The ongoing tensions in Iran, particularly concerning the conflicts involving Saudi Arabia and Ansar Allah, seem to have settled into a suspended state, akin to a waiting game. In the meantime, another urgent topic has emerged: the growing concerns surrounding AI agents accessing bank accounts and potentially engaging in detrimental activities. As we dive deeper, I find the official narrative lacking in clarity and comprehensiveness, and I hope that experts will shed more light on this issue.
To provide context on the Iran situation, we currently see a cacophony of voices, which unfolds across two distinct theaters of action:
Now, let’s shift focus to the concerning developments regarding AI in banking. Currently, the insights available stem largely from an initial report on Axios. It’s worth noting that Reuters has primarily echoed Axios’s findings. According to Axios in their piece titled Scoop: Unvetted AI agents are accessing U.S. bank accounts:
Major U.S. banks are identifying unauthorized third-party AI agents operating within customer accounts, with some agents attempting actions that seem to be independent of user instructions, sources inform Axios.
Why it matters: This influx of AI agents is becoming increasingly problematic for American banks, infiltrating banking systems faster than these institutions can respond.
- The challenge of distinguishing between a human user and an unauthorized bot is forcing banks to block this technology and urgently revise their terms of service.
Driving the news: Financial giants like Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo are racing to mitigate risks associated with these agents. Some banks are already aware of instances of unauthorized access, according to insiders.
- Typically, these situations occur when agents or AI assistants access a user’s account using the individual’s permission and login credentials. Even when users grant permission, this violates the policies of most banks that require personal logins.
- This creates significant security risks: Banking executives fear the actions that agents with login access might take, especially if users permit them to make purchases or transfer funds.
- In other instances, some banks have tracked activities where agents—designed to fulfill requests on behalf of users—contact call centers or seem to act independently of user directives, sources revealed.
What they’re saying: Bank executives describe the current situation as alarming, with one official expressing deep concerns about agents accessing customer accounts and taking actions that could potentially affect user finances.
State of play: These concerns are driving several banks to limit access for third-party AI agents.
Zoom out: Many banks are either allowing or on the verge of allowing read-only access, which would let agents view customer financial data without being able to take any actions.
Reality check: Numerous banking executives acknowledge the necessity of finding a balanced approach with AI agents.
- Customers are likely to demand the use of these agents in the future, which banks recognize.
- However, the current risks associated with being overly lenient are significant.
Threat level: Many banks reportedly face challenges in determining whether agent-driven account activity is user-directed.
- One bank official shared that they struggle to differentiate between agents, as well as discerning whether an agent has user authorization or has gone rogue by gaining access to customer accounts.
While I may be considered old-fashioned, I find it hard to fathom sharing sensitive information—especially financial logins—with AI. I also belong to the group that would never utilize a fitness tracker. How many of you have shared banking credentials with AI, or know someone who has?
This may indeed be true: some customers have shared their financial account credentials with AI, which may have gone rogue. However, I am skeptical that this captures the entirety of the situation. Banks and financial institutions, like many others, have adopted AI agents to reduce customer service costs. Experts have long flagged the security threats posed by AI agents, which require vast amounts of information to perform their intended functions. According to an article titled When AI Becomes the Insider Threat: Understanding Risks in Modern SaaS Environments:
- AI qualifies as an insider through trusted access, not intent: AI becomes an insider threat when it functions with legitimate credentials, permissions, or integrations within the SaaS trust boundary, rendering it functionally similar to an internal actor.
- Non-human identities grant AI broad and persistent SaaS access: AI systems authenticate via service accounts, OAuth apps, API clients, and tokens, inheriting permissions that afford continuous, non-interactive access across business systems.
- AI circumvents traditional user-centric security measures: By operating through background processes and delegated permissions, AI can access or reveal data without triggering any user-based monitoring, behavioral alerts, or session-specific controls.
- Over-permissioned AI and integrations broaden risk across applications: AI tools frequently receive excessive permissions and connect to various SaaS applications, thereby enabling aggregation and access to data that exceeds their original purpose.
This indeed poses an enterprise-level threat; what banks are admitting to is largely reflective of the same concern but at the level of customer accounts.
Another perspective:
I am doubtful that these breaches solely stem from users providing AI with their credentials; it is possible that the banks themselves may have played a role in the problem through their AI implementations—something they would likely never acknowledge without external pressure such as whistleblowing or legal discovery.
As noted in comments on Gary Marcus’s post regarding banks’ security dilemmas:
Uche: ChatGPT announces that they have introduced COBOL into the mix… Days later, banks are experiencing issues with AI Agents?
Gary Marcus: Where was that? The COBOL announcement?
Jules: There is a reference to introducing more 3GL coding capabilities here, discussing COBOL and Fortran: link
Many banks, insurers, and governmental agencies still rely on COBOL for their transaction processing engines.
Recently, South Korea illustrated the vulnerability of banks to AI-based external hackers:
🇰🇷 South Korea’s president says hackers utilized AI to infiltrate banks, leading to widespread concern.
Lee Jae Myung revealed today that customer data was compromised at seven financial firms over the last week, with indications that AI was exploited in some of the attacks.
The hackers targeted weaker side doors instead of the banks’ main payment systems. In one incident, an attacker bypassed identity checks on a portal used by loan brokers, exposing details of about 25,000 Shinhan Bank customers.
Additional breaches occurred at smaller lenders, while bigger institutions like KB Kookmin and Hana Bank also faced smaller leaks. Matching IP addresses suggest a single attacker could be responsible for at least some of these incidents.
A local security expert noted that a Chinese-language, open-source AI hacking tool was likely employed to identify vulnerabilities.
No financial losses have been reported, but the police are investigating, and the government is maintaining a constant state of emergency response.
To combat AI attacks, South Korea’s financial regulator intends to utilize AI itself.
So, moving forward, it looks like robots will be defending the vaults from other robots.
Source: FT / Writer: Julie
— Mario Nawfal (@MarioNawfal) October 6, 2026
As always, I welcome informed feedback from readers.
