Unauthorised AI agents access customer accounts at major US banks

Incidents have been detected at the largest US banks in which unauthorised artificial intelligence agents gained access to customer accounts.

According to a report by Axios based on sources, some of these AI agents attempted to take actions that were not included in user instructions.

Institutions facing risks arising from such agents include leading lenders such as Morgan Stanley, Bank of America, JPMorgan, Wells Fargo, and Citi.

In some cases, AI software entered customer accounts using usernames and passwords directly with user consent.

In contrast, security rules at most banks require users to log in to their accounts personally.

According to Axios, in other instances, AI agents designed to carry out tasks on behalf of customers contacted bank call centres directly or tried to take independent steps without receiving any instruction from the user.

Bank executives worry that such software with access to credentials could make unauthorized purchases or transfer funds.

Following these risks, banks are moving to restrict third-party AI agents from accessing their platforms. While Morgan Stanley has begun blocking such software, JPMorgan, Bank of America, and Citi are also introducing similar restrictions.

Banks are also considering offering a financial access model that gives AI agents read-only permissions while completely cutting off transaction capabilities.

Sources speaking to Axios point out that it is extremely difficult for banks to determine whether an agent is acting on user instructions or accessing the account entirely on its own initiative.

Regulators hold emergency meeting with systemically risky banks

According to reports by Bloomberg and the Financial Times citing sources, US Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell held an extraordinary meeting in April with top executives of the country’s largest banks over concerns about cyber threats that could be posed by a new AI model developed by Anthropic.

Sources providing details on the talks stated that US officials wanted to gauge bank awareness regarding risks tied to the Claude Mythos model and inspect the measures they have taken to protect their systems.

Senior executives from Citigroup Inc., Bank of America Corp., Wells Fargo & Co., Goldman Sachs Group Inc., and Morgan Stanley attended the meeting.

Organised at short notice, the summit indicated that regulatory authorities view this new breed of cyber attack as one of the greatest threats to the financial sector.

All of the banks represented at the table are classified as systemically important institutions within the global financial architecture.

Axios reported that leading AI firms, including Anthropic and OpenAI, harbour concerns that an AI-driven “catastrophic event” could take place over the next 6 to 12 months.