Banks found AI agents logging into customer accounts. Executives called it 'horrifying'

There's a new kind of customer logging into America's biggest banks. It has the right password and the right account number, and it might be about to move your money somewhere you never told it to.

Axios reported on Thursday that major US banks are finding third-party AI agents inside customer accounts. Some of the agents log in with the customer's own username and password. Some, according to people familiar with the matter, have tried steps that seem to have nothing to do with what the customer asked for. Bank executives described it to Axios as "horrifying." One said the industry has "grave concerns" about agents reaching into accounts.

The response has been blunt. Morgan Stanley is blocking outside agents. JPMorgan, Bank of America and Citi are restricting them. The Tech Portal, writing up the Axios report, also lists Wells Fargo among the banks that have spotted unauthorized agents.

Who is actually logging in?

The core problem is boring and hard. When someone logs in with valid credentials, the bank sees a valid login. It can't reliably tell whether that's the customer at a laptop, an agent the customer set up on purpose, or an agent that has wandered off script. Most banks' terms of service say the human account holder has to do the logging in, so even an agent the customer happily approved is breaking the rules.

Several banks are war-gaming the worst cases, according to the reports, including how fast they could lock down or restore an account after an agent does something damaging. That's the part customers should sit with for a minute. Say an AI assistant you gave your password to moves your savings to the wrong place. Who pays? The bank never approved the agent. The company that built the agent has its own terms of service. And you're the one who typed your password into it.

Jamie Dimon has been warning about this for weeks. On JPMorgan's third-quarter earnings call on October 13 he said, "You don't want rogue agents, and there could be thousands of them." He also pointed to "the liability transfer" that happens when customers bring in outside agents. A JPMorgan spokeswoman told CNBC that outside agents can't act on a customer's behalf or log in with their credentials. They can see balances, read-only, if the customer connects through a service like Plaid. They can't send money or pay bills, and the bank hasn't said when that might change.

Dimon's reasoning on the call was simple: "We're not going to allow just any outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan." Look at who is saying it, though. Dimon also said JPMorgan uses AI agents internally and plans to put them in front of customers. The bank is happy with agents. It just wants them to be its own.

Look, don't touch

Read-only is where most of the industry seems to be heading for now. Budgeting apps have lived with that deal for years. An agent can tell you that you spent too much on takeout last month. It can't move a cent.

That's a long way from what the agent makers are selling. Meta's Muse launched with commerce partnerships with Stripe, PayPal and Shopify, because an assistant that can pay for things is the whole pitch. It has already hit a wall elsewhere. In September Amazon blocked Muse from its marketplace, saying the agent "appeared to capture and store customer credentials," according to PYMNTS.

When PYMNTS tested Muse itself, the agent couldn't shop on Amazon or Walmart until the tester shared account credentials through a secure link, and payment ran through Stripe's Link wallet. That's the pattern in miniature. The agent is only as useful as the keys you hand it, and every set of keys is one more thing to steal.

Plenty of people seem willing to hand them over anyway. PYMNTS Intelligence found that 35% of consumers would let an AI agent get at their saved payment credentials, against 56% who would let one search and compare products. That's a big minority ready to trust software with their money before the banks, the regulators or the agent makers have agreed what happens when it goes wrong. And the window for getting it right is shrinking: the Bank for International Settlements has warned that AI is cutting the time banks have to patch security flaws.

The banks have a less noble reason to care too. The reports note that agents with real account access could steadily shift customers' idle deposits into higher-yield products somewhere else. Money that sits still in a checking account is cheap money for a bank. An agent that chases the best rate every week is a problem for the bank even when it does exactly what the customer wanted.

So there are two fights tangled together here. One is about safety: rogue software with your password. The other is about who controls the customer. Banks would rather nobody noticed how neatly the first argument serves the second.

No losses reported, so far

None of the coverage so far describes a customer actually losing money to a rogue agent, and the people behind the Axios story aren't named. But the agents are already inside the accounts, and the banks' own rules say they shouldn't be there. Someone is going to have to write the liability rules before an agent writes the test case.

Sources: Axios: Unvetted AI agents are accessing U.S. bank accounts, Decrypt (via Yahoo Finance): Major banks find rogue AI agents inside customer accounts, The Tech Portal: Major US banks find AI agents inside customer accounts, PYMNTS: Jamie Dimon slams the door on rogue AI agents.