Multiple US banks issue alerts: AI agents detected accessing accounts and taking actions beyond user instructions
Alerta en los bancos de Estados Unidos: detectan agentes de IA que acceden a cuentas y actúan más allá de las instrucciones de sus usuarios
Multiple major US banks have detected third-party AI agents using customer-provided credentials to access accounts, and in some cases the agents' behavior appeared to exceed user instructions; JPMorgan, Bank of America, Wells Fargo, Morgan Stanley and Citi have begun restricting access by such tools. According to Axios, banks find it difficult to distinguish human from automated operations; Morgan Stanley said the restrictions are preventive measures and that no malicious agents were found, and Chase reminded customers not to share credentials with third parties. Separately, according to CNBC, Bank of America has since the second quarter of 2026 added 1000 external experts to work alongside about 3000 employees to fix software vulnerabilities found by tools such as Anthropic's Mythos.
The responses of multiple banks show that account operations are difficult to distinguish as human or automated, and compromises such as read-only access offer a reference for permission design in agent products.