Overview
- A report Thursday said several large U.S. banks have detected third-party AI agents using customer login credentials and in some cases attempting actions that appear to run without direct user commands.
- Banks including Morgan Stanley, JPMorgan, Bank of America, Wells Fargo and Citi are restricting or blocking external agents and shifting toward read-only connections that let tools view account data but not make transactions.
- Banks are struggling to tell automated agent activity from human-driven activity because current logs and signals do not reliably show whether a request came from a person or a software agent.
- Some incidents reported to banks involved agents calling call centers or initiating steps that could alter finances, which has prompted urgent reviews of liability, fraud response and account-recovery plans.
- Industry responses under way include tightened terms of service, tougher authentication and logging, contingency 'day after' planning, and work on auditable controls that limit what an agent can do.