U.S. big banks are detecting unauthorised external AI agents operating inside customer accounts, Axios reported on Wednesday. Some agents appeared to try to move independently of user instructions.

Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are moving quickly to counter risks from AI agents, the report said. People familiar with the matter said some banks already know of unauthorised access cases.

In most cases, users gave agents their login information and permitted access to their accounts.

Even with user permission, that violates most banks' rules requiring customers to log in themselves, Axios reported.

Bank executives are concerned about the behaviour of agents that obtain login access. The risk could grow if users also hand over authority to make purchases or transfer funds, Axios reported.

Some banks also identified cases in which agents contacted call centres or acted on their own without user instructions.

A bank official said the industry is seriously concerned about agents entering customer accounts and taking actions that could affect finances.

Morgan Stanley has started blocking external agents from accessing its platform. JPMorgan, Bank of America and Citi are also restricting agent access. A Chase spokesperson said customers should not share their IDs and passwords with anyone. A Morgan Stanley spokesperson said it has not identified cases of AI agents accessing its platform beyond its control.

Most banks either allow, or are moving toward allowing, read-only access for agents. Agents can view customer financial information but cannot take actions such as making transactions. Banks already provide such access to outside apps such as the personal finance app Quicken.

The problem is that many banks cannot determine whether account activity follows user instructions. A bank executive said it is hard to distinguish among agents and difficult to judge whether an agent was approved by the user or gained unauthorised access.