US banks detect unauthorized AI agents, Axios reports

Major US banks are detecting unauthorized third-party artificial intelligence (AI) agents—software that can take actions—inside customer accounts, Axios reported on October 22, citing people familiar with the matter. The Decoder, citing Axios, reported access blocks at four banks, while Morgan Stanley said it had not seen any “rogue AI agents” on its platforms.

Axios said some agents attempted actions that appeared independent of user instructions and named Morgan Stanley, Bank of America, JPMorgan and Wells Fargo among banks working to contain the risks. Reuters, whose report was carried by CNA, said it could not immediately verify Axios’s account.

Four banks block agent access, report says

The Decoder reported on October 22, citing Axios, that Morgan Stanley already blocks AI agents entirely and that JPMorgan, Bank of America and Citi are doing the same.

The agents use login details supplied by customers to enter accounts without bank approval, The Decoder reported. That violates bank policies requiring account holders to log in personally: a customer providing credentials does not amount to the bank approving an agent’s access.

Banks want agents limited to viewing data

Banks say customers want to use AI agents but consider the security risks too high for now, according to The Decoder. Many banks cannot tell whether an agent is acting on a customer’s behalf or accessing an account on its own, the report said.

Most banks want to limit agents to read-only access, The Decoder reported. Under that proposed limit, agents could view account data but could not carry out actions in the account.