Rogue AI? US banks sound alarm over unauthorised access by 'agents'

Major US banks, including Morgan Stanley, JPMorgan Chase, Bank of America and Wells Fargo, are restricting third-party artificial intelligence (AI) agents from accessing their platforms amid concerns that unvetted technology could compromise customer accounts and carry out unauthorised financial transactions, Axios reported.

The concerns stem from instances in which AI agents accessed customers' accounts using their login credentials and, in some cases, appeared to take actions independently of users' instructions, people familiar with the matter told Axios.

AI agents are designed to perform tasks on behalf of users, including accessing financial information and making transactions. However, banks are struggling to distinguish between authorised, user-directed activity and potentially rogue agents, raising concerns about the security of customers' money.

Morgan Stanley has begun blocking third-party AI agents from accessing its platforms, according per reports. JPMorgan Chase, Bank of America and Citigroup are also restricting such access. A Chase spokesperson advised customers against sharing their login credentials with others.

A Morgan Stanley spokesperson, meanwhile, said the bank had not observed instances of "rogue AI agents accessing our platforms". Bank executives are particularly concerned about agents that have been granted permission to make purchases or transfer funds, as such access could expose customers to financial losses if the technology acts beyond their instructions.

Several banks are considering or moving towards allowing third-party AI agents read-only access, which would let them retrieve customers' financial information without making transactions. Banks already provide similar access to third-party applications, including budgeting services such as Quicken.

Despite the security concerns, financial institutions recognise that customers are likely to increasingly rely on AI agents to manage their finances. Banks are therefore looking for ways to accommodate the technology while preventing unauthorised access and transactions.

The rapid development of AI tools is making the task more difficult, with banking executives acknowledging that existing systems may not reliably identify whether account activity is being carried out by a customer, an authorised AI agent or an agent acting independently.