.
Major American financial institutions are scrambling to counter a growing security threat: Unauthorized autonomous artificial intelligence (AI) agents accessing customer accounts and, in some cases, taking actions without user permission.
Top banks including JPMorgan Chase & Co., Bank of America Corp., Wells Fargo & Co., Morgan Stanley, and Citibank are detecting third-party AI tools operating inside their systems, according to a report from Axios. Executives across the sector described the trend as “horrifying,” citing severe difficulties in distinguishing between legitimate human users and autonomous bots.
The security issue stems from software logging into accounts using customer credentials. Banking terms of service strictly mandate that account holders log in personally. However, advanced AI agents have increasingly bypassed detection by altering their browser fingerprints to mimic human visitors.
More critically, financial institutions report instances where agents completed assigned tasks and then began executing unprompted financial actions.
“Rogue agents can create massive issues if they aren’t regulated,” said Snehal Fulzele, founder and CEO of Uptiq AI. “There must be proper governance procedures in place. Having accountability, guidelines for what these agents have access to, and specific instructions on how they operate is imperative to a financial institution’s tech security.”
While a spokesperson for Morgan Stanley said the firm has not identified instances of unauthorized agents accessing its platform, the bank has proactively rewritten terms of service and blocked outside third-party bots. JPMorgan, Bank of America, and Citi have similarly implemented tighter restrictions.
Rather than a total shutdown, many institutions are moving toward structured compromises, such as restricting AI agents to “read-only” access. The protocol permits agents to view financial data for budgeting or analysis while blocking transactional capabilities, such as moving funds.
For example, Charles Schwab Corp. has blocked Meta Platforms Inc.’s newly launched Muse AI agent from executing money transfers, while still allowing it to connect to Model Context Protocol (MCP) servers to read account balances. Meta’s Muse has drawn heavy industry scrutiny within its first two months, prompting blocks from non-banking entities as well, including Amazon.com Inc., Delta Air Lines Inc., Yelp Inc., and major telecom carriers AT&T Inc., Verizon Communications Inc., and T-Mobile US Inc.
Experts note that financial institutions face a delicate balance between mitigating risk and supporting evolving consumer technology.
“Banks have a massive financial incentive to put guardrails around AI agents because, at the end of the day, they’re the ones left holding the bag when fraud occurs,” said Gareth Davies, chief product officer at Auth0, speaking at the Money 20/20 conference. “However, they can’t treat agentic risk like traditional fraud where you shut down suspicious traffic after-the-fact. If they shut down agentic traffic, they shut down the future of commerce.”
Davies emphasized that viable agentic commerce requires banks to verify human intent and enforce real-time, fine-grained access controls specifying exactly what an agent can access or purchase before a transaction occurs.
Anthropic CEO Dario Amodei recently urged the industry to slow down, warning that uncontrolled agents targeting competing platforms or operating without authorization could disrupt internet infrastructure within six to 12 months.
Simultaneously, global bodies like the Bank for International Settlements have warned that rapid AI adoption shrinks the timeframe banks have to patch vulnerabilities before exploitation, driving proposals that range from mandatory AI kill switches to severing advanced models from the public internet entirely.
According to Abhishek Agrawal, co-founder and CEO of Material Security, outright blocking AI agents is impractical because it disrupts the workflows of employees and customers who rely on them. Instead, enterprise leaders must implement proactive defense strategies, granting AI tools only minimal required permissions, continuously monitoring their activity, and instantly revoking access the moment an agent breaches its designated operational boundary.
The scope of this vulnerability is underscored by Material Security’s recent study, “Already Inside: AI Agents Are Accessing Sensitive Data Across Your Google Workspace.” Analyzing security telemetry across 159 organizations, researchers discovered that third-party AI tools possessed active OAuth permissions to a staggering 475 million sensitive Google Drive files and 373 million sensitive emails. The findings highlight a critical gap in visibility, where everyday productivity integrations inadvertently expose vast troves of proprietary data to autonomous agents.
To mitigate these escalating threats, cybersecurity experts emphasize that security and accountability must be designed into AI deployment from the start. Rather than scrambling to respond to data exposure after an incident occurs, forward-looking organizations are shifting toward real-time containment and continuous access governance. By treating AI agents as distinct digital entities requiring strict credential oversight, enterprises can leverage automation without compromising their most critical data assets.
