Major U.S. banks are detecting unauthorized third-party AI agents attempting to access customer accounts, an Axios report says.

The report added that some unvetted agents appear to be attempting actions independently of user instructions.

“The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even ‘day after’ scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said,” Axios Senior AI reporter Madison Mills wrote.

“Several bank executives told Axios they’re struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior,” she continued.

Axios explained further:

Banks including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and others are racing to contain agent risks. Some are aware of unauthorized access, people familiar with the issue said.

ADVERTISEMENT

These are generally situations when an agent or AI assistant accesses a human’s account with the user’s permission and login credentials. Even if permitted by the user, this goes against the guidelines of most banks requiring that humans log in to their own accounts.

This presents significant security risks: Banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds.

In other instances, some banks have tracked activity when agents — programmed to fulfill requests or complete tasks on a user’s behalf — contact call centers or appear to take actions independent of user instructions, the people said.

Bank executives described the situation as horrifying, with one official saying the industry has grave concerns about agents gaining access to customer accounts and taking steps that could impact user finances.

“Imagine a rogue AI agent liquidating your bank account and investment portfolio. If you are the only victim, I suppose you could get made whole by the AI company responsible. If rogue agents liquidate hundreds of billions across millions of accounts, the AI company would go bankrupt and you wouldn’t get made whole,” Florida Gov. Ron DeSantis commented.

“Imposing criminal liability on AI executives might help mitigate it at the front end, but once the crime is complete and you lose everything criminal responsibility will be necessary but completely insufficient,” he added.

Reuters has more:

JPMorgan Chase CEO Jamie Dimon earlier this month said the largest US lender was developing tools to navigate the risk of AI agents carrying out tasks on their own.

“We’re not going to allow just any outside agent to come in inside ​the company because that’s ​just too risky ⁠for clients and for JPMorgan,” he said at the time.

Charles Schwab CEO Richard Wurster earlier this month also said the brokerage ​was blocking unauthorized agents.

ADVERTISEMENT

“I get a report every day tracking ​how many ⁠times we’ve had to block one of the different agents, and it’s not many because I think people aren’t using it in that way in their financial life. We ⁠are blocking ​it because we want to have control over ​authentication and the experience,” Wurster said.

Watch additional coverage below:

 

Join The Conversation. Leave a Comment.