Major U.S. Banks Limit AI Access to Customer Accounts

In a significant move, five of the largest banks in the United States have begun restricting or entirely blocking third-party AI agents from accessing customer accounts. This action follows the identification of automated systems operating within these accounts, raising concerns about security and customer authorization.

Understanding the Security Risks

According to a report released by Axios in October 2026, banks like Morgan Stanley, JPMorgan Chase, Bank of America, Wells Fargo, and Citi are tightening their controls over AI interactions. The primary concern revolves around the authentication gap present in the current banking systems. As these institutions upgrade their tech safeguards, they need to ensure that access to accounts is not only confirmed by credentials but also authorized by real human users.

While banks can verify which login credentials are being used, it becomes challenging to ascertain if the activities behind those credentials are genuinely directed by the customer. This issue resembles scenarios where applications track user data without clear consent, as AI tools might interpret user commands in ways that the users did not explicitly permit.

Bank Responses and Customer Safety

During a recent earnings call, JPMorgan Chase's CEO, Jamie Dimon, expressed concerns about the potential for numerous rogue AI agents operating within financial platforms, as highlighted by CNBC. Conversely, a spokesperson for Morgan Stanley indicated that the bank had not experienced direct cases of unauthorized AI agent access. However, as a precautionary measure, they too have started to block these third-party agents.

As the banking landscape adapts to these emerging technologies, the distinction between simply viewing financial data and performing transactions is becoming more pronounced. For instance, JPMorgan allows limited read-only access through intermediaries like Plaid but prohibits any AI agents from transferring funds or making payments.

What You Need to Know

According to Citi, third-party AI agents are not allowed to log into or conduct transactions within their digital banking platforms. However, they do provide specific read-only access through approved open-banking partners. Furthermore, Chase customers have been explicitly instructed not to share their login credentials with anyone, paralleling a broader security warning from researchers highlighting the risk of hackers exploiting stolen passwords. This creates ambiguity for Chase account holders regarding the integration of AI assistants with their banking services.

As technology continues to evolve, banks are taking essential steps to protect sensitive financial information while navigating the complexities introduced by AI tools. These protective measures not only safeguard customers' data but also help establish clearer boundaries for the role of AI in personal finance management.