Major US banks are restricting third-party artificial intelligence agents from logging into customer accounts, drawing a distinction between a customer sharing credentials with software and a bank authorizing that software to use its systems.
Morgan Stanley, JPMorgan, Bank of America and Citi are blocking such access, Axios reported, as described in the source material. Wells Fargo was also identified among banks restricting external agents. The reported measures target tools that can use customer-provided login details to navigate banking websites, rather than operating through a bank-approved connection.
The restrictions expose a growing tension between customers’ use of AI assistants and financial institutions’ requirements for account security. Bank policies can require account holders to log in personally. Giving an agent a username and password does not necessarily make its access permissible under those rules, even when the customer wants the software to perform a task.
Axios reported that some agents appear to act without direct user instructions, and that banks cannot always determine whether an automated tool is carrying out a customer’s request or accessing an account independently. Morgan Stanley, however, said it had not observed rogue AI agents on its platforms. That distinction limits what can be concluded about the activity: blocking agent access is not, by itself, evidence that an institution has experienced an unauthorized autonomous transaction.
The banks generally favor limiting agents to read-only access, allowing them to retrieve account information without initiating actions, the report said. That approach separates financial assistance based on balances or transaction histories from software with the ability to change account settings or move money. The institutions recognize customer interest in agents but consider the current security risks too high for broader access.
Browser-operating AI tools create a different access problem from conventional financial-data integrations. An agent equipped to interact with a computer can use a website’s visible interface, entering credentials and navigating pages much as a person would. Tools such as Computer Use and open-source agent software including OpenClaw can provide this kind of capability. Because the interaction occurs through a browser, preventing it is not simply a matter of disabling a dedicated connection for outside software.
The legal and operational distinction is between a customer’s permission and the institution’s access conditions. More broadly, financial services use authentication controls and contractual terms to govern who may enter an account and what they may do there. An agent’s ability to complete a login does not establish that its activity complies with those terms. Read-only access also does not eliminate privacy concerns: account balances and transaction records remain sensitive financial information.
A separate route is emerging through services designed around restricted access. OpenAI has launched a US ChatGPT service for financial tasks that provides read-only access to financial data. That model allows software to use account information while withholding the ability to carry out transactions—the boundary banks currently want to preserve.
Sources: Reuters, The Decoder