The most dangerous intruder in finance may not be a thief at all, but a machine invited in through the front door. If a bank sees only a valid username and password, how does it know whether a person is typing or an AI agent is obeying? That is the unsettling question now hanging over the next phase of digital banking, where the old assumptions about identity, consent, and control start to look as brittle as glass in winter.
The immediate trigger is a Forbes piece by Sandy Carter, which argues that banks cannot reliably distinguish a customer from an AI agent acting inside an account when the agent uses shared credentials. The report lands in the middle of broader concern after Axios said major US banks detected unauthorized third-party AI agents in customer accounts, with some acting beyond user instructions. Reuters could not independently verify that account, and the underlying details rest on anonymous sources. That uncertainty matters. So does the larger point: banks are confronting a problem that their current login systems were never designed to solve.
The old security model assumed a simple world. A human logs in, authorizes a transfer, and bears the consequences. But software agents collapse that neat sequence. They can enter the account with the customer’s own username and password, which violates most banks’ terms requiring a human to log in. Once that boundary is crossed, the bank is left with a legal and technical puzzle. The system can confirm credentials, but not intention. In game theory, that is a classic information gap: one side can act, the other side can only infer. In markets, those gaps are where fragility grows.
The banks named in the reporting as responding include Morgan Stanley, JPMorgan, Bank of America, Citi, and Wells Fargo. Morgan Stanley has begun blocking third-party agents. JPMorgan, Bank of America, and Citi are restricting them. Wells Fargo has gone a different route in its updated Online Access Agreement, effective Nov. 24, 2026. It adds a “Third-Party AI Agents” section and says agent actions authorized by the customer are “AT YOUR OWN RISK.” That is not a technical solution. It is a transfer of liability. When systems cannot clearly distinguish actor from proxy, contracts become the last line of defense.
JPMorgan’s posture is especially revealing because the language from its leaders is less about hype than about swarm risk. Jamie Dimon said, “You don’t want rogue agents, and it could be thousands of them.” Jeremy Barnum added, “If they give up their credentials to the agent, and the agent does something that they don’t want, that’s going to be on them.” Bank of America’s Brian Moynihan took the same basic line: “We strongly believe there should be a human in the loop to authorise money moving out of your account.” Strip away the corporate phrasing and the theme is clear. Banks are less worried about one clever bot than about scale, repetition, and the speed at which small errors compound.
That is the part many investors miss. Technology risk is often misunderstood because people focus on the first failure, not the hundredth. A single mistaken transfer looks like a customer service issue. Thousands of agents operating through shared credentials begin to resemble a structural weakness. History is full of systems that were stable until the assumptions behind them changed. The telegraph was secure until intermediaries became numerous. The lever was reliable until the fulcrum wore down. Banks are now discovering that “the customer logged in” is not the same as “the customer acted.”
Shared passwords were always a compromise, not a philosophy. They worked because the number of human actions was limited and easy to audit. Agentic commerce changes that arithmetic. If an AI agent can read, decide, and transact inside a customer account, then the credential becomes a portable permission slip rather than proof of personal intent. That sounds efficient until it isn’t. In a distributed system, the weakest authentication rule becomes the attack surface for the whole structure. The more tasks you hand to software, the more you must ask whether the software is the user or merely the user’s shadow.
That is why the emerging response is not just blocking, but credential redesign. Forbes cites Visa’s Trusted Agent Protocol, developed with Cloudflare, and Mastercard’s Agent Pay and Agentic Token as frameworks meant to create verifiable agent credentials. The goal is simple to say and hard to execute: prove that an agent is allowed to act without pretending it is a human. That distinction matters. A bank does not just need to know that an instruction came from somewhere inside a login session. It needs to know who, or what, is entitled to move money, under what limits, and with what traceable authority.
There is a familiar temptation here, especially in finance, to assume the market will innovate its way around the problem. Sometimes it will. But institutions are not forests; they do not self-heal quickly after a fire. They harden, patch, and reroute. That means the interim period matters most. Wells Fargo’s “AT YOUR OWN RISK” language is a clue to where the burden may land before standards settle. Read-only access, tighter permissions, and “day after” recovery planning suggest banks are preparing for a world where they can inspect the aftermath better than they can prevent the act.
This is not just a cybersecurity story. It is a story about responsibility under automation. The more we let software mediate ordinary life, the more we blur the line between assistance and agency. That blurring is seductive because it promises convenience without friction. Yet friction is often the price of safety. In engineering, the guardrail looks inefficient until the road curves. In banking, the second authentication step looks annoying until a system starts making decisions faster than a human can supervise.
The investor psychology around this theme is also predictable. People tend to believe the future will be cleaner than the present, as if new tools erase old risks rather than multiply them. But automation rarely eliminates discretion; it moves it to a different layer. Someone still decides what the agent can see, what it can spend, and how much trust it deserves. If that layer is vague, the system becomes more fragile, not less. Probabilities do not disappear when hidden. They accumulate.
There is another reason this matters. The reporting points to a scale problem that is only beginning to emerge. IDC projects active AI agents rising from 31 million in 2025 to 2.45 billion in 2030. Whether every one of those agents touches a financial account is beside the point. Scale changes the economics of misuse. A one-off manual abuse case can be investigated. A population of agents interacting with bank platforms creates an environment where errors, abuse, and unauthorized actions can travel faster than human review. That is not a prediction of disaster. It is a recognition that complex systems fail differently once volume rises.
The likely next stage is not a clean victory for any side. Banks will keep tightening controls. Some will block third-party agents outright. Others will allow narrow, read-only access or require stronger forms of agent identity. Customers will want convenience and will also want someone else to bear the loss when convenience goes wrong. That tension is not new. It is the oldest pattern in finance: the search for yield or speed, followed by the discovery that safety was being quietly subsidized by rules no one noticed until they broke.
So the real question is not whether AI agents can log in. They already can, at least in some cases, by using human credentials. The real question is whether the financial system can build a reliable difference between consent and simulation. If it cannot, then the account holder is no longer the sole actor in the account. The machine becomes a delegated self, and delegation without verifiable identity is how small compromises become systemic vulnerabilities. Banks are right to worry. Not because agents are evil, but because permission without proof is how modern systems drift from orderly to brittle.
