Major U.S. banks are restricting third-party artificial-intelligence agents after detecting or investigating automated access to customer accounts, with some tools reportedly attempting actions beyond what users appeared to request. The findings highlight a difficult boundary for banks: a customer may give an AI assistant their credentials, but that does not necessarily make the software an approved banking user or authorize it to transfer money.
An October 22 investigation by Axios, subsequently reported by Reuters, named Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo among institutions confronting the issue. Citigroup and other banks are also limiting third-party agent access. The reports do not establish that all of the named institutions have suffered a confirmed account compromise, that an agent successfully transferred customer money without permission or that any identified bank has incurred financial losses.
The more immediate development is a policy and security response to AI tools capable of navigating a website, interpreting account information and carrying out instructions. Unlike a conventional budgeting application with controlled data access, a general-purpose agent using a customer’s password may be able to interact with buttons, forms and customer-service channels that were designed for people.
What Did Axios Find About AI Agents Inside Bank Accounts?
In its October 22 investigation, Axios said sources familiar with the matter described instances of third-party agents entering customer accounts with credentials supplied by the customers themselves. Most banks’ terms and security expectations require the customer, rather than an outside automated system, to log in directly.
The publication also reported examples of automated agents contacting call centers or appearing to perform actions independently of user instructions. The wording matters: activity that appears independent is not the same as a forensic finding that the software intentionally disobeyed an authenticated instruction. Bank systems may struggle to determine exactly what a user asked an agent to do.
Axios reported that some banks are aware of unauthorized access, but it did not publish a confirmed number of affected accounts, specific unauthorized transfers, named AI providers responsible for these incidents or a total value of customer funds at risk. Reuters said it could not independently verify the Axios report.
Morgan Stanley’s response illustrates why broad statements about a banking breach would be misleading. Sources told Axios the company had started blocking third-party agents, while a bank spokesperson said it had not observed rogue AI agents accessing its platforms. Those points can coexist: precautionary restrictions do not prove a successful rogue-agent incident at that institution.
The reported concerns extend to the possibility that a tool with purchasing or transfer permissions could take a financially consequential step. But the available reporting does not establish that any of the named banks lost deposits because an AI agent independently initiated an unauthorized payment.
Which Banks Are Restricting Third-Party AI Access?
Axios reported that Morgan Stanley is blocking third-party agents and that JPMorgan Chase, Bank of America and Citigroup are also restricting access. Wells Fargo was among banks described as dealing with the emerging risk, but the investigation did not describe an identical technical control or confirmed incident at each institution.
The response fits a broader trend that was visible before October 22. In remarks surrounding third-quarter earnings, JPMorgan chief executive Jamie Dimon warned about the danger of unapproved external AI agents accessing customer accounts. Bank of America executives have discussed keeping a person involved when an automated service seeks to move money.
Citigroup has said it does not permit third-party AI agents or assistants to log in or transact through its digital banking platforms, while continuing to allow certain approved, limited forms of account-data sharing. This is a distinction between blocking credential-based automation and prohibiting all third-party financial software.
The policies may also reflect a competitive tension. Banks have strong reasons to protect payment authorization and customer credentials, but unrestricted agents could also help depositors rapidly compare interest rates and move funds to competing institutions. That potential effect on deposit retention is an incentive worth examining, not proof that the security concerns are merely a pretext.
What investors cannot yet calculate is the financial cost of the restrictions. The companies have not supplied verified figures for accounts blocked, legitimate agent sessions rejected, fraud losses prevented or revenue affected by new access controls.
Why Can a Customer-Approved Agent Still Be Unauthorized?
Traditional online banking generally authenticates a person through credentials and sometimes additional verification. If that person hands their username and password to a general-purpose AI service, the bank may see a valid login even though the session is being operated by software that has not been approved for account access.
There are two separate questions: did the customer consent to using the tool, and did the bank authorize the method and scope of access? Consent to share credentials cannot necessarily override platform rules, and it may not define whether the agent is permitted to transfer funds, change beneficiaries or communicate with a representative.
An agent asked to find the highest-paying savings account, for example, might only need read-only access to balances and account terms. If it also has access to transfer forms, a misunderstood instruction or poorly bounded plan could lead it toward a payment action the user never explicitly approved. That is a risk scenario, not a documented transfer from the Axios investigation.
Another difficulty is attribution. Automated browsers can mimic ordinary user behavior, while a real customer’s use of a computer can look automated. Blocking every rapid or scripted interaction could disrupt accessibility tools, legitimate financial software and customers who use permitted automation.
As DaveFinances previously explained in an analysis of behavioral biometrics, valid login credentials alone do not prove that the behavior within an authenticated session is normal or authorized. Banks nevertheless need reliable criteria before labeling a session suspicious.
Why Are Banks Moving Toward Read-Only Access?
Several institutions are considering or already allowing AI tools to retrieve account information without gaining the ability to initiate transactions. Similar arrangements exist in established open-banking services, where a customer can authorize an application to view selected data without revealing their main banking password to that application.
A narrowly scoped connection may specify which accounts and categories of information a provider can access, whether it can initiate payments, how long permission lasts and how the customer can revoke it. This provides a clearer boundary than telling an assistant to log in as the user and act on whatever interface appears.
Read-only access does not eliminate privacy risks or the possibility that sensitive data will be mishandled. It does, however, separate a request for information from authority to spend or move money. When an agent proposes a transfer, the bank could require a distinct approval through its own trusted customer interface.
The challenge is that an agent can also generate a plausible instruction that the account holder misunderstands or approves without checking. Permission design therefore needs explicit transaction amounts, destinations, expiration limits and audit logs, rather than relying on a broad claim that a customer authorized an AI assistant.
Bank-built AI applications may operate under different conditions. For instance, Q2’s AI assistant for financial institutions was presented as an internally controlled workflow with activity logging and human oversight of consequential actions. That is not evidence that a Q2 product caused the current access concerns.
What Are Regulators Asking Banks About Autonomous AI?
The latest reports follow growing scrutiny from U.S. banking supervisors. An October 13 Reuters investigation said the Federal Reserve, Office of the Comptroller of the Currency and Federal Deposit Insurance Corporation were questioning firms about controls over autonomous agents, monitoring, human approval and methods for stopping misbehaving systems.
Those regulatory inquiries also covered banks’ own use of AI, including cybersecurity automation, rather than only independent consumer agents trying to enter digital accounts. The two areas share a need to define permitted actions and maintain records of who, or what, made a decision.
Liability remains unresolved in many consumer scenarios. If a customer shares credentials, an agent misinterprets a request and money leaves an account, the outcome may depend on how the transaction was authorized, the applicable law, bank policies and the relevant provider’s contract. No single public statement establishes that consumers automatically bear every loss involving AI.
The security concerns are also different from malicious agents used as hacking tools. In an October 19 investigation of automated attacks on more than 1,200 websites, agents were reportedly directed toward unauthorized intrusion. The present banking problem can begin with a customer voluntarily giving access to software that is not an approved participant in the bank’s systems. There is no verified link between the two incidents.
What Should Customers and Investors Watch Next?
For customers, the practical question is what an AI assistant can actually do after it receives account access. Sharing a password or one-time verification code with an unapproved outside tool can create risks that do not arise when using a bank-supported, read-only connection. A tool’s ability to summarize balances is not proof it should be allowed to send payments or modify security settings.
For banks, the next disclosures to watch include documented cases of customer harm, explicit policies for approved AI services, controls over payment initiation and consistent ways to distinguish legitimate delegated access from suspicious account activity. Recovery procedures will also matter if agents initiate disputed actions or lock users out during containment.
The commercial stakes extend to financial technology providers building agentic payments. A product that can obtain useful data but cannot complete an approved transaction offers only part of the promised convenience. Conversely, a product that can spend without clear boundaries may fail bank security reviews, regardless of customer enthusiasm.
As of October 22, the verified development is that major banks are taking steps to restrict unvetted agents while Axios sources describe troubling account activity that Reuters has not independently corroborated. No public evidence in these reports establishes a coordinated bank breach or confirmed financial losses. The lasting issue is whether banks can create a practical, auditable way for customers to delegate limited tasks without surrendering control of their money.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574