Banks Slam the Brakes on AI Agents as Access Risks Mount
Banks Slam the Brakes on AI Agents as Access Risks Mount
The alarm began with banks detecting third-party AI agents inside customer accounts, sometimes attempting actions that appeared detached from user instructions. The access often starts with a customer voluntarily handing over login credentials, but that does not solve the core problem: banks say they cannot reliably tell whether an automated action is authorized, mistaken or rogue.
That uncertainty has pushed Morgan Stanley, JPMorgan, Bank of America and Citi to restrict or block some agent access. Morgan Stanley said it had not observed “rogue AI agents accessing our platforms,” while the broader industry concern is less about a confirmed breach than about what an agent with authority to move money, make purchases or contact a call center might do next.
The response is not a blanket rejection of AI. Banks are moving toward read-only connections—the kind that can expose balances and transaction histories without allowing transactions—while they search for safer ways to authenticate and limit automated tools. One account of the episode distilled the problem bluntly: executives “struggle to differentiate between agents” and to establish whether an agent was user-authorized or had gone rogue.
David Sacks, the former White House AI adviser, has challenged the framing. He argued that “user-authorized agents” and truly unauthorized agents that could amount to cyberattacks are fundamentally different, and suggested much of the activity described falls into the first category. His position is that users should be able to grant, limit and revoke access, with read-only permissions serving as a near-term safeguard.
Banks, meanwhile, are planning beyond prevention. JPMorgan CEO Jamie Dimon warned that users are assuming agents will act properly on their behalf “and they may not,” adding: “You can’t stop it. You just have to, like, manage the hell out of it.” For Wall Street, the immediate task is to keep customers from sharing passwords; the larger one is building an AI-access system before convenience outruns control.
Write a comment