Morgan Stanley, JPMorgan, Bank of America, and Wells Fargo are blocking external AI agents from logging into customer accounts using personal credentials. This move stops software from accessing bank data without specific bank approval, which violates internal security policies requiring human login. While some agents act on direct user instructions, others appear to operate independently, prompting banks to restrict access entirely or limit it to read-only views. Morgan Stanley stated it has not encountered rogue agents on its platforms yet, but the risk of unauthorised action remains a primary concern. Most institutions now prefer letting users view account information through AI rather than allowing the tools to execute transactions or change settings.
The core issue is that current authentication methods, such as browser tools or open-source software, cannot easily distinguish between a user and an autonomous agent. Banks face a difficult choice between satisfying demand for automated financial assistance and preventing potential security breaches. OpenAI has responded by launching a dedicated service in the US that grants read-only access to financial data, setting a new standard for safe interaction. Until verification technology improves, banks will likely maintain strict barriers against automated login attempts.
- Read-only access is now the preferred model for most major US banks.
- OpenAI offers a specific US service for financial data access.
- Current tools struggle to differentiate between user and agent actions.
