Major United States banks are confronting a new problem as artificial intelligence agents increasingly attempt to interact with customer accounts. Reports of third-party agents accessing financial platforms without bank approval have raised concerns about whether existing security systems can distinguish legitimate customer activity from automated actions that may exceed a user’s intentions.

The issue highlights a growing gap between the capabilities of AI assistants and the rules governing access to sensitive financial services. Customers may want automated systems to organise their finances, monitor transactions or complete routine tasks, but banks must ensure that those systems cannot move money, disclose information or change account settings without appropriate safeguards.

The challenge is not simply to prevent malicious software from entering a banking system. It is to determine how financial institutions should handle software that may have been authorised by a customer but is not recognised or approved by the institution itself.

AI agents blur the distinction between users and software

Traditional online banking systems are designed around identifiable customers who authenticate themselves and initiate transactions. AI agents complicate that model because they can carry out sequences of actions on behalf of a person, potentially interacting with websites, forms and customer service systems in ways that resemble human behaviour.

According to reporting on the issue, major banks including Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo have been assessing risks associated with third-party AI agents. Some institutions have reportedly restricted access while considering how their security controls and customer policies should respond.

The distinction between authorised and unauthorised activity is not always straightforward. A customer might willingly provide an AI agent with login credentials to perform a task, but the bank may prohibit credential sharing or automated access through its terms of service. In other cases, an agent could act beyond the scope of the original instruction or interact with systems in an unexpected way.

These possibilities create a problem for conventional security systems. A successful login may appear legitimate even when the subsequent actions are being performed by software that the bank cannot identify or control. The institution must determine not only whether the credentials are valid, but also whether the activity is permitted and consistent with the customer’s intentions.

Financial authority creates a higher level of risk

AI agents can be designed to complete tasks with limited human intervention. In ordinary applications, this might involve organising information or preparing a document. In banking, the same level of autonomy can have direct financial consequences if an agent is able to initiate payments, transfer funds or alter account settings.

The risks increase when a system has broad permissions. An agent given access to an account for monitoring expenses might possess credentials that also allow it to make transactions. If its instructions are misunderstood, its software behaves unexpectedly or an external party manipulates its actions, the consequences could extend beyond an inaccurate recommendation.

This does not mean that all AI agents are inherently unsafe or that reported incidents demonstrate widespread financial losses. The available reporting does not establish how many accounts were affected, whether money was lost or whether the agents involved acted maliciously. The concern is that existing access arrangements may not adequately distinguish between viewing information and exercising financial authority.

Banks have strong incentives to prevent unauthorised transactions because they must protect customers, comply with regulatory obligations and preserve confidence in their services. An AI agent that behaves unpredictably can create uncertainty over who initiated an action and who should be responsible for the outcome.

Blocking agents may be necessary but is not a complete solution

Some banks are restricting third-party agents while evaluating the threat. Such measures can reduce immediate exposure, particularly when institutions cannot reliably identify automated activity or establish whether a customer has authorised it.

However, a blanket restriction may become increasingly difficult to maintain as customers seek more sophisticated financial assistance. AI agents could eventually help users compare spending, identify unusual transactions, prepare budgets and manage routine administrative tasks. Preventing all automated access could limit useful services while encouraging customers to seek workarounds that create additional security risks.

A more durable approach would distinguish between different levels of permission. Read-only access, for example, could allow an approved service to retrieve financial information without authorising transfers or payments. More sensitive actions could require explicit confirmation, additional authentication or transaction-specific limits.

Such arrangements would need to be designed carefully. Read-only access can still expose highly sensitive information, while permission to initiate transactions requires stronger safeguards. Banks would also need ways to identify the software involved, monitor its behaviour and revoke access when necessary.

The objective should be controlled access rather than unrestricted automation or a permanent refusal to accommodate new technology.

Responsibility remains a difficult question

The growth of AI agents creates uncertainty about liability when something goes wrong. A customer may argue that an agent acted contrary to instructions, while the agent’s developer may contend that the system operated according to its design. The bank must establish whether the activity was authorised under its policies and whether its own controls functioned appropriately.

These questions become more complicated when an agent uses customer credentials rather than a formal connection approved by the bank. The institution may have limited visibility into the agent’s identity, permissions or decision-making process. Without reliable records, reconstructing what happened can be difficult.

Clear standards could help establish how agents should identify themselves, obtain permission and communicate their authority. Financial institutions and technology providers will also need procedures for logging actions, investigating disputes and preventing the same failure from recurring.

Customers have a role in this process. Sharing passwords with third-party tools can expose accounts to risks that ordinary authentication systems were not designed to manage. Yet individual caution cannot replace institutional safeguards, particularly when the technology is developing faster than established policies.

Banking must prepare for controlled automation

The reported incidents illustrate a broader challenge for financial services: AI systems are becoming capable of taking actions, not merely providing information. That shift requires a reassessment of authentication, permissions, monitoring and accountability.

Banks will need to distinguish between trusted integrations and unknown agents, limit what automated systems can do and maintain the ability to stop suspicious activity quickly. Regulators may also need to clarify expectations as AI becomes more involved in financial decision-making and transactions.

The technology could eventually offer substantial benefits by helping customers understand their finances and manage routine tasks. Those benefits, however, depend on users being able to trust the boundaries within which an agent operates.

The immediate priority is to ensure that convenience does not come at the expense of control. AI agents may become a routine part of personal finance, but their access to money and sensitive account information must remain subject to clear, enforceable safeguards.

(Adapted from Axios.com)

Categories: Regulations & Legal, Strategy, Uncategorized