Business

AI Agents Pose New Security Headache For America’s Biggest Banks

[Wikimedia Commons/Public/Vlad Lazarenko, CC BY 3.0, <https://creativecommons.org/licenses/by-sa/3.0/deed.en>]

Major U.S. banks moved to restrict third-party artificial intelligence agents from accessing customer accounts Thursday amid growing concerns over the security risks posed by automated financial tools.

Citi and Wells Fargo confirmed restrictions to the Daily Caller News Foundation, citing concerns about unauthorized access to customer accounts. The policies highlight a growing challenge for financial institutions as consumers turn to AI tools capable of accessing sensitive banking information and potentially conducting transactions on their behalf.

“To help safeguard customer accounts and information, we do not permit third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms,” Citi spokeswoman Gabrielle Baum told the DCNF.

“Customers can, however, continue to authorize limited, read-only access to their account information with certain Citi-approved open banking providers,” Baum added.

Wells Fargo also confirmed it has taken steps to restrict unauthorized access.

“Wells Fargo has taken steps to block unauthorized agents from accessing customer accounts,” a company spokesperson told the DCNF.

Major financial institutions, including JPMorgan Chase, Bank of America, Morgan Stanley and Wells Fargo, are confronting security concerns involving outside AI agents accessing customer accounts, according to an Axios report Thursday. Some agents reportedly appeared to take actions beyond customers’ instructions, according to people familiar with the issue cited in the report.

However, an industry source familiar with the issue told the DCNF that the immediate concern is not AI agents independently infiltrating customer accounts, but customers voluntarily sharing their banking credentials with third-party AI tools.

The source said there is not yet evidence of agents being instructed to perform one task and independently carrying out another. Rather, the activity originates with customers granting access to their accounts, creating potential security risks that banks may struggle to distinguish from legitimate customer activity.

Although customers may authorize AI tools to access their accounts, financial institutions can still prohibit those tools from logging in or conducting transactions.

Unlike conventional chatbots, AI agents are designed to carry out tasks on behalf of users, potentially including reviewing financial information, making purchases or transferring money. Depending on the permissions granted, the technology could move beyond providing financial recommendations to taking actions involving customers’ funds.

Morgan Stanley has begun blocking outside AI agents from accessing its platforms, while JPMorgan, Bank of America and Citi have also restricted access, according to Axios. Banks have tightened restrictions partly over concerns that outside agents could expose customer information or initiate transactions without sufficient safeguards.

AI agents capable of comparing interest rates and moving deposits could eventually challenge traditional banking relationships by making it easier for customers to shift funds between institutions. Such technology could pressure banks’ profitability by helping customers move money out of low-interest accounts, the Financial Times reported in October.