Major U.S. banks are detecting unauthorized AI agents operating within customer accounts, according to an Axios report citing people familiar with the matter. The agents are attempting to take actions that appear to be independent of users’ instructions.
The report said banks including Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo are racing to contain the risk.
Morgan Stanley has begun blocking third-party AI agents from accessing its platforms, according to reports. JPMorgan Chase, Bank of America and Citigroup are also restricting such access. A Chase spokesperson advised customers against sharing their login credentials with others.
Meanwhile, a Morgan Stanley spokesperson told the Times of India that the bank had not observed instances of “rogue AI agents accessing our platforms.”
READ: OCC says nine largest US banks engaged in debanking practices (October 14, 2026)
Bank executives are particularly concerned about AI agents authorized to make purchases or transfer funds. Such access could expose customers to financial losses if the technology acts beyond their instructions.
Many banks are considering allowing third-party AI agents to have read-only access, enabling them to retrieve customers’ financial information without conducting transactions. Banks already provide similar access to third-party applications, including budgeting services such as Quicken.
Despite security concerns, banks recognize that customers are increasingly using AI agents for banking. They are therefore seeking ways to accommodate the technology while preventing unauthorized access.
A Financial Times report earlier this week said Citigroup and Bank of America were restricting AI agents from accessing customer accounts, joining JPMorgan Chase and Charles Schwab in tightening controls over automated financial tools. Banks are concerned that these agents could move customers’ idle cash into accounts offering higher returns, the report noted.
READ: US bank allegedly fires 80 India employees in five-minute Google Meet call, Reddit user claims (September 17, 2026)
Citi said in a statement to Retail Banker International, “To help safeguard customer accounts and information, we do not permit third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms.”
“Customers can, however, continue to authorize limited, read-only access to their account information with certain Citi-approved open banking providers,” the statement added.
Bank of America is also limiting AI agents’ access to consumer deposit accounts, according to Yahoo Finance, which cited a person familiar with the matter. Chief Executive Brian Moynihan said the bank was developing protocols to determine which party would be liable for payments authorized by AI.
“We strongly believe there should be a human in the loop to authorize money moving out of your account,” Moynihan told CNBC.