Last month, security teams at four of the largest US banks kept finding the same strange thing inside customer accounts: AI agents, logged in and quietly working away. Some were doing exactly what their owners asked. Others called support lines, moved through account settings, and took actions nobody had requested.
None of them were hackers. They were the customers’ own assistants, let in with the customers’ own passwords. That detail is what turned a routine fraud review into a policy crisis.
What the banks actually found
On October 22, Axios reported that JPMorgan, Bank of America, Morgan Stanley, and Citi are all restricting third-party AI agents after discovering them operating inside customer accounts. The agents had authenticated with customer credentials, which violates bank rules on shared logins before anything else even happens. Every single one of these sessions was a violation, including the well-behaved ones.
The troubling cases went further. Some agents acted beyond what their users instructed. Bank staff reviewing the incidents found themselves stuck on a basic question, and it is the question at the center of this whole story: from the inside, an approved agent and a rogue one look identical. Same login. Same session. No way to tell whether a human vouched for this thing or not.
One bank executive described the situation as “horrifying” when imagining what happens next: an agent that hallucinates, holding the authority to move money. That scenario isn’t hypothetical paranoia. Most of the incidents these banks reviewed involved authorized agents misreading instructions with real funds at stake. The risk isn’t a criminal with an AI tool. It’s your helpful assistant confidently doing the wrong thing.
The retreat to read-only
The banks’ response so far is a phased retreat. Morgan Stanley is blocking third-party agents outright. JPMorgan, Bank of America, and Citi are restricting them, and according to Axios, most of the industry is drifting toward view-only access while they figure out what comes next.
I think this is the correct move for right now and an unworkable position within a couple of years. Customers are adopting agents faster than banks can write policy. A blanket block holds as long as agents are a novelty. Once “my assistant pays my bills” becomes a normal expectation, the bank that requires customers to log in by hand every Monday morning will lose those customers to the bank that figured out safe delegation first.
The banks know this. That’s why the endgame everyone describes is permissioned access: cleared agents taking defined, auditable actions, with detection systems that catch genuinely rogue ones. The block is a bridge, not a destination.
The real problem is identity, not intelligence
Here’s what bothers me about most coverage of this story: it gets framed as an AI capability problem, as if the models just need to get better at following instructions. The banks’ own behavior points somewhere else. Banking authentication was built for one human with one password and one photo ID. Agents break every assumption in that stack at once.
The agent is a non-human actor. It operates under delegated authority rather than its own. It acts at machine speed, around the clock, and it can’t present ID at a branch. What’s missing isn’t a smarter model. It’s an identity layer built for software that acts on your behalf:
- Agent identity. Who is this agent, who published it, and who vouched for it? Right now banks see a borrowed password and nothing else.
- Explicit delegation. What exactly was this agent authorized to do, granted by whom, and until when?
- Labeled actions. Every agent action should appear in the bank’s logs as an agent action, attributable and reviewable by a human.
The same week this story broke, early credential products built specifically for agents started appearing. That market exists because the password-sharing workaround is the actual bug. Agents borrowing your password is the problem. Agents carrying their own verifiable identity, scoped to specific permissions, is the fix.
What permissioned access should look like
When banks formalize “cleared agents,” and they will, the framework will probably look like this:
Read-only by default. Balance checks, transaction history, statements. Anything sensitive but harmless comes standard, because watching an account is where most agent value lives anyway.
Scoped, time-boxed authority. Want your agent to pay rent? Grant it exactly that: payments to one landlord, under a fixed dollar cap, expiring monthly. Authority should look like a rental agreement, not a power of attorney.
A real audit trail. Every agent action recorded in a form a customer can actually read. Not a buried log file. A monthly statement of what your agent did, which you’d glance at the way you glance at a credit card bill.
One-tap revocation. Killing an agent’s access should be as easy as uninstalling an app. Delegation that’s hard to undo isn’t delegation, it’s a lease with no exit clause.
What to do now
If you build agents: never use customer credentials to get into a third-party system. If a bank or platform offers no agent API, that’s a no, not an obstacle to route around. Scope your permissions to the minimum that works, log every action you take, and build the off switch before you build the features.
If you deploy agents near money at your company: read-only defaults everywhere. Approval gates for anything that moves funds or sends external communications. And have a human review the action log weekly. The banks learned this the hard way; you don’t have to.
If you’re watching the space: agent identity is the near-term opportunity. The moment one major bank publishes a “cleared agent” specification, someone has to issue those clearances, verify those agents, and manage those delegation grants. Keep an eye on who moves first.
The banks panicking this month aren’t anti-agent. They’re pro-audit, and they currently have nothing to audit. The assistant that knows you well enough to run your finances also has to be known well enough to be let in the building. Neither side has that yet, and until it exists, your bank would rather your assistant wait outside.
