Major US banks lock out AI agents that log in with customer credentials

What's going on

Several large US banks are cracking down on AI agents that log in to customers' bank accounts using the customers' credentials. Axios reported the story, and The Decoder summarized it. The banks named are Morgan Stanley, JPMorgan, Bank of America, Wells Fargo and Citi. An AI agent here is a program that carries out tasks on a person's behalf on its own, for example by clicking through a browser and filling out forms.

What the problem is

The agents access accounts using credentials that customers hand over, without the banks having approved them to do so. That violates bank policies, which require the account holder to log in personally. According to the report, some agents even seem to act on their own, without direct instructions from users. There's another problem: many banks can't tell whether an agent is acting on a user's behalf or accessing an account on its own initiative.

How the banks are responding

According to the report, Morgan Stanley already blocks AI agents entirely. JPMorgan, Bank of America and Citi are following. Morgan Stanley stresses, however, that it hasn't observed any "rogue AI agents" on its own platforms. Going forward, most banks want to allow read-only access. Agents could then view account data but couldn't carry out actions such as transfers. The banks acknowledge that customers want to use AI agents, but say the security risks are currently too high.

Technical hurdles

With Computer Use (an AI model operates the computer like a human) or freely available agentic software such as OpenClaw, users can give their agents access to their account through the browser. Blocking that on the provider side is likely to be difficult, since such access is hard to tell apart from a person browsing. Meanwhile, OpenAI launched a dedicated ChatGPT service for finance tasks in the US, with read access to financial data.

Our take

The conflict reveals a gap: users want agents for financial tasks, but banks have no established ways to identify agents securely and assign responsibility. Read-only access is a compromise. It remains to be seen how effective the blocks are technically and whether official interfaces for agents will emerge. The information comes from a media report; the source names no specific incidents or damages.