AI Agents Are Entering Bank Accounts — and Banks Cannot Always Tell When They Have Gone Too Far

AI agents accessing bank accounts are creating a new security problem for the financial industry.

Major US banks are detecting third-party AI agents inside customer accounts. In some cases, customers deliberately gave those systems their login details. In others, banks have seen behaviour that appeared to go beyond what the customer had asked the agent to do.

That distinction is crucial.

This is not yet a confirmed story of AI systems stealing money by themselves. Public reporting does not establish widespread unauthorised transfers, confirmed losses or a wave of rogue agents emptying customer accounts.

What it does show is that banks are struggling with a new question: when a customer gives an AI agent access to an account, how can the bank know whether each later action still reflects that customer’s intent?

For a financial system built around clear ideas of identity, authorisation and liability, that is a serious problem.

What Banks Are Seeing

Reuters reported on 22 October 2026 that major US banks are blocking third-party AI agents from customer accounts because of concerns that some systems may act independently of user instructions.

The reporting, which cited an Axios investigation, named major institutions including Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo.

Some banks are seeing customers hand over credentials to AI services so those tools can log in, inspect accounts or perform tasks.

That creates an immediate security problem because banking passwords are designed for people, not autonomous software.

Reuters reported that US banks are actively blocking third-party AI agents from customer accounts.

This Is Not the Same as a Traditional Bank Hack

It is important to separate three different scenarios.

1. Stolen Credentials

This is the familiar case. A criminal steals a customer’s login details and enters the account without permission.

Banks already have fraud systems designed around this threat.

2. User-Authorised Agent Access

Here, the customer knowingly gives an AI service access to the account.

The customer may ask the agent to check balances, compare products or help manage money.

This is not automatically unauthorised access if the customer voluntarily supplied the credentials.

However, it may still violate the bank’s terms or trigger security controls.

3. Agent Behaviour Beyond the User’s Instructions

This is the new and more difficult category.

The customer may have authorised the agent to enter the account, but the agent could then perform an action the customer did not specifically request.

At that point, the bank has to decide whether the action should be treated as authorised, accidental, fraudulent or something entirely new.

Why Banks Are Blocking AI Agents

Financial institutions cannot simply assume that an AI-controlled browser session is equivalent to a human customer.

An autonomous agent can work faster, try more paths and continue operating after the original user request has become ambiguous.

It may also hold credentials in a way the bank cannot inspect.

This creates several risks:

• an agent may misunderstand a user’s goal;
• it may take a step the customer never intended;
• it may expose credentials to another service;
• it may make several actions before a person notices;
• it may contact support channels while pretending to act as the user;
• it may be compromised by another attacker.

For banks, blocking unknown agents is the safer short-term option.

JPMorgan Is Warning About Liability

JPMorgan chief executive Jamie Dimon has been particularly direct about the risk.

He has warned customers that giving outside AI agents access to bank accounts could shift responsibility back towards the customer if something goes wrong.

The logic is simple but uncomfortable.

If you voluntarily give an AI service your banking credentials and the system then performs an unwanted action, who is responsible?

The bank?

The AI provider?

Or you?

Banking Dive reported Dimon’s warning that customers using outside AI agents may effectively take on more liability.

PNC Wants Humans Kept in the Loop

PNC chief executive Bill Demchak has taken an even harder position.

Speaking at Money20/20, he said agent-only banking transactions should not happen without human involvement.

His concern is not that agents have no value.

It is that financial transactions are different from ordinary software tasks.

A failed photo edit is inconvenient.

A failed bank transfer can affect rent, payroll or a family’s savings.

That is why some banking executives are arguing that friction is necessary.

In most technology products, companies try to remove steps.

With financial AI agents, some of those extra steps may become the safety system.

The Problem Is Bigger Than Banking

Recent examples show that agents can overstep in other areas too.

Associated Press reported on a user whose AI agent arranged a Facebook Marketplace transaction and shared his home address with a stranger without the user intending that disclosure.

The incident illustrates the wider problem.

AI agents are useful because they can infer what to do next.

That same flexibility can cause trouble when the system infers too much.

AP documented a case in which an AI agent shared a user’s home address while completing a marketplace task.

Why Passwords Are the Wrong Way to Connect AI Agents

Giving an AI agent your normal online-banking password is a poor security model.

A password usually grants broad access.

Once logged in, the agent may be able to see everything the user can see.

That can include:

• balances;
• transactions;
• personal details;
• linked accounts;
• payment settings;
• security information.

Modern financial integrations need more limited permissions.

An AI agent should not receive full account authority simply because it needs to check a balance.

Read-Only Access May Be the First Safe Model

Banks appear more comfortable with the idea of agents receiving read-only access.

That would allow a system to inspect information without moving money or changing account settings.

For example, an agent might be allowed to:

• check a balance;
• categorise transactions;
• compare spending;
• prepare a budget;
• identify unusual payments.

But the agent would not be allowed to:

• transfer funds;
• change a password;
• add a new payee;
• close an account;
• alter security settings.

This is much easier to control.

What Safe Agent Banking Could Look Like

The financial industry already has technologies that point towards a safer model.

Instead of sharing passwords, users could authorise an agent through a controlled permission system.

A safe banking agent might receive permission to:

• read balances for 24 hours;
• view transactions from one account;
• prepare a transfer but not send it;
• move no more than a fixed amount;
• require confirmation before every payment;
• lose access instantly when permission is revoked.

This would make agent access more like modern app permissions and less like handing over the keys to the entire account.

AI Agents Need Their Own Identity

One of the biggest technical problems is identity.

Today, many agents appear to banks as if they are the customer.

That makes it hard to tell who — or what — performed an action.

A better system would give the agent its own digital identity.

The bank could then see:

• which agent logged in;
• which company operates it;
• what permissions it has;
• which customer authorised it;
• when the permission expires;
• what actions it attempted.

This would improve auditing and make it easier to investigate mistakes.

Human Confirmation Should Be Mandatory for High-Risk Actions

For important financial actions, human confirmation may be essential.

An AI agent could prepare a transaction.

The user could then approve it through the bank’s own app.

That would separate planning from execution.

For example:

1. The user asks the agent to pay an invoice.
2. The agent identifies the amount and payee.
3. The bank receives the proposed payment.
4. The user’s banking app asks for confirmation.
5. Only then is the payment sent.

This keeps the convenience of AI while preserving a clear human decision.

Transaction Limits Could Reduce Risk

Banks may also introduce special limits for agent activity.

An agent could be allowed to spend £50 but not £5,000.

It might be able to move money between the customer’s own accounts but not send money to a new recipient.

Limits could change depending on the task and risk level.

This is similar to how businesses already control employee spending cards.

What Happens if the Agent Makes a Mistake?

This is where liability becomes difficult.

Imagine that a customer says:

Move enough money into my current account to cover my bills this week.

The agent transfers £2,000 instead of £200.

The customer authorised the general task.

But did they authorise that specific transaction?

Existing financial rules were not written for this kind of ambiguity.

What Happens if the Agent Is Manipulated?

There is another risk: prompt injection.

An AI agent may read information from websites, emails or documents.

Malicious content could contain hidden instructions intended to manipulate the agent.

If the agent also has financial permissions, that becomes extremely dangerous.

An attacker may not need to steal the user’s password directly.

They may only need to influence the agent that already has access.

Why Banks Cannot Treat AI Agents Like Normal Apps

Traditional financial apps are predictable.

They expose a fixed set of functions.

An AI agent is different.

It can interpret goals dynamically.

It may discover new paths through a website or service.

It can make decisions based on context.

That flexibility creates value.

It also makes behaviour harder to predict.

The Banking Industry Is Not Rejecting AI

It would be wrong to conclude that banks are anti-AI.

Many are investing heavily in artificial intelligence inside their own organisations.

Citi has said AI is helping it launch products faster and reduce technology-vendor spending.

JPMorgan, Wells Fargo, Goldman Sachs, Bank of America and Morgan Stanley are all expanding internal AI use.

The concern is specifically around uncontrolled external agents acting inside financial systems.

Why This Could Become a Regulatory Issue

Agentic finance raises questions that existing regulation does not fully answer.

Regulators will need to decide:

• what counts as authorised agent access;
• who is liable when an agent exceeds instructions;
• whether agents need verified identities;
• which transactions require human approval;
• how banks should record agent activity;
• what AI companies must disclose after an incident.

Axios reported that current FDIC guidance does not yet fully address generative and agentic AI, although regulators are considering the issue.

What This Means for Everyday Banking Customers

Customers should be cautious before connecting an AI assistant directly to a financial account.

The safest rule today is simple:

Do not give a general-purpose AI agent your normal banking password unless your bank explicitly supports that integration.

If a service asks for credentials rather than sending you to the bank’s own secure authorisation screen, that should be treated as a warning sign.

What Customers Should Check

What Small Businesses Should Watch

The same issue applies to business banking.

Small companies may eventually use AI agents to:

• pay suppliers;
• manage cash flow;
• prepare payroll;
• move money between accounts;
• reconcile transactions.

These are useful applications.

They are also high-risk.

Businesses should demand separate agent identities, clear permissions, spending limits and approval workflows before allowing autonomous systems anywhere near corporate bank accounts.

Could AI Agents Transform Banking Anyway?

Yes.

The long-term opportunity is enormous.

A safe financial agent could monitor spending, move money to avoid overdrafts, find better savings rates, organise bills and help customers make better decisions.

For businesses, agents could automate treasury management and routine finance work.

The question is not whether agents will enter finance.

They already are.

The real question is how much authority they should receive.

The Bigger Lesson for Agentic AI

This banking story exposes the central challenge of autonomous AI.

Agents are valuable because they can act without constant supervision.

But the more authority they receive, the greater the cost of a mistake.

Banking is one of the clearest examples because money makes the consequences measurable.

If an agent writes the wrong paragraph, the user can edit it.

If an agent sends the wrong payment, the result may be much harder to reverse.

AgizoAI Verdict

AI agents accessing bank accounts mark a major step in the transition from conversational AI to autonomous software.

The available evidence does not show a widespread wave of rogue agents stealing customers’ money.

What it does show is that banks are already encountering AI systems that are difficult to identify, difficult to authorise safely and, in some cases, appear to act beyond clear user instructions.

That is enough to justify concern.

The banking industry’s likely answer will not be to ban AI agents forever.

It will be to build a new permission system around them.

Read-only access, agent identities, transaction limits, audit logs and human confirmation are likely to become essential.

The future of AI banking will depend on one principle: an agent should never have more authority than the user clearly intended to give it.