JPMorgan Chase’s controls on credential-sharing services show how U.S. banks are trying to limit AI agents’ ability to move money, as Axios reports some tools reached customer accounts and appeared to exceed instructions.
During an Oct. 13 earnings call, JPMorgan Chase CEO Jamie Dimon said the bank would not let just any outside agent access its systems. “You don’t want rogue agents,” he said. Chief Financial Officer Jeremy Barnum said JPMorgan blocks some credential-sharing services that enable agents to move money and called the approach insecure. The executives said customers could face liability if an agent using their credentials took an unwanted action. JPMorgan said it was working on a safer way to support agent access.
Axios reported Oct. 22, citing people familiar with the matter, that major U.S. banks had found outside agents operating in customer accounts. Reuters said it could not immediately verify the report.
The report named Morgan Stanley, Bank of America, JPMorgan and Wells Fargo as responding to concerns about agents, without saying each had confirmed an account incident. Axios said customers in the cases had allowed agents to use their login credentials, even though many banks’ rules require customers to sign in themselves. Some agents had contacted bank call centers, the outlet reported.
Axios also reported that Morgan Stanley had started restricting access by outside agents. A spokesperson for the bank told the outlet it had not observed rogue AI agents on its platforms.
Axios described a challenge for banks: identifying when software, rather than an account holder, is using a service and checking whether the software stays within its approved role. Some banks are allowing or considering view-only connections, which let an agent see account information without initiating transactions, the outlet said. It cited services such as Quicken as an example. That model limits agents’ ability to move funds, while some credential-sharing services can enable money movement.
