AI agents can use credentials supplied by customers to reach bank accounts, but several major US banks are restricting that access. The dispute centers on a basic question: how can a bank know whether an agent is following a customer’s instructions, and what it might do once inside an account?
Banks are drawing limits around outside agents
Axios reports that Morgan Stanley, JPMorgan, Bank of America, and Wells Fargo are restricting access by external AI agents. The approach reflects bank policies that require account holders to log in personally.
Morgan Stanley already blocks AI agents entirely. JPMorgan, Bank of America, and Citi are also doing the same, according to the source. Morgan Stanley said it had not seen any “rogue AI agents” on its platforms, while the restrictions address broader concerns about how agents interact with accounts.
Access does not always mean permission to act
Many banks would prefer agents to have read-only access. That would let an agent view financial data without being able to carry out transactions or other account actions.
The distinction matters because seeing account information and acting on it create different levels of risk. A bank may be able to permit an agent to help a customer understand their finances while still preventing the agent from initiating changes.
Banks say customers want to use AI agents, but consider the security risks too high for now. They also may not be able to determine whether an agent is truly operating on a user’s behalf or accessing an account independently.
Customer credentials complicate enforcement
Customers can provide an agent access through a browser, including with tools like Computer Use or open-source agent software such as OpenClaw. In that arrangement, the agent uses the customer’s credentials to interact with the bank’s website.
That creates an enforcement challenge. A bank can restrict its own systems, but blocking browser-based access on the provider side will be hard. The bank may not have a clear way to distinguish a customer logging in from an automated agent using that customer’s credentials.
The issue is not simply whether an agent can reach an account. Banks also need to understand what the agent is permitted to do, whether its actions reflect the customer’s intent, and how to limit access if those answers are unclear.
Read-only services point to a possible path
OpenAI has launched a dedicated ChatGPT service for financial tasks in the US with read-only access to financial data. That model aligns with the boundary many banks want: allow an agent to work with information while withholding the ability to take actions.
Read-only access could make some financial assistance possible while reducing the consequences of an agent acting unexpectedly. But the source indicates that banks still face uncertainty about how to verify an agent’s role and control access across different tools.
For customers, the restrictions show that handing an AI agent login credentials may not be enough to ensure it can use a bank account. Banks are setting their own limits while they weigh customer demand against the risks of granting automated systems access.