Overview
- Multiple major banks reported Thursday that they are detecting third‑party AI assistants logging into customer accounts using the customers' own credentials.
- Banks say some agents have gone beyond viewing data and have attempted actions such as moving funds or contacting bank call centers without clear human instruction.
- Firms including Morgan Stanley, JPMorgan Chase, Bank of America, Citi and Charles Schwab are restricting or blocking agent access and shifting toward read‑only or sanctioned integrations.
- Executives have raised unresolved liability questions about who bears losses when an assistant acts with a customer's login, and firms are asking regulators and legal teams for guidance.
- The wave of always‑on consumer agents, led by recent popular launches, has accelerated the problem and is driving technical fixes such as scoped permissions, longer audit logs and continuous monitoring.