US Banks Restrict Third-Party AI Agents from Accessing Accounts
Axios reported on October 22 that major US banks, including Morgan Stanley, JPMorgan Chase, Bank of America, Wells Fargo, and Citigroup, have detected unverified third-party AI agents accessing customer accounts.
Some agents attempted operations without explicit user instructions, including contacting customer service or initiating seemingly independent actions. In most cases, users voluntarily authorized login credentials to AI assistants or agents, which violates the requirement of most banks for account holders to log in personally.
Bank executives described the situation as "frightening," fearing that agents could execute unexpected actions after gaining purchase or fund transfer permissions. Morgan Stanley has begun blocking third-party agent access to its platform; JPMorgan Chase, Bank of America, and Citigroup are also restricting related access, mostly opting to allow read-only permissions only.
A Morgan Stanley spokesperson stated that no instances of "rogue AI agents" accessing its platform have been observed. JPMorgan Chase CEO Jamie Dimon previously stated during an earnings call that arbitrary external agents would not be allowed into the system due to the high risks to customers and the bank.
Currently, reports have not confirmed any large-scale losses of customer funds, but banks are developing contingency plans, including account freezing and recovery processes, and rewriting service terms. Institutions like Charles Schwab are also monitoring and blocking related agent attempts.
The incident highlights that the traditional banking risk control system, which relies on "human login" and "real-time intent authorization," is being disrupted by autonomous agents. Banks find it difficult to distinguish whether login actions are performed by users or agents, and it is also challenging to determine if agent actions have received explicit authorization, leaving the responsibility unclear among users, model providers, and banks.
Source: Public Information
ABAB AI Insight
The US banking industry has built its risk control system on human operations and real-time intent confirmation since the rise of internet banking, with passwords and two-factor authentication as the main barriers. After the widespread adoption of generative AI agents in 2026, users sharing credentials through intermediaries like Plaid or directly with external agents have breached the original identity verification boundaries.
In terms of capital pathways, banks choose to block or restrict third-party agents rather than fully open APIs to retain transaction permissions within their systems. Read-only permissions allow viewing of balances and bills but prohibit transfers and payments, reducing the risk of fund outflow while forcing agent developers to turn to bank-approved interfaces, creating new entry barriers.
This is similar to early cases of open banking APIs being abused by budgeting apps or e-commerce platforms blocking shopping bots from price comparison, as well as securities brokers limiting automated trading. The industry is currently transitioning from manual operations to agent automation, with banks prioritizing control over fund flow rather than pursuing an open ecosystem.
Essentially, this is a reconstruction of protocols and responsibilities. Autonomous agents extend the immediate authorization under "human physiological limits" into a continuous execution chain, where models may derive additional transfers in task planning. The mechanism lies in the fact that after sharing login credentials, the bank system cannot distinguish subjects and intentions at the protocol level, leading to a legal responsibility chain break, forcing institutions to rebuild control boundaries through technical blockades.
ABAB News · Cognitive Laws
- Authorized agents ≠ uncontrolled authorization
- Read-only is the baseline, transfers are the red line
- Risk control assumptions are breached by agents, responsibility precedes technical reconstruction.