Axios reported that Bank of America, JPMorgan Chase, Morgan Stanley and Wells Fargo have encountered unauthorized or unapproved AI-agent activity. Banks are increasingly favoring read-only access, where AI can view account data but cannot move money.
Main risks
AI agents can potentially:
- access accounts using customer credentials;
- initiate purchases or transfers;
- contact bank support;
- perform multi-step actions without separate approval;
- behave differently from the user's original instruction.
The key problem is authentication: banks may see a valid customer session but still be unable to tell whether the action came from the customer or an AI agent.
A valid login does not necessarily prove that the customer personally approved the action.
Previous model vs. AI agents
| Feature | Traditional banking app | AI agent |
| Main function | Read data | Read, reason and act |
| Access | API / open banking | API or browser automation |
| Decisions | Predefined rules | Model-generated |
| Money movement | Usually bank-controlled | Possible if permissions allow |
| User approval | Required for most actions | May be delegated |
| Main risk | Credential theft | Credential theft + autonomous action |
Traditional finance apps usually retrieve balances and transaction history through limited APIs.
AI agents can add:
LLM → tool layer → browser/API → bank account → action
This means the agent may not only read information but also decide what action to take.
Why banks want read-only access
A safer permission model looks like this:
- accounts.read — allowed
- transactions.read — allowed
- payments.prepare — limited
- payments.execute — blocked
- beneficiaries.create — blocked
- security.modify — blocked
The principle is simple: an AI agent can analyze financial data but should not be able to move funds without additional authorization.
Technical safeguards
Banks will likely need:
Separate agent identity. The bank should know which AI agent is acting instead of treating it as the customer.
Scoped permissions. Agents should receive only specific API rights.
Transaction limits. For example, maximum amount per transaction or per day.
Human confirmation. A payment can be prepared by AI but approved through the bank's app using biometrics or another trusted method.
Audit logs. Banks need records showing which agent requested an action, which permissions it used and whether the customer confirmed it.
A secure transaction flow could look like:
AI prepares transfer → bank sends confirmation → customer approves → bank executes
The AI never receives the final payment credential.
Why this matters
Previous AI assistants mainly followed:
Question → answer → human action
AI agents increasingly follow:
Goal → reasoning → tool use → action
That difference is critical in banking. A chatbot mistake produces bad information. An autonomous financial agent with transaction rights can produce a real financial loss.
The likely banking model is therefore:
Bank API + verified AI identity + limited permissions + human approval
For now, read-only access is becoming the safest boundary between AI assistants and customer funds.
