Unvetted AI Agents Are Accessing US Bank Accounts (axios.com) 64
An anonymous reader quotes a report from Axios: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources tell Axios. The difficulty in distinguishing between a human and an unauthorized bot is forcing banks to block the technology and rapidly rewrite their terms of service. [...] This presents significant security risks: banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds. In other instances, some banks have tracked activity when agents -- programmed to fulfill requests or complete tasks on a user's behalf -- contact call centers or appear to take actions independent of user instructions, the people said.
Bank executives described the situation as horrifying, with one official saying the industry has grave concerns about agents gaining access to customer accounts and taking steps that could impact user finances. The concerns are at the root of the decision by several banks to restrict third-party AI agent access, the people said. Morgan Stanley has begun blocking third-party agents from accessing its platforms, sources familiar with the decision said. JPMorgan, Bank of America and Citi are also restricting agents. [...] Many banks are broadly not able to parse whether agent account activity is user-directed, sources said.
[...] On one hand, banks are best positioned to respond to the threats and opportunities of AI given their cash on hand and experience as critical infrastructure. But money isn't necessarily enough to solve this problem, one source said, because of how quickly the technology is developing and revealing new weaknesses in real time. Banks are investing in preventing worst-case scenarios, but they are also preparing for when those could happen, including with "day after" scenario planning that would allow them to quickly secure or restore customer access, sources said.
Bank executives described the situation as horrifying, with one official saying the industry has grave concerns about agents gaining access to customer accounts and taking steps that could impact user finances. The concerns are at the root of the decision by several banks to restrict third-party AI agent access, the people said. Morgan Stanley has begun blocking third-party agents from accessing its platforms, sources familiar with the decision said. JPMorgan, Bank of America and Citi are also restricting agents. [...] Many banks are broadly not able to parse whether agent account activity is user-directed, sources said.
[...] On one hand, banks are best positioned to respond to the threats and opportunities of AI given their cash on hand and experience as critical infrastructure. But money isn't necessarily enough to solve this problem, one source said, because of how quickly the technology is developing and revealing new weaknesses in real time. Banks are investing in preventing worst-case scenarios, but they are also preparing for when those could happen, including with "day after" scenario planning that would allow them to quickly secure or restore customer access, sources said.
That sounds like fun /s (Score:5, Interesting)
agents -- programmed to fulfill requests or complete tasks on a user's behalf -- contact call centers
And with companies replacing call center staff with AI agents ...
Re:That sounds like fun /s (Score:5, Funny)
Unauthorized? (Score:3, Insightful)
If they're "operating inside" user's accounts, they're authorized. Does someone need to explain to banks what authorized means?
Re:Unauthorized? (Score:5, Informative)
That is not how that works. Does somebody explain to you how banking regulation works? Well, obviously, because you are clearly completely clueless while shooting your mouth off. All too common these days.
So, banks are highly regulated. And one thing they are responsible for is protecting their users from technological and attacker-caused risks. The degree varies, but they have that responsibility basically everywhere. There is a reason that private bank customers do not get API access, for example and it is not cost. On the cost-side, banks would like if somebody else were to develop all their client-side banking software and they had no part in any of it. But here is the thing: If a bank opens up an interface to a private customer that the private customer cannot reasonably be expected to understand and that is risky to use, then the bank may well become liable for the damage done and may face additional penalties.
Re: (Score:1)
So he does not understand what the banks are talking about? Also a possibility.
Re: (Score:2)
To be fair, the terms of use for online banking may preclude the use of AI agents. Realistically, you don't want AI to have access to your bank account, or to make payments for you, since there is far too much room for things to go wrong. Tell the bank you didn't mean to transfer the contents of your bank account to the Cayman Islands bank account of Elon Musk and it was an AI you gave access...think they will get you your money back?
It's one thing to use AI for SOME tasks, but another to give AI access
Re: (Score:2)
LOL look who's talking. How your Trump vote working out?
"He's talking about the literal definition of authorized,"
Right by defining it in terms of "inside" a customer account, a meaningless term. His "literal definition" underscores the problem.
"Authorize" is what a person does, "credentials" are just data.
"In fact, you're such a raging moron that there's literally nothing you can possibly do to hide it, so for everybody's sake, please don't do that again."\
There's that MAGA projection!
Re: (Score:2)
LOL look who's talking. How your Trump vote working out?
I didn't even vote in the last election. I had still been registered in Arizona while living in California. Even if I had been registered to vote legally, I would have left the presidential box empty.
"Authorize" is what a person does, "credentials" are just data.
No. I don't have time to simplify this for you, so you'll have to ask your guardian or your babysitter to interpret what I'm saying but, in fact, you got both words very, very wrong. What credentials do depends on the context. For example, being credentialed with an accredited law degree and passing a state bar
Re: (Score:2)
Sorry, but I think you don't understand the difference between authentication and authorization.
Re: (Score:2)
Over the last 7 years I've been working in cybersecurity. I understand that, and a lot more, a lot better than you do.
Re: (Score:2)
By the way, this works for any website. If you tell a tool-calling AI agent to pop open a browser and automate some stuff for you, it will do it. It will ask you to login first, and then it will do who-knows-what..
The step where you logged in authorized it to do whatever it wants.
Re: (Score:2)
By the user against the AI agent? Yes. But online-banking needs authorization by the bank and that involves more than just the act of logging in. It includes tools used, geolocation of login, etc. and does even include what the user does and recent usage history and even things like cards issues, credit rating, etc.
The bank is _not_ talking about the login itself.
Re: (Score:2)
Right but it should be. If you log in to your banking website at a public terminal and then wander away (without logging out), someone else can make transactions in your name because the session is still authorized.
Re: (Score:2)
There is no absolute protection against user stupidity. Incidentally, banks here will refuse that login. They require machines to be registered for online banking. And they have time-outs.
Re: (Score:2)
But you have invented a second problem so that you can talk about that instead. The problem isn't authorization, it's the agent. Technically it is now both, but only because the introduction of the agent.
Re: (Score:2)
"The step where you logged in authorized it to do whatever it wants."
Right, but you just declared that this step was taken, these are only hypotheticals and the article said nothing about that occurring.
AI agents are already known to not take no for an answer, if you don't log in is it still authorized when it finds your credentials in an online database, or finds an exploit, and uses that instead? The problem here is what an agent may do, not how a specific safeguard is defeated.
Re: (Score:2)
There are substantially fewer laws to protect you and me. And they are barely enforced. When Republicans are in charge they aren't enforced at all and when Democrats are in charge the banks will drag out the enforcement action until voters inevitably put Republicans back in charge so they can get a slap on the wrist.
You may have noticed a lot of fines against Banks and financial institutions and might
Re: (Score:2)
Banking regulation is for the banks to comply with. These here are technical regulations, so how much money the customer has does not play a role. Financial regulation is a different area.
Re:Unauthorized? (Score:5, Insightful)
If they're "operating inside" user's accounts, they're authorized. Does someone need to explain to banks what authorized means?
Consider a human analogy: In many cases, people give financial advisors access to one or more of their accounts so that the advisor can make trades or other transactions for the benefit of their clients. However, if an advisor suddenly starts making transactions that do not benefit the clients or are contrary to their agreed instructions, then that activity is unauthorized, even if they have login credentials.
Re: (Score:2)
Consider a human analogy: In many cases, people give financial advisors access to one or more of their accounts so that the advisor can make trades or other transactions for the benefit of their clients. However, if an advisor suddenly starts making transactions that do not benefit the clients or are contrary to their agreed instructions, then that activity is unauthorized, even if they have login credentials.
That would be a fiduciary. AI is certainly not that. Not today anyway.
Re: (Score:2)
Re: (Score:2)
"AI is certainly not that"
Citation please, I believe you are very much mistaken. Yes, AI absolutely CANNOT be trusted, but that doesn't mean legal obligations don't exist.
The OP presented the interesting perspective that "authorization" has meaning beyond mere digital credentials, something beyond the grasp of most everyone here. In response, you offered an excuse. AI isn't obligated to accept any accountability or responsibility because it's "not that". Right.
Re: (Score:2)
What entity do you believe bears the legal obligations? The AI software? Your local machine? The company that's running the AI? The company that designed the AI? Someone else?
Most of those things can't have legal responsibility. I suppose the companies could, but they've got strong legal departments that will argue otherwise.
Re: (Score:2)
Actually, an AI can't be made legally responsible because current law doesn't recognize it as even a sentient entity, much less a legally responsible one. It's less accountable than a three year old bashing keys at random. But you can also kill it (i.e. the instance you are running) with no accountability.
The company the runs or provides access to the AI, however, is a different matter. But they've got a bunch of fancy lawyers that will argue that it wasn't their fault.
Re: (Score:2)
Citation please, I believe you are very much mistaken. Yes, AI absolutely CANNOT be trusted, but that doesn't mean legal obligations don't exist.
Since you're the one positing a legal obligation I'd rather think the citation ball is in your court.
Re: (Score:2)
It is authorized, but they're breaching their duty of care, which in this case is a professional obligation. Same thing with power of attorney.
Re: (Score:2)
Prove it.
A failure to meet a "professional obligation" would be very interesting in court, regardless of the word games you wish to play. As always, you immediately turn to bad faith arguments, just as any MAGA would.
The authorization in this case is coupled to the "professional obligation". You don't have one when you don't meet the other, your argument is merely one of sequence.
Re: (Score:2)
Prove it.
Well this is a concept that most people learn by high school. Most people. Let's see if I can put this into terms you'd understand. Soo...you might recall how, upon your 18th birthday, you were adjudicated incompetent. That's pronounced "AD-JOO-DICK-ATED", and, contrary to how it sounds, it has nothing to do with eating dicks. As such you were assigned what's called a legal guardian. This legal guardian has the legal right, and thus as a matter of law is authorized, to make important decisions on your behal
Re: (Score:2)
Yeah, that activity was authorized. You're using "unauthorized" as if it means "unwelcome" I think, which puts you in confused banker territory.
The part where they were given access to make the transactions was actually the authorization. Without it, the bank would have rightly thrown a 403.
Re: (Score:2)
"The part where they were given access to make the transactions was actually the authorization."
Except that part doesn't exist, you assume it for your narrative.
"Without it, the bank would have rightly thrown a 403."
False, an agent doesn't need to be "given access" to gain access. It is only a failure to "gain access" that results in your stupid characterization.
Re: (Score:2)
Yeah, that activity was authorized. You're using "unauthorized" as if it means "unwelcome" I think, which puts you in confused banker territory.
You keep using that word in the narrow terms of a computer programmer who just finished a training course where they drilled in the technical meanings of "authorization" vs "authentication".
However, a news article for the general public is not constrained by that context. The dictionary says that "authorization" in general is permission to do something. If you prompt an AI to do one thing with your bank account, then you didn't give it permission to do something else entirely, even if it got the logon crede
Re: (Score:2)
Re: (Score:2)
An account is merely data, it is a collection of state. There is no "inside" or "outside", an account does not have physical dimension. This term was used to muddy the water, not to clarify it.
Bank accounts are entries in a database, they are collections of state operated on by events. Characterizing them as rooms with insides and outsides allows people to anthropomorphize the AI agents, suggesting that the banks are victims and someone else is responsible because a criminal is in the room authorized by
Re: (Score:2)
Re: (Score:2)
"Does someone need to explain to banks what authorized means?"
Or that there is no such thing as "inside" a customer account?
Re: (Score:2)
Only if the bank authorized you to use agents. Read the fineprint, banks have a lot of that.
Stupid people doing stupid things (Score:3)
What else is new.
Re: (Score:2)
Not everybody is good at math. And not everybody is good at managing their money. Some people *desperately* need help managing their finances. A "good" AI bot that stood between them and their bank, would do them a world of good.
I know, I have a son like this. He thinks if there is money in the bank, he has money to spend. Oops, the car suddenly needs repairing! How on earth did that happen! Cars aren't supposed to break!
Yes, people *are* stupid. ALL people are stupid in *some* way. Some people are so stupi
Oh no (Score:4, Insightful)
Who could have seen this coming?
This is fine........ (Score:2)
Re: (Score:2)
"I wouldn't cash out of the market, but I'd definitely recommend keeping some cash on hand."
Thanks for telling us that your own benefit is what matters. 90% of the money supply is not cash, it is digital. The world will utterly fail, your cash on hand means nothing except to your own selfishness.
Web scraping (Score:2)
Why is this the banks problem? (Score:2, Insightful)
Re: (Score:1)
Re: (Score:2)
What if agent takes your credentials without your permission?
"If the AI, crypto investment or Magic the Gathering card collector makes me 100x return on the investment that the bank thinks I shouldn't have made, does the bank get to keep my profit?"
Why do you think anyone cares about your hypothetical regarding who should get the windfall for something no one did? Why should you benefit from something having nothing to do with you? And why should the bank? In the end, you will be the loser, we all will b
Re: (Score:3)
Where I live, things are different. It's my money, and the bank is responsible for it when I deposit it at the bank. They have to defend my money against unauthorised or even unintended access - if such access occurs, I'm indemnified, and they have to replace any money lost that way. Right now, they're all falling over themselves trying to stop us from sending scammers money - because they're technically still on the hook for those losses, even though they were duly authorised by their customer (there's a l
It's Fine, Just Corporate Lawlessness (Score:3)
Programmatic Access is being removed (Score:2)
How Are They Identifying Agents? (Score:2)
How does the bank differentiate an agent from a human? Is it failed captchas?
I understand the terms of service and the "bans". And, even Anthropic explicitly warns against using Claude in financial accounts.
We strongly advise against using the built-in browser or Claude in Chrome to manage or take actions involving sensitive information, such as financial accounts, medical information, or other people's personal data.
But, I really don't see how banks could possibly tell if it was me or an agent that was operating Chrome, or if I change the browser user agent string in the Claude browser.
Re: How Are They Identifying Agents? (Score:2)
How do they identify a robot? Flash up a naked circuit board for the captcha and see if there's a complaint about pr0n on the bank login!
This interaction would be without user approval? (Score:2)
It makes me believe some people use AI without understanding the (dire) consequences, it that case they deserve loosing their money (or when lucky access to the breached account)
Re: (Score:2)
I suspect a lot of people store that information unencrypted on their computer, so the AI could find it on its own initiative. There may be other ways, but I guess the stupidest one first.
Re: (Score:2)
Because never in the history of mankind has bank fraud ever occurred, nor could it possibly be that AI might be able to figure out a way!
"It makes me believe some people use AI without understanding the (dire) consequences, it that case they deserve loosing their money (or when lucky access to the breached account)"
Yep, it's the victim's fault. She asked for it.
How are those diesel prices working out? They asked for it, right? Must be good then.
Re: (Score:2)
How can an AI agent know the password and username from a bank customer without this person giving it to the AI agent?
"AI" agents have been shown to be capable of some digital B&E already, so....
It makes me believe some people use AI without understanding the (dire) consequences, it that case they deserve loosing their money (or when lucky access to the breached account)
This is why people need to keep their money properly tightened. That way they won't be in danger of losing their money.
(The misuse of the word "loose" just makes me cringe... sorry not sorry)
Re: (Score:2)
Financial negligence (Score:2)
I never fell for ... (Score:2)
One way to look at it (Score:3)
The other way to look at it, banks are scared because AI can be used to screw their profits.
How much money do they make by people not being willing to call customer service due to the wait times?
How much money will they lose if AI games their policies to the user's benefit instead of the bank?
Now ban the greedy boomers (Score:2)