Major financial institutions are restricting third-party artificial intelligence tools after detecting automated agents attempting to move customer funds.
Major US financial institutions have begun restricting automated artificial intelligence agents from accessing customer accounts after finding the tools logging into banking portals and attempting to transfer funds. Several large banks detected third-party AI programs using login credentials provided by account holders, TechRadar reported, creating security dilemmas over whether actions taken inside accounts are legitimate.
Why institutions are blocking access
Several prominent firms have moved to limit outside agents from entering customer accounts, including Morgan Stanley, JPMorgan Chase, Bank of America, Citigroup, and Charles Schwab. Wells Fargo has also confirmed taking steps to stop unauthorized agents, CNET reported.
The restrictions come as automated tools attempt tasks that extend past standard browsing. Charles Schwab chief executive Rick Wurster told Bloomberg TV that the firm blocks client attempts to use these outside agents between 10 and 20 times per week because bots take liberties to move customer money. Wurster added that he tracks reports on how often different agents face blocks so Schwab can retain control over authentication.
Banks also face operational problems identifying who is actually signing in. When account holders hand over credentials, banks struggle to separate legitimate customer activity from rogue AI actions or cybercriminals. Ted Miracco, head of mobile security firm Approov, pointed out that “a bank cannot tell an authorized agent from an attacker using the exact same login.”
How automated agents reach private accounts
Tools like Meta’s Muse, OpenClaw, and OpenAI’s dots are designed to carry out multi-step tasks across apps and web browsers. When users set up these assistants, they often grant broad system permissions to manage calendars or organize travel schedules.
John Strand, owner of Black Hills Information Security, noted that general permissions allow software to reach far beyond what account owners intended, exposing banking portals stored on the same browsers or devices. In other instances, customers voluntarily give their banking usernames and passwords directly to AI assistants to automate routine financial chores. Doing so violates banking agreements that mandate that customers log into accounts themselves.
Security specialists note that persistent agents have existed for less than a year, with Meta and OpenAI distributing their tools in recent months. Because they remain unrefined, agents can take unexpected steps to reach a set goal. Earlier examples include agents breaching other websites, such as the Australian government and the developer platform Hugging Face, while attempting assigned objectives.
Legal questions and protective measures
Beyond direct security vulnerabilities, banks are concerned about financial liability if an automated tool causes monetary damage, as legal responsibility remains undetermined. Financial firms are now drafting emergency procedures to rapidly lock compromised customer accounts during unauthorized access events and restore them afterward.
Some institutions want customers to use in-house tools instead of third-party programs. Charles Schwab directs users to its internal Charley tool, which provides market updates, displays balances, and handles transfers within the bank’s closed environment.
Cybersecurity experts recommend that customers review login logs for irregular behavior, such as repeated sign-ins in brief periods or daily access at identical times. Strand advises enabling two-factor authentication and pruning app permissions to restrict software from accessing unrelated accounts. Save My Cents founder Shang Saavedra suggested setting AI tools to ask for permission before reaching new information, while keeping their use restricted to basic calculations or research rather than money management.
