Banks are right to block rogue AI agents, but walls aren't a plan

Would you hand a stranger your online banking password because he promised to optimize your savings? That, in essence, is the bargain whenever an agent logs in with a customer's own credentials, and it's why the news that US banks are shutting the door deserves less outrage than it's getting.

Here is what has been reported. Axios reported that major US banks are detecting unauthorized third-party AI agents operating inside customer accounts. Reuters followed that major banks have been blocking such agents from operating inside accounts and making transactions. Banking Exchange says Bank of America and Citigroup have restricted them, joining JPMorgan, and the New York Post uses the word "nightmare" in its headline.

The block is defensible, because nobody can answer four basic questions

A bank has to know who is acting, whose authority they carry, what they may do right now, and what evidence will exist afterward. That's not our framing; it's close to how Ping Identity's white paper describes the problem. It adds a detail that explains the banks' nerves: an agent can work asynchronously, chain many tools, and issue requests that each look valid in isolation while the whole sequence strays from what the customer wanted.

A password-based login can't express any of that. It can't say "check my balance but never move money," and it can't tell a human from a script. If an agent logs in with a customer's credentials, the bank sees the customer. In our view, a fraud team that refuses to play along is doing its job.

Liability is the other half. The Consumer Bankers Association's symposium paper notes that the Electronic Fund Transfer Act set clear rules of the road, including limits on consumer liability for many unauthorized transactions. We'd argue those rules were written with people and cards in mind, not for a chatbot that decides to "help." Until it's settled who eats the loss when an agent misreads an instruction, banks have every incentive to say no. We'd say no too.

But blanket bans are a walled garden in disguise

Here's where we part ways with the cheerleaders of the lockout. Blocking is a stopgap, not a strategy. The risk is that "security" slowly becomes the justification for each bank building its own proprietary agent, its own approved partners and its own toll booth.

The regulatory backdrop hints at how real that risk is. The Section 1033 rule from the CFPB, finalized in October 2024, would require institutions to make consumer data available to authorized third parties, but Socure notes it is under litigation and reconsideration by new CFPB leadership. It also says the rule doesn't prevent banks from charging access fees, a point that remains fiercely debated. With the legal footing that shaky, we think banks have little pressure to open up and plenty of reasons to keep customers inside their own channels.

Meanwhile the market isn't waiting. Invela reported in August that Plaid and Sierra let AI agents connect bank accounts and act on the data mid-conversation. Open Banking Tracker is already keeping a directory of banks shipping first-party Model Context Protocol servers. So sanctioned agent access is not science fiction; some institutions are building it.

What a sanctioned standard should look like

Our proposal is simple to state and hard to execute. Agents should be treated as governed actors, which is the language Ping uses: a distinct identity, a verifiable link to the customer, and permissions limited by purpose, scope, duration and risk. Reading a balance, preparing a transfer and releasing funds should be different permission tiers, with human approval for the consequential ones. Revocation should be instant, and every request should leave an audit trail.

That is basically open banking's lesson applied again. Replacing credential sharing with permissioned APIs was a goal of the earlier wave, and agents are a stress test of whether the industry meant it. Konsentus argues agentic AI is challenging the static consent models of PSD2; if consent built for one-off flows already creaks, a password handed to a bot is hopeless.

Our verdict

If you're a customer, don't give your banking credentials to any agent, however helpful the demo looks. If you're a bank, keep the blocks until you can offer something better, and publish a timeline for that something. If you're an agent developer, stop pretending screen access is a feature.

The blocks are the right short-term answer. But if a year from now the only way to use an agent with your money is the one your bank sells you, the industry will have solved a security problem by creating a competition problem. Regulators and banks should aim for a shared standard, not a collection of gardens.