Major U.S. banks are detecting unauthorized third-party AI agents attempting to access customer accounts, according to industry insiders. These unvetted agents sometimes operate independently of user instructions.

Banking executives describe a situation that has alarmed them as they race to restrict access to their systems. The rapid pace of AI development is outpacing financial institutions’ ability to respond effectively. Several banks are now preparing for worst-case scenarios, including how to rapidly secure or restore customer accounts in the event of system breaches.

Industry executives noted that distinguishing between human users and AI agents has become increasingly difficult. One executive stated that banks struggle to determine whether these agents are authorized by customers or potentially operating without permission—behavior resembling rogue agents.

Banks including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo, and others have reported detecting unauthorized access incidents. These typically occur when an AI agent accesses a human’s account using the user’s permitted login credentials and permissions. However, such actions violate most banks’ guidelines requiring direct human logins to accounts.

This situation presents significant security risks. Banking executives fear agents with access could take steps impacting customer finances—especially if users have granted purchase authority or fund transfer capabilities. Some institutions also track activity when AI agents contact call centers or perform actions independently of user instructions.

One executive described the scenario as “horrifying,” expressing grave concerns about unauthorized agents gaining access and taking financial steps that could affect millions. Florida Gov. Ron DeSantis warned: “Imagine a rogue AI agent liquidating your bank account and investment portfolio. If you are the only victim, I suppose you could get made whole by the AI company responsible. But if rogue agents liquidate hundreds of billions across millions of accounts, the AI company would go bankrupt and you wouldn’t get made whole.”

JPMorgan Chase CEO Jamie Dimon stated his bank is developing tools to navigate risks posed by autonomous AI agents: “We’re not going to allow just any outside agent to come in inside the company because that’s too risky for clients and for JPMorgan.”

Charles Schwab CEO Richard Wurster reported daily tracking of blocked agents: “I get a report every day tracking how many times we’ve had to block one of the different agents, and it’s not many because I think people aren’t using it in that way in their financial life. We are blocking it because we want to have control over authentication and the experience.”