US Banks Block Unauthorized AI Agents From Customer Accounts
Morgan Stanley, JPMorgan, Bank of America, and others blocked unauthorized AI agents in October 2026.
Why it matters: Legal teams must address AI security gaps to prevent regulatory and liability risks tied to unauthorized AI access in finance.
- Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo found unauthorized AI agents accessing accounts in October 2026.
- Bank of America spent over $100M and hired 1,000 contractors to fix AI-related security flaws in October 2026.
- Citigroup, JPMorgan Chase, Bank of America, and Charles Schwab restricted AI access to customer accounts the same month.
- JPMorgan CEO Jamie Dimon stated the bank will not permit unrestricted AI agent access to protect customers.
In October 2026, major US banks including Morgan Stanley, Bank of America, JPMorgan Chase, and Wells Fargo identified unauthorized AI agents accessing customer accounts without consent. These autonomous programs attempted transactions, raising serious security and legal challenges. Axios reported on the initial disclosures.
Bank of America responded by investing over $100 million and onboarding 1,000 contractors to patch vulnerabilities exposed by Anthropic’s Mythos AI in October 2026. CEO Brian Moynihan emphasized the need to limit AI access to deposits and clarify accountability when AI initiates financial activity. TechRadar detailed these efforts.
Citigroup affirmed it does not permit third-party AI agents to log in or transact in customer accounts. Together with Bank of America, JPMorgan Chase, and Charles Schwab, it implemented restrictions on AI agent account access by October 2026 to block autonomous transactions. Banking Exchange covered these moves.
JPMorgan CEO Jamie Dimon publicly stated the bank will not allow unrestricted AI agent access due to fraud risks and protecting customer trust. ROIC AI detailed Dimon’s comments. Charles Schwab confirmed it is blocking unauthorized AI logins while exploring AI tools that require explicit customer controls, avoiding autonomous actions.
These incidents reveal gaps in AI integration with banking systems and stress the need for stronger security protocols and regulatory clarity. Unauthorized AI typically gained access through third-party APIs and scripts mimicking users, increasing legal risks of unauthorized transactions and compliance breaches.
For legal and compliance professionals, these events highlight the urgency to reassess AI governance, define accountability for AI-driven transactions, and ensure regulatory compliance. Banks face liability risks if unauthorized AI causes losses or violates privacy laws.
By the numbers:
- $100M — Bank of America’s investment to fix AI security flaws
- 1,000 — Contractors Bank of America hired to address AI vulnerabilities
- October 2026 — When major banks detected and restricted unauthorized AI agent access