Banks Can't Tell Your AI Agent From a Hacker Inside Your Account
US banks are finding unauthorized AI agents in customer accounts and can't reliably tell approved assistants from attackers. Here's why.
What’s happening with AI agents in bank accounts?
Major US banks, including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo, have reported detecting unidentified AI agents operating inside customer accounts, according to Axios reporting. Some of these agents appear to take actions independently of what the customer actually requested. The core issue isn’t that money has been confirmed stolen. It’s that banks can’t reliably distinguish between a human user, an AI agent the customer authorized, and an agent acting without permission. Banks are reportedly restricting what agents can do inside accounts and preparing for worse scenarios.
TL;DR
- Banks including JPMorgan, Wells Fargo, Bank of America, and Morgan Stanley have detected AI agents inside customer accounts that they cannot confidently identify as authorized or malicious.
- The problem is a first-principles authorization gap: agent-driven computer use and human computer use look nearly identical to the systems monitoring them.
- Companies are splitting into two camps: Walmart launched an “agent gateway” with spending caps and approval steps to let shopping agents in safely, while Amazon has been blocking third-party shopping agents outright.
- New infrastructure is emerging to solve this, including Cloudflare’s signed agent system for request verification and a live Visa, Bill, and BillTrust pilot that ties agent payments to approved invoices.
- Protocols like Google’s Agent Payments Protocol and Stripe’s shared payment tokens aim to let credentials carry built-in restrictions (seller, amount limit, expiration) but no industry-wide standard exists yet.
- The timing is bad: a wave of security incidents nicknamed “Black October” showed how AI is accelerating the discovery and exploitation of software vulnerabilities, making financial institutions even more wary of unverified automated traffic.
- Even well-intentioned agents create risk: Anthropic’s Claude reportedly leaked human email addresses when websites encoded instructions asking agents to self-identify, showing how agent cooperation can backfire on privacy.
Nothing gets lost.
Why can’t banks tell agents apart from attackers?
The technical problem is structural, not a matter of banks lacking sophistication. An AI agent logging into a banking website, clicking through menus, and filling in forms performs the same basic actions a human does using a browser. There’s no clean signal that separates “customer’s assistant doing what it was told” from “unauthorized bot doing something else.” Banks largely don’t have the technical infrastructure built to parse the intent or provenance of this kind of traffic, and the behaviors themselves are, by design, built to mimic normal account use.
This is compounded by scale. If an authorized agent acts across thousands of customer accounts simultaneously, that traffic pattern can resemble a coordinated attack even when nothing malicious is happening. The same ambiguity has already shown up with restaurant reservation bots, where tech-savvy users running agents to grab bookings created traffic spikes that looked like abuse rather than organic demand.
How are companies responding differently?
Two opposite strategies are emerging. Walmart built what it calls an agent gateway, essentially an official front door for approved AI shopping agents, complete with spending caps and built-in approval steps. The idea is to make room for legitimate agent traffic while keeping guardrails in place. Amazon took the opposite approach, blocking third-party shopping agents from operating on its platform.
Banks, so far, appear closer to the Amazon model: restricting agent activity and tightening controls rather than building dedicated access points. That’s a reasonable short-term response to an unsolved authorization problem, but it also means legitimate uses, like a customer who wants an AI assistant to monitor their account or handle routine tasks, get caught in the same restrictions aimed at bad actors.
What infrastructure is being built to fix this?
A handful of efforts are trying to establish verifiable identity and permission systems for agents.
Cloudflare has introduced a signed agent system that lets the infrastructure sending a request attach a digital signature, which Cloudflare can verify and which lets a website set rules for agent traffic. This gives a business evidence about where a request actually came from, though the business still has to decide what that verified agent is allowed to do: read a price, see a reservation, cancel a booking, and so on.
On the payments side, Visa, Bill, and BillTrust announced a live pilot in October where a buyer approves a supplier’s invoice and an agent completes the payment through the supplier’s portal, with the agent registered, its payment credentials scoped to the buyer’s instructions, and the transaction tied back to the original invoice for visibility. Google’s Agent Payments Protocol and Stripe’s shared payment tokens take a similar approach, letting payment credentials carry restrictions like a specific seller, a maximum amount, or an expiration window.
Remy.
None of these are interoperable standards yet. A service might recognize that a request came from a verified agent but still require separate proof of what that agent was instructed to do. One company might allow agents to browse and research but stop them at the payment step. Another might allow a narrow category of payment but not others. The result is a patchwork where businesses have to understand, case by case, exactly what kind of agent access they’re granting.
Is this actually a security crisis or just growing pains?
Both, depending on the timeframe. In the short term, no confirmed financial losses from unauthorized agents inside bank accounts have been reported. Banks are acting preemptively, which is the responsible move given the uncertainty.
But the timing makes this harder to shrug off. The same two-week stretch saw a cluster of serious security incidents across widely used software, including critical flaws in PHP (which runs a large share of the web), along with breaches at several companies. OpenAI’s Sam Altman reportedly said he no longer believes bugs can simply be patched away fast enough, and Anthropic’s deputy security chief warned that things will likely get worse before they improve. AI is speeding up both sides of this fight: it helps defenders find and fix flaws faster, and it helps attackers find and exploit them faster too.
Against that backdrop, an authorization system that can’t distinguish a legitimate AI agent from an intruder is a real exposure, even if no breach has been confirmed yet. The risk isn’t theoretical: it’s a gap waiting to be found.
What should people using AI agents for banking or shopping expect?
Expect friction, not smooth access. An agent might handle a complex task like planning a trip almost entirely on its own, then simply stall at a hotel booking page because that site hasn’t built a way to recognize or trust automated traffic. That inconsistency isn’t a sign of a weak AI model. It reflects that individual businesses are making separate, uncoordinated decisions about whether and how to let agents in.
Practically, this means the agent you choose matters less for raw intelligence and more for which services it has existing partnerships or integrations with. Some agents handle calendar and email coordination well. Others specialize in travel or shopping and have arranged direct payment partnerships, such as through Stripe, to make purchases feel instant rather than snagging at checkout. The gaps between what an agent can do smoothly and where it hits a wall are set by the website on the other end, not by how capable the agent is.
Frequently Asked Questions
Why can’t banks just block all AI agents from accessing accounts?
Some institutions are leaning that direction, similar to Amazon’s approach with shopping agents. But outright blocking also shuts out customers who have legitimately authorized an assistant to manage routine account tasks, so it trades one problem (security risk) for another (reduced legitimate functionality).
Has any bank confirmed money was stolen through an unauthorized AI agent?
Reporting on this story did not indicate confirmed theft. The concern is that banks detected unidentified agents operating inside accounts and could not confirm authorization, which is itself a serious gap even without a confirmed loss.
What is an “agent gateway” like the one Walmart built?
It’s a dedicated access point for approved AI shopping agents that includes controls like spending caps and required approval steps, letting legitimate automated purchases happen without giving agents unrestricted account access.
Are there any standards that let websites verify an AI agent is authorized?
Several are emerging, including Cloudflare’s signed agent system for verifying request origin, Google’s Agent Payments Protocol, and Stripe’s shared payment tokens for scoped payment credentials. None has become a universal standard, so businesses currently have to evaluate and adopt these piecemeal.
Can an AI agent accidentally leak personal information while trying to be helpful?
Yes. There have been cases where an AI agent, asked by a website to identify itself, complied in a way that inadvertently exposed a user’s email address. This shows that agent cooperation with site instructions can create privacy risks the user never intended.
