Major US banks detect unauthorized AI agents operating in customers’ accounts. Some of these intruders attempt to perform actions that appear to be independent of user instructions.
AI agents are becoming a nightmare for American banks. They infiltrate banking systems faster than financial institutions can respond. The difficulty in distinguishing between a human being and an unauthorized bot forces banks to block this technology and quickly change their terms and conditions of use, reports Axios.
Several in the US, including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo, are making intense efforts to limit the risks associated with these agents. Some of them are aware of unauthorized accesses, sources familiar with the issue told the cited publication.
How AI agents come to operate in bank accounts
Generally, these are situations where an AI-based agent or assistant accesses a person's account using the user's permission and authentication data. Even if the user consents, this contradicts the policies of most banks, which require users to personally log into their own accounts, writes the publication.
Bank representatives are concerned about the actions that agents with account access might undertake, especially if the user has granted them the right to make purchases or transfer funds.
In other cases, banks have identified situations where agents—programmed to resolve requests or perform tasks on behalf of the user—have contacted call centers or performed actions that were not dictated by user instructions, sources said.
Banking executives have complained that the situation is terrible; one official stated that the industry is deeply concerned that AI agents gaining access to customers' accounts could undertake actions that affect users' finances.
What measures US banks are taking
According to sources, Morgan Stanley has begun blocking third-party agents' access to its platforms. JPMorgan, Bank of America, and Citi are also restricting access for these agents.
Customers should not disclose their usernames and passwords to anyone, a Chase Bank spokesperson said.
Most banks have authorized—or are moving towards authorizing—read-only access, which would allow agents to view customers' financial information without being able to perform transactions.
Banks already provide such access to third-party applications, such as Quicken, used for budget management and other activities.
Banks seek a middle ground
Several banking executives admit the need to find a middle ground regarding AI-based agents.
Banks are aware that, in the future, customers will want to use these agents. However, at present, the risks of a too permissive approach are far too high, as many banks are unable to determine whether an agent's activity in an account is directed by the user or not.
On one hand, banks are among the institutions best positioned to respond to the threats and opportunities offered by artificial intelligence, given their cash reserves and experience managing critical infrastructure.
Nevertheless, financial resources are not necessarily sufficient to solve this problem, considering the rapid pace at which technology evolves, revealing new vulnerabilities in real time, the publication notes.
T.D.