AI agents are logging into bank accounts and banks cannot tell who sent them: why Wall Street is blocking them

Should you let an AI agent log into your bank account? America's biggest banks say no, at least not with your password. Major US lenders have discovered autonomous AI agents logging into customer accounts, sometimes using the customer's own credentials and occasionally taking actions that appear to go beyond what anyone asked them to do, according to an Axios report summarised by Decrypt. Bank executives described the situation as horrifying.

The response has been swift. Morgan Stanley is blocking outside agents, while JPMorgan, Bank of America and Citi are restricting them. The episode marks the first major collision between the consumer rush to use AI agents and the security rules that keep bank accounts safe, and it is a preview of a debate that Asian banks, regulators and fintechs will face within months.

What did the banks find?

According to the Axios report, several of the largest US banks detected unauthorised third party AI agents operating within customer accounts. Some agents logged in as the customer, using credentials the customer had shared, and some attempted steps that looked independent of the user's instructions. One executive said the industry has "grave concerns" about agents reaching into accounts and taking actions that could affect people's finances.

The core problem is identification. Bank systems are built on the assumption that the person logging in is the account holder. When software logs in using a customer's password, the bank struggles to tell whether the agent was authorised, what it intends to do, or whether it has gone rogue. Most bank terms require humans to access their own accounts, which puts agent use in a grey area even when the customer approves it.

Not every bank reported the same experience. A Morgan Stanley spokesperson told the Times of India that the bank had not observed instances of rogue AI agents accessing its platforms, according to American Bazaar, even as it moved to block third party agents.

Why banks are worried about money moving

Read access is one thing. Movement of money is another. Executives are most concerned about agents authorised to make purchases or transfer funds, because an agent that misreads an instruction, or is manipulated by a malicious website, could cause real losses. A Financial Times report earlier in the week said banks were also concerned that agents could move customers' idle cash into accounts offering higher returns elsewhere.

That second worry is commercial as much as technical. Banks earn money on low cost deposits, and AI agents that constantly hunt for the best rate could make those deposits far less sticky. Blocking agents protects customers, but it also protects the bank's funding base.

The real battle over AI agents in banking is not just about security. It is about who controls the customer's money when software does the shopping.

The broader security backdrop is worrying. The Bank for International Settlements has warned that AI is shrinking the window banks have to patch security flaws before attackers exploit them, a risk illustrated last week when a critical PHP flaw pushed Japanese banks into emergency maintenance, as we reported in our analysis of the php2shell vulnerability.

The likely compromise: read only access

Banks are not trying to ban agents forever. Most have authorised, or are leaning toward, read only access that would let agents view a customer's financial information without moving money, similar to what banks already grant budgeting apps such as Quicken. Executives acknowledge that customers will want to use AI agents, so some accommodation is coming.

A Chase spokesperson advised customers against sharing their login credentials with anyone, which remains the most important practical step. Sharing a password with an AI tool gives it the same power as the account holder and may breach the bank's terms, which could affect a customer's protection if something goes wrong.

The safest path is through official connections rather than shared passwords. Open banking interfaces, where a bank grants limited, revocable permissions to an approved app, offer a model that can be extended to AI agents with clear limits on what they can see and do.

What it means for banks in Asia

Asian banks are moving quickly on AI, and regulators are already writing rules. The Hong Kong Monetary Authority has set out a framework for agentic AI in banking built on accountability, resilience and trust, and Singapore's BLOOM initiative includes a workstream on agentic payments. Banks across the region are also deploying their own AI agents for customers, especially corporate clients.

Those bank built agents are different from the third party agents causing alarm in the United States. A bank's own agent runs inside its controls and compliance systems. A third party agent logging in with a customer's password does not. The key questions for Asian banks and regulators include:

• Whether third party AI agents should be allowed to log in using customer credentials at all
• How to give agents limited, revocable permissions through official interfaces
• Who is liable when an authorised agent makes a mistake or is manipulated
• How to detect and block agents that impersonate customers
• How consumer protection rules apply when software, not a person, initiates a payment

For Southeast Asian markets with fast growing digital banks and super apps, the stakes are high. Millions of customers already manage money through phones, and the next wave of AI assistants will want access to those accounts.

What comes next

Expect formal policies. US banks are likely to publish clearer rules on agent access, and regulators may issue guidance on liability and consumer protection. Technology firms building AI agents will push for official access channels rather than password sharing, because blocking threatens their products.

In Asia, regulators have a chance to get ahead of the problem by defining safe agent access before it becomes widespread. The lesson from Wall Street is clear: if banks do not offer a safe way in, customers will give agents their passwords anyway, and that is the riskiest outcome of all.

The discovery of AI agents inside bank accounts is the first real test of how finance will handle software that acts on its own. US banks have chosen to block first and negotiate later, steering toward read only access through approved channels. Asia's regulators and banks now have a short window to design safe rules for agents before customers decide for themselves.