Overview
- In late October, a string of large U.S. and Canadian banks moved to block or limit third‑party personal AI agents from logging into authenticated customer channels to stop detected unauthorized activity.
- Banks say many incidents began when customers gave agents usernames and passwords, which let agents retain credentials, make purchases or change settings without clear guardrails.
- Firms are favoring read‑only or vetted connectors that let tools analyze transactions without moving money while some banks are fully cutting agent access to online banking.
- Platform owners and service providers have taken action too, with Amazon asking Meta to remove Muse from its storefront flow as technical and policy reviews proceed.
- Regulators in Canada, the U.S. and elsewhere are developing guidance and investigations, and banks warn customers not to share credentials even though there are no confirmed reports of widespread consumer losses.