AI Agents Are Already Inside Banks. Their Risk Framework Isn’t Ready.

Agentic Crooks Look for Value Like Bears Look for Honey

It is natural that AI will be used to attack asset holders. Bad actors will point AI at any store of value. Today, some banks cannot reliably tell a customer from the customer’s AI agent, and that gap is a risk-control problem, not a technology problem. On October 22, Axios reported that major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts. Morgan Stanley has begun blocking them. JPMorgan, Bank of America and Citi are restricting them. One bank executive told Axios the bank struggles to tell whether an agent was authorized by a customer or has gone rogue.

The sourcing is anonymous, and a Morgan Stanley spokesperson said the bank has not seen “rogue AI agents” on its platforms. I treat the story as an early signal, and it exposes a weakness that mid-market banks share, and they have far less money to fix their cybersecurity posture than the giants do. I discussed this emerging vulnerability last week with Michael Glotz, Bert Knotts and Amitabh Bhargava, principals at SRA Consulting, a leading firm that provides risk consulting and tools to mid-market banks with decades of experience in the field.

The login no longer proves intent

They noted most of these cases are not break-ins in the usual sense. A customer gives an assistant a username and password, and the assistant logs in as the customer. Most banks forbid that, because they require humans to log in to their own accounts. It also leaves the bank blind. A customer’s agent, a criminal’s agent and a customer’s agent that drifts off task all arrive with valid credentials.

Most banks now allow, or are moving toward, read-only access, the same arrangement they already grant budgeting apps such as Quicken. That is a sound first step. Your next step is a way for legitimate agents to identify themselves, with permissions that are scoped, revocable and logged.