AI agents are logging into bank accounts, and Wall Street can't tell who authorised what

America's biggest banks are trying to limit AI agents that enter customer accounts. According to an Axios investigation based on financial-sector sources, some of these agents appear to attempt actions that go beyond what their users asked for. Morgan Stanley has reportedly begun blocking third-party agents on its platforms. JPMorgan, Bank of America and Citi are also restricting access, and Wells Fargo is named among the institutions trying to contain the risk. The most revealing detail comes from executives quoted in the report. They say they cannot always tell whether a person or a program is on the other side of the screen, or be sure what the account holder authorised.

The facts are thinner than the alarm suggests. The report does not say how many accounts were involved or what transactions the agents attempted. It does not report any losses. A Morgan Stanley spokesperson told Axios the bank had not seen 'out of control' AI agents accessing its platforms. In most of the cases described, the agent got in with the customer's consent: the customer handed over a username and password to get a task done. The more worrying episodes in the investigation are agents phoning call centres or seeming to act outside their instructions. They are real signals, but for now they are anecdotes, not evidence of a pattern.

An 'agent' is different from a chatbot because it can act. It can log in, click, buy and move money on someone's behalf, within whatever permissions and tools it has. That splits security into two questions. The first is who can get into an account. Banks have spent decades on that one. The second is what an agent may do once inside. A valid password answers the first question but says nothing about the second. Customer consent doesn't settle it either, because the bank never authorised the arrangement. Access terms often forbid a third party from logging in as the user.

Chase's terms of use show where this is heading. The bank requires agents to identify themselves as agents and to generate recognisable traffic. They must also answer truthfully when asked whether they are a human or an AI. Chase reserves the right to limit, suspend or cut off their access. The terms also make the user responsible when an agent misreads instructions, takes unwanted actions or exceeds the authority it was given. In other words, the bank is shifting the risk onto the customer before there is any shared standard for how agents should behave.

Our reading: this is the agentic era's first real collision with regulated infrastructure, and it matches a thesis we have argued before. The short-term danger of agentic AI is not a rogue superintelligence. It is automation operating in systems that were built for humans. That includes fraud, which the report links to recent AI-assisted attacks such as a campaign against financial firms in South Korea that ended in data theft. The current response is defensive and crude. Banks block agents, and customers are told never to share credentials. That is reasonable as a first step, but it doesn't scale. Users will keep delegating tasks because doing so is useful.

The lasting fix is not a ban. It is what we have called the 'plumbing': verifiable agent identity, permissions limited by scope and amount, explicit confirmation for sensitive actions, and clear rules on who is liable. Open banking already moved from screen-scraping to authorised APIs, and agents will probably follow the same path. Whoever defines those standards, whether banks, regulators or AI platforms, will shape who controls financial delegation. We see a hopeful outcome here. Agents that can safely handle paperwork, payments and comparisons would take a lot of administrative load off people. Getting there requires that a bank can always know who is acting, and on whose authority. The alarm about these agents is justified, and so far it is about how the system is designed, not about losses anyone has documented.