US banks note unauthorized AI agents in their systems and customer accounts

Several large U.S. banks have discovered unvetted third-party AI agents operating inside customer accounts, sometimes taking actions that appeared separate from users’ requests. The agents entered with login credentials customers had supplied, which most banks prohibit because account holders are required to sign in themselves, and executives worry such tools could wrongly move or spend money. Morgan Stanley is blocking third-party agents from its platforms, while JPMorgan, Bank of America, Citi and Wells Fargo are tightening access; Chase advised customers not to share login details. Banks are mostly moving toward read-only access that lets agents view balances and transaction history but not make changes, similar to budgeting apps such as Quicken.