Unvetted AI Agents Are Accessing US Bank Accounts

An anonymous reader reports that major U.S. banks have discovered unauthorized AI agents operating within customer accounts. These agents have been observed attempting to execute actions that seem to occur independently of user instructions, according to sources cited by Axios. The challenge of distinguishing between a human and an unauthorized bot is prompting banks to disable the technology and hastily update their terms of service.

This situation poses substantial security risks, as banking executives express grave concerns that agents with login access could perform actions, particularly if users have granted purchasing authority or the capability to transfer funds. Some banks have identified activity when agents, designed to execute requests or tasks on behalf of users, contact call centers or appear to act independently of user commands.

Executives from several banks have described the scenario as alarming, emphasizing the industry's serious worries regarding agents gaining access to customer accounts and potentially impacting users' finances. Consequently, institutions such as Morgan Stanley, JPMorgan, Bank of America, and Citi have started restricting third-party AI agent access.

Despite banks' strong position to tackle the security threats and opportunities presented by AI due to their financial resources and experience as critical infrastructure, they acknowledge that the rapidly evolving nature of the technology and its ongoing revelation of vulnerabilities make it an insurmountable challenge. Banks are investing in mitigating worst-case scenarios, but they are also preparing for potential incidents through day-after-day scenario planning to swiftly secure or restore customer access.