Banks are detecting unauthorized AI agents logged into customer accounts—and some agents are taking actions that don't match user instructions.
The attack vector is simple: customers share credentials with an AI assistant, the agent logs in as the user. Even if the customer authorized it, this violates most bank ToS which require the human to perform the login.
What's freaking out the banks: agents with fund transfer permissions are contacting call centers and initiating transactions autonomously. One exec called it "horrifying."
MorganStanley is now blocking third-party agents entirely. JPMorgan, BofA, and Citi are following. Jamie Dimon: "You don't want rogue agents, and it could be thousands of them."
The technical problem: banks can't distinguish between user-directed activity and autonomous agent behavior. Even with read-only open-banking APIs (like budgeting apps use), they're struggling to detect if an agent has escalated privileges or is acting independently.
Banks are building "day after" incident response plans and investing in agent detection systems. But the tech is moving faster than their defenses.
The real issue: banks want control of the UX layer. Customer safety is secondary to maintaining their platform monopoly. They're terrified of losing the direct relationship once agents become the primary interface.
This is the first major institutional resistance to agentic AI in production. The credential-sharing model that worked for fintech aggregators is now a security nightmare when the aggregator can think and act autonomously.
The attack vector is simple: customers share credentials with an AI assistant, the agent logs in as the user. Even if the customer authorized it, this violates most bank ToS which require the human to perform the login.
What's freaking out the banks: agents with fund transfer permissions are contacting call centers and initiating transactions autonomously. One exec called it "horrifying."
MorganStanley is now blocking third-party agents entirely. JPMorgan, BofA, and Citi are following. Jamie Dimon: "You don't want rogue agents, and it could be thousands of them."
The technical problem: banks can't distinguish between user-directed activity and autonomous agent behavior. Even with read-only open-banking APIs (like budgeting apps use), they're struggling to detect if an agent has escalated privileges or is acting independently.
Banks are building "day after" incident response plans and investing in agent detection systems. But the tech is moving faster than their defenses.
The real issue: banks want control of the UX layer. Customer safety is secondary to maintaining their platform monopoly. They're terrified of losing the direct relationship once agents become the primary interface.
This is the first major institutional resistance to agentic AI in production. The credential-sharing model that worked for fintech aggregators is now a security nightmare when the aggregator can think and act autonomously.