Several leading US banks have detected artificial intelligence agents accessing customer bank accounts after users voluntarily share login credentials, prompting urgent measures to curb unvetted third-party agent activities.
- Customers often share bank credentials with AI assistants, risking unauthorized account access.
- Banks struggle to differentiate between human and AI-driven transactions.
- Institutions are enforcing restrictions and preparing to block rogue AI agent activity.
What happened
US banks have detected multiple cases where AI agents, acting on behalf of customers, accessed bank accounts using shared credentials. These AI tools perform workflows that users have delegated to them, but the banks often cannot distinguish between actions authorized by humans and those executed autonomously by AI. This has triggered heightened scrutiny among top financial institutions including Morgan Stanley, JPMorgan Chase, Bank of America, Citigroup, and Wells Fargo.
While these AI agents are not breaching systems through hacking or external attacks, the main risk stems from customers voluntarily sharing sensitive login information with them to automate banking tasks. Such practice frequently violates bank policies requiring direct customer login and complicates institutions’ ability to secure accounts and manage liability for unauthorized activities.
Why it matters
The involvement of AI agents in banking transactions presents new security risks for both customers and banks. With AI autonomously handling sensitive financial data and account access, traditional security measures and customer authentication protocols face unprecedented challenges in monitoring and controlling account activity.
Moreover, the unclear liability framework around AI-driven account actions raises significant concerns. Banks are unsure who is responsible if an AI agent mishandles funds or executes incorrect transactions, complicating responses to potential fraud or errors. This uncertainty places banks at risk of financial and reputational damage while highlighting regulatory and operational gaps.
What to watch next
Banks are expected to intensify efforts to restrict and monitor third-party AI agent access, incorporating real-time authentication controls and daily review processes to detect unauthorized AI activity. Executives like Charles Schwab's CEO have emphasized the need for daily reporting on blocked AI agents to maintain control over account security and customer experience.
In addition to tightened access controls, banks are likely preparing rapid incident response capabilities designed to suspend and restore accounts quickly in the event of AI-related breaches or misuse. How regulators respond to these new AI risks and whether clearer liability guidelines emerge will also be crucial to shaping how the banking sector manages AI integration moving forward.