Your Bank Blocked Your AI Agent. Here's the Way Back In

Bank of America, JPMorgan Chase, Morgan Stanley and Wells Fargo have started blocking or restricting third-party AI agents from operating inside customer accounts, according to an Axios investigation. The uncomfortable part: none of this required a breach. Customers handed over their logins, and the agent went to work.

That shifts the practical question for anyone automating their finances. It is no longer "which agent is smartest." It is "what access does it actually need, and who eats the loss when it guesses wrong." Here is what the banks found and how to run an agent without getting locked out of your own money.

What the banks are actually seeing

The reported pattern is messy rather than dramatic. Agents contacted bank call centers and took actions customers had not asked for. Some tools harvested credentials by scraping banking interfaces, a method banks already block. And once an agent sits behind a real customer login, the bank has no reliable way to tell a human from software.

Chase now discourages customers from disclosing account credentials to any third party, AI agents included. Morgan Stanley, for its part, says it has not itself observed rogue agents inside customer accounts, which is the kind of detail that separates a real incident wave from a cautious industry flinch.

Jamie Dimon's framing was blunt: letting any outside agent into JPMorgan's systems is "too risky for clients and for JPMorgan." Bianco Research's Jim Bianco offered the cynical read during an Unchained livestream, asking banks whether they are protecting customers or protecting the revenue from cash that sits idle in low-interest accounts. Both can be true at once. A security problem and a business incentive are not mutually exclusive.

Strip the noise and four things changed at once.

• Agents reached bank call centers and requested actions no customer had approved.
• Some tools scraped account interfaces to obtain credentials instead of using approved connections.
• Banks lost the ability to tell a customer's own click from an agent's click behind the same login.
• At least four major institutions, including Chase and Bank of America, moved from watching to blocking.

Bank of America's line to customers is the part that should change your behavior: if you share your credentials, you are responsible for the activity that results from that access. That is a policy position, not a legal ruling, but it tells you where the argument will start if an agent moves money you did not intend to move.

Ted Miracco, CEO of Approov, put the technical failure plainly. There is no machine gone rogue in this story, only people handing banking credentials to AI software and vendors shipping agents that ask for them. He calls it an identity failure rather than an AI failure: an authorized agent and an attacker using the same login look identical to the bank.

How to keep automation without losing the account

You do not have to choose between a useful assistant and a working bank login. You have to choose the access path deliberately.

1. Never paste banking passwords or one-time codes into a general-purpose chat assistant. If a tool asks for them, that is the signal to stop, not a setup step.
2. Prefer the bank's own connection route. Aggregator links and official integrations keep you inside the terms of service instead of outside them.
3. Take read-only when read-only is enough. Budgeting, transaction review and rate comparison do not require payment authority.
4. Scope the data, not just the permission. An agent comparing savings rates does not need your statements.
5. Read confirmation prompts properly. Treat each one as the last checkpoint before money moves, because it usually is.
6. Test with a small account first. A dedicated account with limited balance turns a bad agent decision into an annoyance instead of an incident.

The pattern behind all six: least privilege. Give the agent the narrowest slice of access that still completes the task, and keep the irreversible actions in your hands.

What read-only does not fix

Axios reported that many banks already allow, or are moving toward allowing, read-only agent access. That is a meaningful boundary. It is not a privacy guarantee. An agent that can read statements can still leak them if the service behind it is compromised or manipulated, and blocking transactions and protecting confidentiality are two separate problems.

The threat is not theoretical. In October 2026, several South Korean banks were hit using ARTEX AI, an open-source penetration-testing tool that lowered the skill bar for attackers and exposed personal data belonging to more than 140,000 customers.

So the useful mental model is this. An assistant that researches rates is a search engine with opinions. An agent that can log in and act is a delegate with your signature. Use the first freely. Lend the second the keys only when the task genuinely requires it, and take them back when it is done.