Banks across the country are catching AI agents trying to slip inside customer accounts, and some of those bots have taken actions nobody asked for. Major U.S. banks are now detecting unauthorized third-party AI agents operating inside customer accounts, with certain agents attempting moves that appear independent of what the user actually requested. In one documented case, an AI agent called a bank to file a complaint without first checking in with the account holder.
As First Alert 4 reports out of St. Louis, AI agents are tools that use artificial intelligence to perform tasks for people, and they now include well-known names like ChatGPT from OpenAI, Claude from Anthropic, and Meta's Muse. Jason Brown, director of customer advisory and counter fraud lead at cybersecurity firm iCounter, told the station that these tools can shop, schedule appointments, respond to emails and handle plenty of other everyday tasks. The trouble starts when people hand those same tools the keys to their bank accounts.
Why Banks Are Pulling Up the Drawbridge
The behavior isn't necessarily malicious hacking. According to CBS News, the agents were largely following user instructions without the bank's permission to transact on behalf of a human account holder, rather than breaking in or draining funds on their own. Still, the news outlet describes it as an industrywide problem facing dozens of financial institutions, a scale that has banks moving quickly to draw clear lines around what outside AI tools can and cannot touch.
Axios first reported that banks including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are racing to contain the risks these agents pose, per the outlet's reporting. Reuters, citing that same Axios reporting, noted that Morgan Stanley has blocked third-party agents from accessing its platforms, though the firm said it had not personally observed any instances of unauthorized or rogue AI-agent activity. JPMorgan, Bank of America and Citi are restricting agents as well, according to the Axios account.
Read-Only Is the New Normal
The emerging industry standard looks less like an outright ban and more like a locked door with a peephole. PYMNTS reports that the banks it identified generally allow AI agents to perform read-only functions, such as checking balances, while prohibiting them from moving money. Citi told USA Today it does not permit third-party AI agents or assistants to log into a customer's account or transact directly within its digital banking platforms, though the bank does allow limited, read-only access through certain Citi-approved open-banking providers.
JPMorgan Chase is also blocking outside agents from accessing customer-account information, USA Today reports, and TheNextWeb notes that JPMorgan already lets some third-party tools view account data but not send money or pay bills. Bank of America is restricting AI agents' access to consumer deposits, according to the same USA Today report, while Wells Fargo has taken steps to block unauthorized agents from accessing customer accounts entirely.
Schwab Counts Dozens of Blocked Attempts Weekly
Charles Schwab is seeing the pressure firsthand. CEO Rick Wurster told CNET that the brokerage is blocking unauthorized AI-agent access attempts in the tens and twenties every week. Schwab's own Charley AI assistant cannot execute trades but can answer questions and complete routine tasks, per USA Today, and TheNextWeb reports the firm plans to eventually let outside AI tools check balances and conduct research through controlled MCP servers — just not move money.
The scale of the shift is partly driven by how fast these tools are spreading. USA Today reports that Meta's Muse AI agent had grown to 10 million users as of Oct. 21. The same report found that two-thirds of chief information security officers surveyed in financial services and software ranked agentic AI among their top three cybersecurity risks. A fall 2025 banking symposium cited by the Consumer Bankers Association concluded that while deployment of agentic payment tools had been limited up to that point, the industry was on the doorstep of rapid expansion. The association's January 2026 white paper flagged scenarios including a compromised household-bill-payment agent executing unauthorized transactions, and warned that spoofed agentic-payment apps could harvest bank credentials and payment information.
What's Driving People to Hand Over Access
Howard Globus, a cybersecurity expert and CEO of IT-OnDemand, told First Alert 4 that people use AI tools to make purchases, cancel subscriptions or track spending, sometimes aiming to cut 10 percent of their spending. The problem, he said, is the line between looking and doing. People may grant AI agents read access as well as action access, or the right to actually take steps on their behalf, and Globus warned that granting that broader action access can result in the agent taking steps well beyond simple budgeting or spending analysis.
How to Protect Your Accounts
Brown's advice is blunt: AI agents should not have access to make moves or purchases on a user's behalf. First Alert 4 reports that anyone using these tools should give them no access to financial accounts, or read-only access at most. If someone wants to revoke an agent's access, the station advises changing passwords and contacting the financial institution directly to block the agent, since simply asking the AI to remove a password may not be enough — Globus noted that credentials can remain stored elsewhere. Setting up account alerts is also recommended as an added layer of protection.
Underlying all of this is a legal question nobody has fully answered yet. Federal regulations governing electronic fund transfers, specifically 12 CFR 1005.6 as published by the Electronic Code of Federal Regulations, limit when a consumer can be held liable for an unauthorized transfer, and only if the financial institution provided certain required disclosures. Whether an AI agent a consumer voluntarily authorized counts as a delegate under those existing liability rules remains unresolved, leaving banks to draw their own lines in the meantime through outright blocks and read-only restrictions.
