Top U.S. banks are putting new limits on third-party AI agents after finding software operating inside customer accounts. In some cases, the agents used customers’ own usernames and passwords, then took actions those customers had never requested.
The issue has pushed JPMorgan Chase, Bank of America, Morgan Stanley, Wells Fargo, and Citi to rethink how outside software can interact with financial accounts. Most banks are moving toward read-only access, while Morgan Stanley is blocking third-party agents and Chase has also begun restricting access.
That response reflects a problem banks have not solved: software can act inside an account, but banks still struggle to tell whether the activity came from a person, an authorized agent, or a rogue agent.
Why banks are treating agents as a financial risk
Bank executives described the situation as “horrifying,” with one official saying the industry has grave concerns about agents gaining access to customer accounts and taking steps that could impact user finances. The fear is not limited to an agent making a mistake while reading account information. Executives worry that an agent could hallucinate and affect a user’s finances if it received authority to make purchases or move funds.
Most cases did not involve rogue hacks. They involved users authorizing agents, then allowing those agents to log in with credentials that banks expected customers to keep private. That distinction matters, but it does not remove the risk. An authorized tool can still take an action the user did not request, especially when it has access to account functions beyond reading information.
A Chase spokesperson said customers should not give their usernames and passwords to anyone. That warning captures the conflict at the center of the issue: customers want to use AI agents, but banks built their account protections around people controlling their own credentials and actions.
Morgan Stanley has taken the strictest position among the named banks by blocking third-party agents. A Morgan Stanley spokesperson said the bank hasn’t observed instances of “rogue AI agents accessing our platforms.” Even so, the bank is restricting third-party AI agent access as other institutions work to limit what these tools can do.
Read-only access becomes the middle ground
Most banks have authorized, or are moving toward allowing, read-only access for AI agents. That approach lets software view account information without giving it permission to buy something or move funds. It does not remove every concern, but it creates a boundary between gathering information and taking financial action.
JPMorgan Chase, Bank of America, and Citi are restricting third-party agents, while Morgan Stanley and Chase have begun restricting access as well. These steps show banks are trying to find a middle ground rather than reject AI agents entirely. Customer demand gives them a reason to keep looking for a workable path.
The challenge is identifying what kind of software is using an account and whether the customer approved it. Banks are investing in ways to prevent worst-case scenarios and preparing for potential security breaches, while also trying to support the agent activity customers want.
That balancing act will grow harder as more agents reach financial services. IDC projects that active AI agents will grow from 31 million in 2025 to 2.45 billion by 2030. With that many agents in use, a policy built only around blocking access would face pressure from customers, while unrestricted access could expose accounts to unwanted purchases or fund transfers.
Visa and Mastercard are part of the industry framework surrounding AI agent activity, but individual banks still must decide how agents can interact with customer accounts. The immediate direction is clear: limit outside software, separate reading from financial action, and monitor activity that banks cannot yet classify with confidence.
The developments dated Oct 22, 2026, and Oct 23, 2026, point to a financial system preparing for agents before their numbers reach the levels projected for 2030. Banks are not treating every agent as a rogue attacker. They are treating access itself as a risk that needs stronger boundaries.
For customers, the current rules are simple even as the technology becomes more complex: banks are restricting third-party agents, read-only access is emerging as the safer option, and customers should not give their usernames and passwords to anyone. The next stage will depend on whether banks can distinguish approved software from unwanted activity without blocking the tools customers are asking to use.
Based on
