If you’ve caught the headlines about AI agents and banks over the past couple of weeks, you’d be forgiven for picturing an autonomous bot army kicking in the door at Chase. The coverage has leaned hard on words like “rogue” and “horrifying,” and to be fair, some of that concern is earned. But dig into the reporting underneath the headlines, and especially the statements the banks themselves have put out, and the picture gets a lot more mundane and a lot more useful.
What’s mostly happening is that people are handing their bank username and password to an AI assistant so it can do chores for them: check balances, pay bills, shuffle cash between accounts. The agents are logging in with the customer’s permission and the customer’s credentials, and the “unauthorized” part means unauthorized by the bank, because nearly every bank’s terms of service say a human logs into a human’s account. Schwab’s CEO told Bloomberg they’re blocking agents trying to move client money, and he named Meta’s new Muse assistant specifically. Citi was even blunter in a statement: third-party agents don’t get to log in or transact on their platforms, period, though read-only access through approved open banking providers is still fine.
So the scary headline is, for the most part, a credential sharing story. If you’ve been in this industry a while, that should feel extremely familiar.
We’ve had this fight before
We spent the better part of a decade on this exact problem with budgeting apps. Mint and its cousins stored your bank password and logged in as you to scrape your transactions, the banks hated it for the same reasons they hate this, and the industry slowly moved toward token-based, scoped API access so the aggregator never had to hold your password at all. The read-only access most banks are now steering agents toward, the same kind Quicken already gets, is that same plumbing. Agents went right back to the old screen-scraping model because the newer, safer model doesn’t let them move money yet, and moving money is the thing people actually want them to do.
It’s also worth knowing there’s a business motive here alongside the security one, which the banking trade press has been more upfront about than the general headlines: banks are worried agents will sweep idle cash out of low-yield accounts and into higher-yield ones elsewhere. I don’t think that makes the security concern fake; it’s real. But when a bank blocks agents, it’s protecting deposits as well as customers, and it’s fair to keep both in mind when you read executives describing the situation as horrifying.
Where the real security problem is
The part of the coverage I’d actually pay attention to is the reporting that banks can’t reliably tell whether agent activity is something the customer asked for, along with accounts of agents calling contact centers or doing things nobody instructed them to do.
When an agent logs in with your real password, it is you as far as the bank’s logs are concerned. Pretty much every fraud and identity control built over the last twenty years assumes that whatever is holding a valid credential is either the legitimate owner or a thief, and an agent is neither. It’s an authorized identity running delegated intent with nondeterministic behavior, and our tooling doesn’t have a box for that. On top of that, agents are susceptible to prompt injection, so a webpage, email, or document the agent reads while doing your chores can steer what it does next with your logged-in session. From the outside, that looks exactly like an agent “taking actions independent of user instructions.”
Back when I was doing pen tests, a valid credential was always the best foothold you could get, because everything you did afterward blended in with normal user traffic. An agent holding your bank password is that same foothold, except you installed it yourself and gave it a to-do list.
If you’ve already given an agent your bank login
On JPMorgan’s earnings call last week, their CFO said that if customers hand credentials to an agent and it does something they didn’t want, “that’s going to be on them.” That’s more than a bank being grumpy. I’m not a banking expert (my partner will happily confirm this), but I went digging, and the rule the banks are leaning on is Regulation E. Its official commentary says that if you give someone your access credentials and authority to make transfers, and they go beyond what you told them to do, you’re fully liable for those transfers until you tell your bank that person isn’t authorized anymore. The examples it uses are a family member or a co-worker, and nobody has really tested how that plays out when the “someone” is a piece of software, or when a third party hijacks your agent with a malicious prompt (the rules do treat credentials obtained through fraud differently). Regulators reportedly think the law may need clarifying on exactly this. Until it is, I’d assume your bank will treat whatever your agent does as something you did.
The cleanup is straightforward. Change your bank password, which kills whatever copy the agent has stored, then go into the agent’s own settings and revoke any saved logins, sessions, or connected accounts. Check your bank’s connected apps or linked services page and remove anything you don’t recognize or don’t use anymore. Turn on real-time alerts for every outgoing transfer, every new payee, and every login from a new device; most banks let you set the threshold to zero dollars, and you should. If you still want an AI helping with your finances, give it read-only data through your bank’s supported aggregator connection, or have it work off exported statements, rather than handing it a live login. And keep moving money a human action. Bank of America’s CEO said publicly that a person should be the one approving money leaving an account, and that’s good advice for you whether or not your bank enforces it.
If you run security for anything
Swap “bank” for your SaaS stack and this whole story is about you. Your employees are almost certainly doing the same thing right now, pointing browser agents and computer-use tools at the CRM, the ticketing system, email, and the HR portal using their own sessions. Your logs show a human, and you have the exact blind spot the banks are describing.
Start by finding out where agents are already operating: browser extensions, AI-native browsers, and cloud-hosted agents that log into your apps from someone else’s infrastructure. Then push agents toward their own identities with scoped, delegated access (OAuth grants with narrow scopes, dedicated service identities) instead of borrowed human sessions, so you can tell them apart in the logs and revoke them without nuking the human’s access.
Tie access to known, managed devices and phishing-resistant authentication like certificates or passkeys. A password that can be pasted into an agent running in a vendor’s cloud eventually will be, and device-bound authentication with conditional access shrinks the number of places a valid session can be used from. Be honest with yourself about the limit here, though: an agent running inside the user’s own browser on a managed laptop will sail through device checks, which is why the separate-identity piece matters so much.
Put step-up authentication in front of the high-consequence stuff, like payments, permission changes, bulk exports, and new integrations, so an agent can do the boring work but a human has to approve the dangerous work. Baseline what normal looks like for your users, because agents tend to work at machine speed, at odd hours, and across more records than a person would bother touching.
Finally, steal the banks’ playbook. Several of them are reportedly doing “day after” planning for when an agent goes sideways. Run that tabletop yourself: an agent with a real user’s access does something destructive or exfiltrates data. Who notices, who revokes, how fast, and how do you even figure out which actions were the human and which were the agent?
Where this ends up
The banks aren’t wrong to block credential-sharing agents right now, and they also know they can’t keep the door shut forever, because customers want this and their competitors will offer it. Where it lands is probably where the budgeting app fight landed: agents get their own delegated, scoped, revocable access with transaction limits and a human approving the money movement. Until that exists at your bank, or in your environment, don’t hand over the keys and hope for the best.
