27th October 2026 – (New York) Major united states banks have identified third‑party AI agents operating inside customer accounts, prompting a rapid clampdown on automated tools that appear to act beyond explicit user instructions. Institutions including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and Citi are moving to curb agent activity, with several blocking or restricting access amid fears that delegated permissions could enable fund movements or other actions not clearly authorised by customers. Executives said the difficulty of distinguishing between a human user and an unauthorised bot has forced changes to terms of service and tighter controls, while call‑centre logs and telemetry have in some cases flagged agent‑like behaviour that appears independent of direct prompts.
Banks are steering towards read‑only connections that allow agents to view balances and transactions without executing payments, similar to longstanding arrangements for budgeting software, as they balance growing customer demand for automation with elevated operational and fraud risk. Industry figures acknowledge there is no evidence of widespread losses, but warn that the pace of AI development is exposing new vulnerabilities in real time. Lenders are investing in “day‑after” playbooks to secure or restore account access should worst‑case scenarios materialise, even as they emphasise that customers should not share usernames or passwords with third parties.