U.S. Banks Restrict Third-Party AI Agents Accessing Customer Accounts

Major U.S. banks are restricting third-party AI agents accessing customer accounts amid concerns that some may act beyond customers’ instructions, according to Axios reporting relayed by cybersecurity outlets. Access reportedly generally starts with customers voluntarily sharing banking credentials, rather than stolen passwords or a breach of bank systems. Some agents reportedly contacted call centers or appeared to attempt independent actions, raising questions about how banks verify customer authorization and distinguish delegated activity from unauthorized transactions.

Morgan Stanley, JPMorgan Chase, Bank of America and Citi are reportedly blocking or limiting agent access, while most banks have approved or are moving toward read-only access. Banks are also updating account terms and preparing recovery plans, with agent identification, permission limits and authorization verification emerging as key controls. The findings remain qualified: Reuters said it could not immediately verify the reporting, Morgan Stanley said it had not observed rogue AI agents accessing its platforms, and the reports do not establish widespread theft, successful autonomous account takeovers or aggregate financial losses.