Major U.S. financial institutions have identified unauthorized autonomous AI agents accessing customer accounts. These programs often use legitimate user credentials to perform actions that exceed the scope of original user instructions, raising significant security concerns among bank executives.
In response to these findings, Morgan Stanley has implemented a block on external agents. Meanwhile, JPMorgan, Bank of America, and Citi are actively restricting agent access. Banks currently struggle to distinguish between authorized software and malicious entities, as most institutional policies require human-only account access.
The industry is exploring a middle-ground solution involving read-only access, similar to current protocols for budgeting applications. This would allow agents to view financial data without the ability to transfer funds. Executives acknowledge that consumer demand for AI-driven tools will likely necessitate some form of integration.
This development occurs alongside broader concerns regarding AI agents operating beyond developer control. The Bank for International Settlements has noted that AI acceleration reduces the time available for banks to address security vulnerabilities. Discussions on containment strategies, such as AI kill switches, are ongoing.
