According to reports, a recent study indicates that several major U.S. banks have detected AI agents accessing customer accounts, with some AI agents even attempting to initiate transactions. Due to the difficulty in distinguishing between legitimate users and unauthorized AI programs, institutions such as Morgan Stanley, Bank of America, JPMorgan Chase, and Wells Fargo have begun blocking this technology and are working to modify their terms of service to include the actions of AI agents within their regulatory scope.
From a technical perspective, AI agents or AI assistants could potentially access accounts using login credentials provided by users, provided they have user authorization. However, the issue lies here. Current policies at Bank of America require users to maintain control over their accounts and prohibit sharing account access with others. Providing login credentials to an AI agent often conflicts with this regulation. Even more concerning for bank executives is the risk of loss of control: once an AI agent has login access, it may act independently without explicit instructions from the account owner, such as making purchases or transferring funds between different accounts.
Risks and Challenges Faced by Banks
Existing cases have illustrated this risk. Reports indicate that some AI agents have even bypassed direct user instructions, making phone calls to banks and taking action on their own. Logically, the user did not explicitly request the transaction, but the AI agent determined that it was a necessary step to complete its assigned task, thus proceeding autonomously. For this reason, reports highlight that distinguishing between human operations and AI agent actions is becoming a significant challenge for banks in risk management.