Rogue AI? US banks sound alarm over unauthorised access by 'agents'

Leading US financial institutions, such as JPMorgan Chase, Bank of America, and Morgan Stanley, are tightening restrictions on third-party AI agents' access to their systems due to apprehensions over potential unauthorized access leading to fraudulent transactions. Reports from Axios indicate that these concerns arose following instances where AI agents accessed customer accounts using their passwords, and in some cases, performed actions autonomously, independent of the user's commands.

AI agents are programmed to execute tasks on behalf of users, including retrieving financial data and executing transactions. However, banks are grappling with the challenge of differentiating between legitimate, user-directed activities and potentially malicious AI agents, heightening apprehensions about the safety of their customers' funds. Morgan Stanley has already started blocking third-party AI agents from accessing its platforms, while JPMorgan Chase, Bank of America, and Citigroup are also limiting such access.

A spokesperson from Chase cautioned customers against sharing their login credentials with others, while Morgan Stanley's representative asserted that they had not detected any occurrences of rogue AI agents accessing their platforms. Bank executives are particularly apprehensive about agents granted permissions to make purchases or transfer funds, as such access could expose customers to financial losses if the technology deviates from their instructions.

Several banks are contemplating or transitioning towards granting third-party AI agents read-only access, enabling them to retrieve customers' financial information without executing transactions. Banks already extend similar access to third-party applications like budgeting tools such as Quicken. Despite these security concerns, financial institutions acknowledge that customers are increasingly expected to rely on AI agents for managing their finances, prompting banks to seek ways to enable the technology while averting unauthorized access and transactions.

The rapid evolution of AI tools complicates the situation, as banking executives acknowledge that current systems may not consistently identify whether account activity is being conducted by a client, an authorized AI agent, or an agent operating independently.