US media outlets reported on Thursday that several major US banks have discovered unauthorized third-party AI agents operating in customer accounts. According to people familiar with the matter, some agents attempted actions beyond the scope of customers’ original instructions, raising concerns at the banks.

These agents typically enter accounts after users voluntarily provide login credentials, but most banks’ terms of service still require customers themselves to complete the login process. Even with customer consent, allowing a third-party AI to act on their behalf may cross policy boundaries. Banks are concerned that once an agent obtains login access, particularly for transfers, purchases or fund movements, its subsequent behavior may be difficult to fully predict.

Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo are accelerating efforts to identify and contain related risks. People familiar with the matter said some banks have already detected signs of abnormal access. Morgan Stanley has begun blocking third-party AI agents from accessing its platform, while JPMorgan, Bank of America and Citigroup are tightening access controls. Chase, JPMorgan’s consumer banking arm, said customers should not share their usernames and passwords with anyone. Morgan Stanley said it has not yet found evidence of so-called “runaway AI agents” entering its platform.

Many banks are not entirely opposed to AI. Read-only access has drawn considerable discussion, with some institutions allowing or considering allowing agents to view account information but not execute transactions. Similar approaches have previously been seen in third-party financial tools such as budgeting applications. Banks believe customers may increasingly want to use AI to handle routine financial matters, requiring a balance between risk control and functional openness.

The bigger headache for banks is that existing systems often struggle to determine accurately whether a transaction was initiated by the customer or by an AI agent. One bank executive said distinguishing among different AI agents is not straightforward, and banks also find it difficult to confirm whether an agent is genuinely authorized or has deviated from the user’s intent and acted on its own.

To prepare for potential incidents, banks are investing in stronger safeguards and developing “day-after” contingency plans. The plans focus on quickly securing customer accounts, restoring normal customer access and minimizing potential losses. People familiar with the matter said AI technology is evolving rapidly, new vulnerabilities could emerge at any time, and banks must both prevent the worst-case scenario and be ready if it materializes.