by 
Several of the largest US banks have started throttling AI agent activity on their networks after spotting unauthorized third-party agents operating inside customer accounts. The move marks one of the first visible institutional responses to a problem the financial sector has long seen coming: software that acts on a person’s behalf, using that person’s login, in ways the bank cannot easily verify.
Major Lenders Move to Contain Agent Risk
Axios reports that Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and other institutions are working quickly to limit exposure after finding agents attempting actions that appeared to be unconnected to any instruction from the account holder. Rather than waiting for a full set of technical safeguards, the banks have chosen to slow or restrict agent traffic first and sort out the details afterward.
Security leaders describe the step as a significant signal. Ram Varadarajan, CEO of cyber deception and active defense company Acalvio, called it the first major institutional line in the sand. In his view, it shows that banks cannot yet distinguish a faithful agent from a rogue or manipulated one, so they are choosing control over convenience.
Varadarajan explained to that an agent holding a customer’s credentials looks identical to the customer. A capable agent can be hijacked or misled, and may even learn to conceal its own behavior. When that happens, the bank loses the ability to tell genuine intent from impersonation.
A Squeeze Between Customer Demand and Liability
The banks are caught between two pressures, according to Chris Hughes, vice president of security strategy at AI security and governance firm Noma Security. Customers are adopting AI tools quickly, and an institution that shuts out agents entirely risks looking like the less useful option. No bank wants to fall behind competitors on that front.
On the other side sits liability. Banks are on the hook when money leaves an account, and today they cannot reliably tell a customer from that customer’s agent, or from an agent acting entirely on its own initiative.
Hughes pointed out that the systems banks rely on were designed with a human in mind. Fraud detection, authentication and session monitoring all assume a person is sitting at the keyboard. Restricting access is therefore the cleanest lever available while better controls are developed. He added that when institutions with that much regulatory experience make this tradeoff in public, every enterprise rolling out agents should see its own situation reflected in it.
Why a Valid Login Proves Little
Patrick Harr, CEO of AI-powered fraud and anti-money laundering platform DataVisor, said banks have traditionally treated a valid login as evidence that a human is behind it. Agents undermine that assumption.
Harr noted that, according to Axios, several large banks cannot reliably determine whether an agent is following a customer’s instructions, has been compromised, or is an unauthorized actor that has slipped in. He described this as the same blind spot that account takeover fraud has always exploited, only now at higher volume and with more convincing behavior.
Even legitimate, authenticated agents create trouble. A bank may be unable to tell whether such an agent is doing what the customer actually wanted or simply making an error, such as misreading an instruction or sending a payment to the wrong place. Harr summed up the banks’ posture by saying they are putting visibility ahead of convenience, because a risk that cannot be seen cannot be managed.
Shrinking the Attack Surface
Erich Kron, a CISO advisor at digital workforce cybersecurity company KnowBe4, said limiting agent access goes straight at the attack surface created by unverified, autonomous integrations plugging into core financial systems. In banking, he noted, integration flaws are not ordinary IT bugs. They are high-stakes events, and data loss can bring severe enforcement penalties.
The business consequences arrive quickly as well. Kron cited a figure suggesting that one in three financial services clients will switch providers after a data incident, which makes reputational damage an immediate operational concern rather than a distant one.
He also highlighted a deeper technical issue. Because autonomous agents can carry out actions instead of merely reading information, banks are effectively acknowledging that legacy perimeter tools and static security policies cannot govern non-deterministic machine behavior. Rules written for predictable software struggle when the software itself decides what to do next.
Read-Only Access: A Useful Start, Not a Cure-All
Axios also reported that most banks have approved, or are moving toward, read-only access for agents. Under this arrangement, an agent can view customer financial information but cannot move money or alter account details. The model resembles the access banks already grant to third-party apps such as Quicken.
Dan Moore, senior director of customer identity and access management strategy and identity standards at FusionAuth, agreed that read-only is the right default because it reduces the potential damage if something goes wrong. But he cautioned that it is not the safety guarantee some people assume, since agents can still leak the data they read. He recommended treating it as one layer in a defense-in-depth approach, combined with short-lived, scoped credentials and a separate identity for the agent itself.
Moore also raised the issue of pace. In his view, the real problem is the mismatch between how fast AI is advancing and how slowly bank software development processes move. Attackers can adopt a new tool the same afternoon it appears, while a bank may need an entire quarter just to approve a pilot.
Chris Jacob, field CISO at cybersecurity company Securonix, said read-only access is a sensible place to begin. It lets an agent help with budgeting or account monitoring without the power to transfer funds. Still, he urged caution about the word “only.” Transaction history can expose a person’s employer, medical spending, travel habits and income, and that information can be copied or retained even after the customer disconnects the service.
Jacob’s advice to banks was to supply data through a controlled connection instead of allowing agents to browse the regular banking site using customer credentials.
The Usefulness Trade-Off
Read-only access carries a cost of its own. Noma Security’s Hughes noted that it caps the usefulness customers actually want. An agent that can only look is far less valuable to the people it serves, and users will keep reaching for more capable tools regardless of what banks permit.
His proposed answer is scoped, revocable and monitored delegation. Under that model, an agent would receive limited permissions that can be withdrawn at any time, and its activity would be watched continuously. Higher-risk actions would require step-up confirmation from the human, meaning the customer must explicitly approve them before they go through.
Shared Credentials Blur Accountability
Some experts argue the story is less about rogue machines and more about how people and vendors are behaving. John Carberry, chief marketing officer of managed IT company Xcape, said the financial industry now faces a collision between open banking mandates and credential-driven AI automation, creating immediate fraud and compliance risks.
According to Carberry, AI companies are aggressively deploying products built to parse financial records, which has led to automated tools operating with delegated credentials. While the “rogue agent” label makes for sensational headlines, he said the technical reality is simpler: consumers are willingly handing access to third-party tools that run poorly scoped workflows.
Ted Miracco, CEO of mobile application security company Approov, made the point more bluntly. In his words, there is no machine gone rogue in this story. There are only irresponsible people giving banking credentials to AI software, and vendors shipping agents that ask for them. Both are human decisions, he said, and both should carry financial consequences, though right now neither clearly does.
Miracco described the underlying flaw as one of identity rather than intelligence. By building agents to impersonate customers and then relying on shared credentials, the industry has made it impossible for a bank to tell an authorized agent from an attacker using the same login. He called that more of an identity failure than an AI failure.
What Comes Next
The experts quoted share a common conclusion: the current restrictions are a stopgap, not a destination. Banks are limiting agents because the tools to verify them do not yet exist at scale, not because they oppose the technology.
Miracco laid out what would need to change. Until agents carry verifiable identities, scoped permissions and an audit trail, he said, blocking them remains the most defensible control a bank has. Other voices in the article point toward similar building blocks: separate identities for agents, short-lived credentials, controlled data connections instead of screen-level access, and human confirmation for risky actions.
For enterprises beyond banking, the lesson is hard to miss. Institutions with long regulatory experience and deep security budgets are openly admitting they cannot yet tell a customer, a customer’s agent and an impostor apart. Any organization preparing to let agents operate inside its systems may soon face the same question, and the banks’ cautious response offers an early preview of the trade-offs involved.
