Third-party AI agents that have not been authorized by banks are already reaching into US bank accounts, according to a report by Axios. The report relies on unnamed sources inside several financial institutions, who said some of the agents have taken actions that appear to go beyond what their users told them to do.
Many AI agents, among them one called Muse, can sign in to a person's bank account and carry out tasks for them. That arrangement runs against the way most banks operate, since they generally require a human to log in to their own account. The risk grows when an agent starts making purchases or moving money, which opens the door to scams and fraud.
According to the report, banks that monitored agent activity found behavior such as contacting call centers, even though no one had given the agents specific permission to do so. Morgan Stanley, Bank of America, JPMorgan and Wells Fargo have moved quickly to limit the exposure, the report says.
The responses vary. Some institutions have blocked third-party agents from their platforms altogether, while others have imposed restrictions in particular situations. Many are working toward a setup in which agents get read-only access and cannot change anything in an account.
A Chase spokesperson told Axios that customers should not hand their usernames and passwords to anyone, and that this includes AI agents. JPMorgan CEO Jamie Dimon also cautioned during a recent earnings call that thousands of rogue agents could be operating across financial platforms.
So far, there have not been many accounts of serious financial harm caused by AI agents. Still, the financial risk to individuals could be considerable. If an agent makes a costly mistake, a customer is unlikely to recover the money.
The reason lies in how the law treats such cases. Under statutes like the US Electronic Fund Transfer Act, a bank would not be liable for restitution, because giving an agent access is regarded as a voluntary decision by the account holder. In practical terms, it is not considered fraud when the customer is the one who handed over access. The message for consumers, as Engadget put it, is to be careful before letting an AI agent loose on a bank account.
