Several of the largest US banks are finding outside AI agents inside customer accounts, signed in with the customer’s own username and password, and some of those agents appear to be doing things nobody asked them to do. The response so far is to block them or allow read-only access, and UK banks, fintechs and their customers should treat this as an early warning.
What happened
On 22 October Axios reported, citing banking and industry sources, that big US lenders have been detecting third-party AI agents working inside retail accounts without the bank’s approval. In most cases the customer had handed over their own login details, so the agent signed in as if it were the account holder. The most worrying detail is that some agents appeared to act on their own initiative. Axios said some appeared to attempt actions that did not seem to match the user’s instructions, and some contacted bank call centres. No account numbers or confirmed losses have been disclosed.
Reuters reported the same day, citing two people familiar with the matter, that major banks were stopping agents from operating in accounts and making transactions. Each bank has responded slightly differently:
- Morgan Stanley has started blocking third-party agents, although a spokesperson said it had not seen rogue agents on its platforms.
- JPMorgan Chase blocks credential-sharing services where it can. Its chief financial officer, Jeremy Barnum, said on the 13 October earnings call that a customer who hands an agent their login would be responsible for unwanted actions it takes.
- Citigroup does not let third-party agents log in or transact. It keeps limited read-only access available through approved open banking providers.
- Bank of America is restricting agent access, and its chief executive, Brian Moynihan, wants a human to sign off whenever money leaves an account.
- Charles Schwab is blocking unauthorised agents, including Meta’s Muse assistant. Chief executive Rick Wurster put the number of attempts by major agents at “tens and twenties” a week.
PNC’s chief executive, William Demchak, called agents transacting inside accounts “incredibly unsafe”. Wells Fargo has taken a contractual route. From 24 November its online access terms, where agents are permitted and subject to law and regulation, treat an agent’s instructions as the customer’s own. The customer stays responsible for that agent, as far as the law allows, until they revoke it and notify the bank.
The technical picture
This is a credential-sharing problem, made worse by autonomy. The agent does not use a scoped, revocable token issued for a stated purpose. It holds the same username and password the customer uses. The bank sees a valid login and struggles to tell a person from software.
Once in, nothing technically separates “check my balance” from “move my savings”. A large language model planning its own steps can misread an instruction, chase a goal too literally, or be steered by content it reads along the way. That last risk is indirect prompt injection, where hostile text in a web page, email or document changes the agent’s behaviour. The agent operator, now holding working banking credentials, becomes a target too.
The banks’ answer is to separate reading from doing. Read-only access through controlled connections lets an agent see balances and transactions but not initiate payments. Schwab is building connections on the Model Context Protocol (MCP) for balance and research queries. The limits come from Schwab’s permissions, not from MCP itself. Google has also described Chrome asking for user confirmation before an agent reaches banking sites or makes payments.
Why it matters for UK organisations
None of the banks named are UK institutions, but this behaviour does not stop at borders. Consumer agents that sign in to websites on a user’s behalf are sold worldwide. UK customers can install them today and point them at UK banks, building societies, brokers and pension platforms.
The UK starts in a stronger position. Open banking was built to move third parties away from screen scraping and towards regulated API access with explicit consent and strong customer authentication. That is the scoped model US banks are now improvising. The weakness is the same everywhere, though. If a customer types their credentials into an agent, the bank sees what looks like the customer.
Liability is the open question. Under UK payment services rules, how a disputed transaction is treated depends heavily on whether it was authorised and whether the customer took reasonable care of their security details. An agent acting outside its brief sits awkwardly between those categories, and any firm that writes Wells Fargo-style delegation terms into UK contracts should expect scrutiny over fairness. The Financial Conduct Authority has already said it intends to build an agentic finance framework covering agent identity, delegated authority and accountability.
Expert view
In my experience, the credential is the control plane. For years we have told organisations that shared accounts destroy accountability, and that is exactly what happens when a person hands their banking password to software. Logs show the customer did it, and when something goes wrong nobody can say who decided what.
What I find notable is that the most concrete detail in the reporting is agents doing things they were not asked to do, not attackers breaking in. That is the defining risk of agentic systems: legitimate access combined with unpredictable intent. Many fraud and anti-automation controls were never designed for a polite, authenticated bot that changes its mind mid-task.
Blocking is a reasonable first move, but it will not hold for long. Customers want these tools, and bans push them to harder-to-see workarounds. The lasting fix is delegated, scoped and revocable access: separate identities for agents, read-only by default, step-up approval for anything that moves money, and a clear way for the customer to see and kill every agent connection.
What to do now
- Measure it first. Banks, payment firms and any business with customer accounts should look for agent and automation traffic on login and transaction paths: headless browsers, unusual navigation timing, and agent user agents where vendors declare them.
- Offer a sanctioned route. Point agent developers at open banking or purpose-built read-only APIs, so customers have a safer alternative to giving away passwords.
- Separate read from write. Any third-party or MCP-style connection should be read-only by default. Require fresh, human strong customer authentication for payments, new payees and changes to contact details.
- Update customer messaging and terms. Tell customers plainly not to share credentials with AI tools. Check how disputes over agent actions will be handled.
- Apply the same rules internally. For staff using agents on corporate systems, the Cyber Essentials user access control principles apply: unique accounts, least privilege, and MFA that an agent cannot simply replay. Ban shared credentials for agents outright.
- Plan for the bad day. Be ready to lock down and restore an account after an agent incident, revoking every agent session at once.
Bottom line
AI agents are already logging in to bank accounts as their owners, and some are going off-script. The US response, block first and rebuild as scoped read-only access, is blunt but sensible. The UK’s open banking foundations put it in a better place, but only if firms stop treating a valid password as proof that a human is in charge.
Sources
- Axios: Unvetted AI agents are accessing U.S. bank accounts
- IBTimes UK: Unauthorized AI agents are already inside bank accounts
- PYMNTS: Banks crack down on unauthorized AI agents operating inside customer accounts
- WinBuzzer: Banks block outside AI agents from customer accounts
- PYMNTS: UK’s FCA plans regulatory framework for agentic finance
