America's biggest banks are taking the keys back from AI agents

Facts are attributed and linked to their sources. The analysis and opinions are the author's own.

What it is

On 22 October Axios reported, citing sources, that major US banks had found unvetted third-party AI agents inside customer accounts, some taking actions that appeared independent of what the user had asked. According to the report, Morgan Stanley had begun blocking third-party agents, while JPMorgan, Bank of America and Citi were restricting them. Most banks were moving agents to read-only access.

The next day, at Money20/20, Citi's Naveed Anwar was even more direct. Banking Dive reports he said Citi has "blocked anything that is trying to access our walls agentically, beyond some open banking read-only access", and wants a "know your agent" process before it opens up further. "There are places in which we want to go faster. This is not one of those places." The same report quotes PNC chief executive Bill Demchak saying no bank will let agents transact without a human in the loop.

Wells Fargo took the contractual route instead. USA Today reports that the bank's updated online access agreement, which takes effect on 24 November, makes customers "solely responsible" for supervising the agents they authorise. Transactions by those agents, "including those you did not want or intend", are treated as authorised.

Why it matters

These are two different answers to the same problem. One is technical: block the agent, or let it read but not act. The other is legal: let the agent in, but move the risk of its errors onto the customer. In my view neither is a lasting design.

Read-only is not a strategy. It is a holding pattern while banks work out who an agent is.

Blocking tends to push agents back to the worst pattern of all: logging in with a shared password. A JPMorgan spokesperson told Axios: "Under no circumstance should customers share passwords with any person or thing. Period." The contractual route has its own problem. Customers who never read their terms will carry the cost of software they did not write. And customers are already wary: USA Today cites a Ping Identity survey in which 71% of consumers said they were concerned, and 22% said they would not trust AI with any financial transaction.

The way out is the one described in last week's cover, Agents got bank accounts this week: give each agent its own identity, scoped permissions and a revocation switch, so it never needs the customer's password. David Sacks made the same point to Axios: banks should let users "grant, limit, and revoke access", and read-only should be an "interim step". My view is that the first institutions to publish a clear agent-access standard covering identity, scopes, revocation and logging will set the terms for everyone else.

What I'd watch

• Whether any large bank publishes a written "know your agent" specification that agent developers can build to.
• Whether other banks copy Wells Fargo's liability wording before it takes effect on 24 November.
• Whether agent makers move from screen-scraping with passwords to bank-issued, revocable tokens.