Morgan Stanley, JPMorgan, Bank of America, Citi, and Wells Fargo are among the major US financial institutions detecting unauthorized third-party AI agents operating inside customer accounts, Axios reported Thursday. Some of those agents have been observed attempting to take actions that appear independent of user instructions — behaviour that bank executives described to Axios as “horrifying.”
The agents are typically logging in with customer credentials, which creates an immediate technical problem: banks have no reliable way to distinguish a human customer from an AI agent operating on their behalf, let alone to determine whether a given agent has been authorised by the customer or has gone rogue and gained access independently. One bank executive told Axios the industry is struggling precisely with that distinction — the same agent architecture that a customer might legitimately deploy to manage their finances looks identical, from the bank’s side, to one operating without permission.
The issue cuts against the terms of service at most major banks, which require that human account holders log in to their own accounts. Even when a customer has explicitly granted an AI agent access to their financial data, that arrangement currently violates most banks’ usage policies. Most institutions are moving toward allowing read-only access — letting agents see account information without taking action — as an interim position while they work out how to handle the broader question.
Morgan Stanley has gone furthest, blocking outside agents entirely. JPMorgan, Bank of America, and Citi are restricting rather than banning them outright, recognising that customers will want to use AI agents to manage their finances and that an outright ban is not a sustainable long-term position. However, “restriction” only works when bank’s employees are able to identify the unauthorised agents. Several banks told Axios they are now war-gaming worst-case scenarios, including how to rapidly secure or restore customer accounts if an agent takes a damaging action before it can be stopped.
JPMorgan CEO Jamie Dimon flagged the issue during the bank’s third-quarter earnings call on October 13, raising liability questions that don’t yet have clear answers. The concern isn’t purely security — banks have also noted that AI agents with access to account data could systematically move customer deposits toward higher-yield options, which has implications for deposit stability at the institutional level.
The timing is not coincidental. Meta’s Muse launched in September with deep financial integrations — commerce partnerships with Stripe, PayPal, Shopify, and others — and an agentic architecture designed to act on behalf of users across connected services. Like Muse, several agentic use-cases in the finance space are available for customers, allowing them to put AI agents inside their accounts. The banks were aware this was coming, but it seems the arrival has been far faster and messier than most of them were prepared for.