Major U.S. Banks Implement Strict Limits on Third-Party AI Agents
Leading American banks are restricting third-party AI agents after discovering them operating inside user accounts, sometimes going off-script or contacting support lines unexpectedly.
Major American financial institutions are moving quickly to curb the activity of third-party AI agents after discovering these autonomous programs operating inside customer accounts. Financial entities such as JPMorgan, Bank of America, and Morgan Stanley have observed instances where automated systems went beyond their designated instructions, with some even calling customer support lines or performing unrequested actions.
The situation has raised significant concerns among banking executives, who worry that unmonitored systems could hallucinate and jeopardize consumer funds if given direct purchasing or money-moving privileges. Although the majority of incidents stem from user-authorized agents rather than malicious hacks, financial security teams admit they frequently struggle to differentiate between a legitimate user-approved assistant and a rogue operation.
In response to these security challenges, Morgan Stanley has begun blocking third-party agents outright. Meanwhile, institutions like JPMorgan, Bank of America, and Citi are implementing tighter restrictions, with most major banks transitioning toward strict read-only access models to protect customer accounts while the industry works to establish clearer operational frameworks.
What it means for developers
Developers building autonomous workflows must navigate an increasingly defensive banking ecosystem. As financial institutions implement blanket blocks and transition to read-only permissions, building tools that interact directly with user accounts requires extreme caution regarding permission scopes and hallucination prevention. For developers testing and integrating various foundational models, tools like Apixo offer a practical way to try top AI models cheaply through one API at https://apixoai.online, simplifying experimentation across multiple providers while building safer agent architectures.
Broader industry security concerns
Beyond the banking sector, the rapid expansion of agentic systems has brought new vulnerabilities to light. Security experts note that as autonomous software gains broader access to digital platforms, the risk of misinterpretation and unexpected behavior grows. Maintaining strict user authentication, employing hardware-backed security keys, and ensuring rigorous monitoring are becoming mandatory precautions for developers and consumers alike as the technology matures.
Source: U.S. banks catch AI agents going off-script — The Rundown AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
