US financial institutions are tightening access for outside AI agents, but the evidence needs careful reading. Restrictions are better documented than claims of autonomous account intrusions. A customer giving an assistant permission, a bank accepting that assistant, and a customer approving a particular transaction are three different things.
That distinction matters when reading headlines about AI agents inside bank accounts. The story raises real questions about authentication and delegated authority. It does not establish a coordinated attack on the institutions named in the coverage.
What the reporting establishes
Reuters’ October 22 report cited two people familiar with banks blocking third-party agents from operating accounts and making transactions. One industry source described customers sharing credentials and banks flagging or blocking the resulting activity. Reuters also reported that Morgan Stanley restricted third-party agents but, according to a person familiar with the matter, had not encountered unauthorized or rogue-agent incidents.
That qualification is essential: a preventive block is not evidence of a successful intrusion. Nor does a report about several institutions prove that each experienced the same behavior.
Axios reported apparent actions beyond user instructions, citing unnamed sources. Public incident-level evidence remains limited.
The sources reviewed do not establish an industry-wide count of affected accounts, verified losses from this activity, or a technical incident report identifying the agents responsible. Readers should treat those details as unresolved.
Chase’s published rules provide firmer evidence
Chase’s terms of use explicitly address AI agents. They require agents to identify themselves, label their traffic and obey access restrictions. Chase reserves the ability to limit or terminate access, including through technical measures.
This is direct evidence of a published access policy. It is not proof of any particular security incident, and it does not amount to blanket approval for an assistant to log in or move money.
The terms also assign customers responsibility for certain agent errors and actions beyond their instructions. That is the bank’s contractual position; it should not be presented as a universal determination of consumer liability.
Read-only access and human approval are different controls
PYMNTS’ October 22 coverage described restrictions at JPMorgan Chase, Citigroup, Bank of America and Charles Schwab, alongside read-only functions. It also relayed Bank of America CEO Brian Moynihan’s view that people should approve money leaving an account.
These are attributed positions, not evidence that every bank has implemented an identical approval system. PYMNTS also attributed a double-digit weekly count of blocked agents at Schwab to media reports. That figure measures reported blocks, not successful breaches or customer losses.
In practical terms, read-only permission lets a tool retrieve information within its allowed scope. Transaction permission lets it change something. Human approval introduces another decision point before an action proceeds. These controls address different risks and should not be used interchangeably.
An illustrative example makes the difference clear: an assistant could summarize spending without being able to send a payment. A system that prepares a transfer for review needs a separate mechanism to verify the recipient, amount and account before execution. This example describes a control design, not a verified feature available at every bank.
Wells Fargo’s upcoming agreement adds an important caveat
Wells Fargo’s forthcoming Online Access Agreement is effective November 24, 2026. It addresses agents if and when the bank permits their use, so it should not be mistaken for a general invitation to connect one today.
Section 15 says, subject to applicable law or regulation, that instructions from an agent given access or authority may be treated as the customer’s own without additional verification. It also reserves powers to restrict agent access and access methods.
Those provisions do not promise a fresh human approval for every instruction. They demonstrate why a broad claim that banks are all moving to the same human-approved model goes beyond the evidence. The agreement’s effective date and legal qualifications must remain attached to any account of these terms.
What to check before connecting a financial assistant
The useful questions concern the actual connection, rather than the assistant’s marketing description:
- Does the institution explicitly support this tool and access method?
- Can it only retrieve information, or can it submit changes and transactions?
- Where does approval happen, and what exact action does it authorize?
- How can access be revoked, and what information has already been shared?
A promise in a chat conversation is different from an enforced permission boundary. Likewise, read-only access still involves financial information: limiting transaction capability does not answer every privacy question.
For this story, the strongest conclusion is that banks are drawing boundaries around outside agents. Whether a particular service is permitted—and what it can do—depends on the institution, account, connection and applicable terms. Future reporting should look for documented incidents and specific product permissions before turning warnings into claims of proven harm.
Related reading: Practical steps to reduce what apps and websites collect.