AI assistants promise to make managing money easier, but some of America's biggest banks are moving to keep them out of customer accounts.
Major US financial institutions, including Morgan Stanley, JPMorgan Chase and Bank of America, are tightening controls on third-party AI agents accessing customer accounts, according to an Oct. 22 Axios report. Banks are concerned about automated tools using customer credentials to access financial information, contact call centers and potentially initiate transactions.
The concern centers on automated tools that use customers’ banking credentials to access accounts, with some reportedly attempting actions that appear to go beyond user instructions. Banks are also concerned about agents contacting call centers and potentially initiating transactions.
The access does not necessarily involve stolen credentials or hackers breaking into banking systems. Customers may have voluntarily shared their usernames and passwords with AI services, even when their banks prohibit such arrangements.
Morgan Stanley has blocked third-party agents from accessing its platforms, while JPMorgan, Bank of America and Citi are also restricting access, Axios reported. Reuters said banks have been flagging and blocking transactions involving shared credentials.
Despite those restrictions, the bank said it had not observed rogue AI agents accessing its platforms, according to Axios. JPMorgan CEO Jamie Dimon previously said the bank would not allow outside agents into its systems without appropriate controls.
The identity problem behind AI banking
The difficulty extends beyond identifying automated software. Banks must establish whether an agent has permission to perform a specific action and whether that action matches the customer's intentions.
Ted Miracco, CEO of Approov, argues that responsibility lies with customers who share their banking credentials and vendors that design agents to request them, rather than with the AI systems themselves.
“There is no "machine gone rogue" in this story. There are only irresponsible people handing banking credentials to AI software, and vendors shipping agents that ask for them. Both are human decisions and both should carry the financial consequences; however, right now neither clearly does,” Miracco told eSecurity Planet.
The growing use of AI agents also raises questions about whether banks are adequately testing the security controls protecting customer accounts.
John Strand, owner of Black Hills Information Security, warned that conventional penetration testing can leave gaps when customer accounts are excluded from testing.
“Keeping customer accounts out of scope cannot mean leaving the controls protecting those accounts untested,” Strand said.
Why read-only access could be the next step
Banks are exploring a middle ground that preserves useful automation without handing AI tools control over customers’ money. According to Axios, many institutions have approved or are moving toward read-only access, which allows agents to retrieve financial information without executing transactions.
John Carberry, solution sleuth at Xcape Inc., said financial institutions should move away from shared credentials and adopt API-based access controls, including OAuth flows with limited permissions.
That approach could let customers use AI to categorize expenses or analyze spending without giving an agent permission to transfer funds. However, read-only access is not risk-free. Financial records can reveal sensitive information about spending habits, account balances and transaction histories.
Banks would still need to enforce limited permissions, monitor access and provide ways to revoke an agent's authorization.
What this means for banking customers
Customers should avoid sharing banking passwords with third-party AI tools and check their bank’s rules before connecting financial accounts to an assistant. Even when a tool offers convenient automation, granting it account access may violate bank policies or expose personal financial records.
The reported incidents do not establish widespread theft or confirmed financial losses. But they expose a practical problem: a customer can authorize access without fully understanding what an automated system might do with it.
Banks need to control what agents can do
Blocking outside agents may reduce immediate exposure, but it could also limit legitimate financial tools as AI-powered services become more common. Banks will need ways to distinguish verified agents from ordinary users, restrict permissions and maintain records of actions taken on customers’ behalf.
Strand expects attackers to use AI to test account-access weaknesses at scale, reinforcing the need to test protections safely. Carberry also warned that similar automated access risks could spread to healthcare records.
The long-term challenge for banks is not simply keeping AI out. It is ensuring that when an agent is allowed in, its access is limited, traceable and tied to the customer’s actual intent.
Other news: Developer hosting platform Zeabur disclosed a security breach that exposed information from 321,810 accounts and more than 3.2 million environment-variable records.