As consumers delegate more tasks to autonomous AI assistants, some are handing over banking credentials and allowing agents to interact directly with their financial accounts. The problem is that banks have no reliable way to determine whether an AI agent is acting within the customer’s intentions, exceeding its authority or operating without legitimate authorization.
Recent reports that major U.S. banks are detecting AI agents accessing customer accounts have brought this emerging threat into sharp focus. For CISOs, the issue exceeds traditional bot detection and account takeover prevention. It challenges fundamental assumptions about digital identity, authentication, customer consent and accountability when an autonomous system moves money.
The banking industry now faces a difficult question: How do you secure an account when the person accessing it might not be a person at all?
AI agents show up in customer accounts
An October 2026 report from Axios revealed that major U.S. banks, including JPMorgan Chase, Bank of America, Wells Fargo and Morgan Stanley, were encountering a growing number of third-party AI agents accessing customer accounts.
In many cases, customers had voluntarily provided agents with their banking usernames and passwords, allowing the agents to perform tasks on their behalf. This practice conflicts with many banks’ requirements that customers personally access their accounts.
More concerning were reports of agents apparently taking actions beyond their users’ instructions. Some AI systems reportedly contacted bank call centers or attempted activities that customers had not explicitly authorized.
Banks responded by restricting or blocking third-party agent access. Morgan Stanley, JPMorgan Chase and other institutions have taken steps to prevent unvetted agents from interacting with their platforms.
The reported activity differs significantly from conventional cyberattacks or evidence of compromised bank infrastructure, exposing a security gap that traditional banking controls were not designed to address.
AI’s Catch-22 for Banks
For financial institutions, the immediate concern with the rise of AI agents is loss of control over authenticated sessions. An agent operating with legitimate customer credentials can potentially access sensitive financial information, initiate transactions or interact with customer service systems. Traditional authentication may establish that the credentials are valid without establishing that a particular action is authorized.
The most obvious response by CISOs operating across retail finance and other sectors would be to block all automated access. This step, however, could frustrate customers who increasingly expect AI assistants to manage routine financial tasks. Allowing unrestricted access, on the other hand, could expose institutions to fraud, disputes and liability questions when an agent makes an unintended transaction.
For banking consumers, the convenience of delegating financial tasks comes with a new form of exposure. Giving an agent account credentials can reveal a wide range of financial data — transaction histories, personal information, linked accounts and payment capabilities. Consumers may also struggle to establish whether an unintended transaction resulted from their instructions, an agent’s interpretation or a security compromise.
For CISOs, this is an identity and access management issue as much as a fraud problem. Security teams must account for nonhuman actors operating with human privileges, potentially across multiple systems and over extended periods.
Is traditional fraud detection still relevant?
For years, banks have used behavioral analytics and biometrics to establish a baseline for normal customer activity. Systems monitor signals such as typing patterns, mouse movements, device characteristics, login locations, transaction frequency and spending habits. When activity deviates from that baseline, the system can flag a potentially compromised account.
But what happens when the account holder delegates access to an AI agent?
Jonathan Kreiner, CTO and co-founder at Orion Security, explains that fraud models were built to monitor human activities to determine whether a user is the real customer. An agent does not type, navigate or make decisions like its human principal, and interaction patterns may be radically different from the customer’s established behavior. A legitimate agent could therefore trigger fraud alerts simply because it behaves like a bot.
“An agent doesn’t have any of these traits,” said Kreiner. “That leaves banks two bad options. They can flag agent traffic as abnormal, which creates so much friction that it gets allowlisted. Or they can trust the agent from the start. Either way, the agent ends up in a blind spot, and if it’s compromised, the attacker gets that trust, too.”
What’s next for banking cybersecurity?
“AI agents introduce uncharted territory, so banks need to transform their security protocols to verify not just who owns an account, but which AI agent is accessing it and what permissions it has,” advised Ethan Gustav, North America group president at AI communication platform Infobip.
With a permanent ban on AI agents being unfeasible in the long term, financial institutions will need to consider developing an authorization framework that treats AI agents as distinct digital identities rather than extensions of a customer’s login credentials.
Experts suggest establishing these capabilities:
-
Unique agent identity: Every agent should have a verifiable identity, including the organization or provider operating it. Banks must be able to distinguish approved agents from unknown automation.
-
Explicit, granular delegation: Customers should authorize specific activities rather than hand over unrestricted account access. Permissions could distinguish between viewing balances, analyzing spending, initiating payments and transferring funds.
-
Time-limited, revocable credentials: Agents should receive scoped access tokens rather than customer passwords. Permissions should expire, be revocable immediately and be limited to the resources and actions necessary for the task.
-
Transaction-level controls: High-risk activities, including large transfers, new payees and changes to account security settings, should require additional customer confirmation. Banks should establish transaction limits and risk-based approval thresholds.
-
Continuous monitoring and auditability: Banks should maintain records identifying the agent, the customer who delegated authority, the permissions granted, the actions performed and the decisions made. Banks should also be able to suspend an agent when its behavior falls outside its authorized scope.
Existing security standards offer a starting point. The OpenID Foundation’s Financial-grade API (FAPI) 2.0 security profile, for example, provides a framework for protecting high-value financial APIs through strong client authentication and sender-constrained access tokens.
“AI agents have enormous potential to make banking more convenient, but as more and more people adopt this technology, there are legitimate questions about whether security measures can keep up,” warned Gustav.
“Businesses, particularly financial institutions, cannot assume that existing fraud prevention and authentication capabilities provide sufficient safeguards against AI agents that can independently access accounts and initiate transactions.”
Richard Livingston is an editor for TechTarget Cybersecurity, covering news, trends and analysis. Livingston’s professional background includes editorial positions in the national defense industry covering the U.S. Army Medical Department, as well as offensive and defensive cyber strategy for military and government audiences.
