AI Agents Pose New Security Headache For America’s Biggest Banks

Major U.S. banks moved to restrict third-party artificial intelligence agents from accessing customer accounts Thursday amid growing concerns over the security risks posed by automated financial tools.

Citi and Wells Fargo confirmed restrictions to the Daily Caller News Foundation, citing concerns about unauthorized access to customer accounts. The policies highlight a growing challenge for financial institutions as consumers turn to AI tools capable of accessing sensitive banking information and potentially conducting transactions on their behalf.

“To help safeguard customer accounts and information, we do not permit third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms,” Citi spokeswoman Gabrielle Baum told the DCNF.

“Customers can, however, continue to authorize limited, read-only access to their account information with certain Citi-approved open banking providers,” Baum added.

Wells Fargo also confirmed it has taken steps to restrict unauthorized access.

“Wells Fargo has taken steps to block unauthorized agents from accessing customer accounts,” a company spokesperson told the DCNF.

Major financial institutions, including JPMorgan Chase, Bank of America, Morgan Stanley and Wells Fargo, are confronting security concerns involving outside AI agents accessing customer accounts, according to an Axios report Thursday. Some agents reportedly appeared to take actions beyond customers’ instructions, according to people familiar with the issue cited in the report.

However, an industry source familiar with the issue told the DCNF that the immediate concern is not AI agents independently infiltrating customer accounts, but customers voluntarily sharing their banking credentials with third-party AI tools.

The source said there is not yet evidence of agents being instructed to perform one task and independently carrying out another. Rather, the activity originates with customers granting access to their accounts, creating potential security risks that banks may struggle to distinguish from legitimate customer activity.