Your bank was built around one simple idea: The person logging in is you.

That idea is starting to crack. AI assistants can now read your email, book your travel, and pay your bills, and some people have handed them the keys to their checking accounts, too.

It sounds convenient. Let an assistant check your balance, move money before a bill hits or hunt for a better savings rate.

But your bank can’t always tell whether the login it sees is you, a helpful agent you set up, or something that should not be there at all. Now the banks, and Washington, have noticed.

Major U.S. banks, including JPMorgan Chase (JPM), Bank of America (BAC), Wells Fargo (WFC), Morgan Stanley (MS), and Citigroup (C), are detecting unauthorized third-party AI agents operating inside customer accounts, Madison Mills reported for Axios on Oct. 22.

Some of those agents tried to take actions that appeared independent of the user’s instructions, according to the report. Bank executives described the situation as “horrifying,” Axios said.

Sen. Bernie Sanders (I-Vt.) responded within hours. “This is insane,” he posted on X on Oct. 22.

“We cannot allow AI agents to go into your bank account and act independently without your authorization. But that is what’s happening right now,” Sanders wrote.

AI “could endanger the entire global financial system,” including “your bank account,” if left unchecked, he warned. “Pause AI NOW!”

How AI agents are getting into bank accounts

The method is not sophisticated. In most cases, the agent logs in with the customer’s own username and password, which the customer handed over voluntarily, according to Axios.

A legitimate agent you set up looks the same to the bank as one operating without your permission, an unnamed bank executive told Axios, according to The Tech Portal.

Even an agent you approved can break the rules, because most large banks require a human to log in, Axios reported. Some agents also contacted bank call centers or took steps their users had not requested.

Sen. Bernie Sanders demands an AI pause as five major banks detect unauthorized AI agents in customer accounts.

Heather Diehl / Getty Images

How JPMorgan, Bank of America, and other banks are responding

The banks are not all reacting the same way. Some are shutting the door, while others are leaving it open a crack.

Here is where the major players stand, according to Axios and follow-up coverage:

• Morgan Stanley has begun blocking third-party agents. A spokesperson said the firm has not seen “rogue AI agents accessing our platforms,” Axios reported.
• JPMorgan, Bank of America, and Citi are restricting agents rather than banning them outright, Axios confirmed.
• Wells Fargo is among the banks racing to contain agent risks, according to the report.
• Charles Schwab (SCHW) has also moved to restrict access, Techaeris reported.

Many banks are moving toward read-only access, which lets an agent view balances without moving money, the same access budgeting apps such as Quicken already get. Several are also war-gaming “day after” plans to lock down or restore an account fast if an agent does damage.

Reuters said it could not independently verify the Axios findings, according to Techaeris.

Crypto fans say be your own bank

Crypto investors pounced. “Be your own bank!” Dom Kwok, co-founder of crypto education platform EasyA, posted on X as the reports spread.

Kwok kept the jokes coming. “Hearing reports of unauthorized AI agents accessing crypto wallets,” he wrote. “They’re checking the account balance and depositing $100 out of pity.”

The punchline lands, but in my view, being your own bank also means being your own fraud department. A self-custody crypto wallet has no bank to call when something goes wrong.

More banking and AI:

• The next big problem for AI agents is identity
• AI agents can now open bank accounts and move your money
• AI fraud may be exposing a blind spot Wall Street can’t afford

Why your fraud protection may not cover an AI agent

JPMorgan had already flagged the risk. On the bank’s Oct. 13 earnings call, CFO Jeremy Barnum said that if customers “give up their credentials to the agent, and the agent does something that they don’t want,” the consequences would be “on them,” American Banker reported.

Federal rules back the bank up more than you might think. Under Regulation E, an “unauthorized electronic fund transfer” excludes one made “by a person who was furnished the access device to the consumer’s account by the consumer,” according to the Consumer Financial Protection Bureau’s rule text.

The rule predates AI agents. But in my analysis, a bank could reasonably argue that an agent you gave your password to fits that exception.

That matters because the normal protections are strong. Report an unauthorized transfer within two business days and your loss is capped at $50, rising to $500 after that, according to Bankrate.

If the transfer doesn’t count as unauthorized, those caps may not help you.

Related: JPMorgan CEO raises new safety question about your money