Category: Cyber Security | Published: 2026-10-29
Asking an AI assistant to review your spending sounds very different from asking it to move your money. Yet if both tasks rely on the same unrestricted bank login, the software may have access to more than you intended.
That gap between a customer's request and a tool's actual permissions is central to AI banking risks. Reports of outside agents accessing US bank accounts have prompted questions about what happens when financial assistants move beyond suggestions and start taking action.
The opportunity is real: automation could reduce administration and make financial information easier to understand. The challenge is to make sure that permission to help never becomes open-ended authority over an account.
A conventional chatbot can explain a statement or suggest a budget. An AI agent can go further by using connected tools to carry out tasks, such as navigating websites, contacting an organisation or initiating a transaction where its access allows.
That changes the consequences of an error. A poor recommendation can be checked before somebody acts on it. An agent with payment permissions might turn the same misunderstanding into a transaction before anyone notices.
Before connecting a financial tool, ask whether it can only read information or whether it can also change settings, add recipients or move funds. The answer should come from the service's permissions and controls, not simply from what you have told the assistant to do.
Some US banks have reportedly detected external AI agents accessing customer accounts, with concerns that certain tools attempted actions beyond their users' instructions. In some cases, customers are reported to have shared their banking login details so the software could help manage their finances.
These reports raise serious questions about oversight, but they do not establish that every bank restricting agents has experienced customer losses.
Morgan Stanley, for example, said it had not identified unauthorised or rogue AI activity on its platforms. Restrictions can therefore be precautionary as well as a response to an identified problem.
It is important to keep the reported activity, the banks' preventive measures and any confirmed financial harm separate. They are not interchangeable evidence of the same thing.
During the 13 October earnings call cited in the source reporting, JPMorgan chief executive Jamie Dimon said the bank uses agents internally but would restrict outside access because of risks to customers and the institution.
Chief financial officer Jeremy Barnum highlighted credential sharing and screen scraping as methods the bank considers insecure and is blocking where possible. Screen scraping involves software retrieving information through the customer's banking interface.
The concern is understandable. A login that allows the customer to manage an account may expose functions that a budgeting tool does not need. Technical access to those functions is not the same as the customer's approval to use them.
There is also a commercial dimension. Barnum acknowledged that personal AI agents could help customers find better returns and move money more easily between providers. Banks must protect accounts while competing to retain deposits, so their response involves business interests as well as security.
An agent does not have to be deliberately harmful to make a costly mistake. It might misread a request, overlook a limit or interpret an instruction too broadly.
For example, a request to identify unnecessary spending should not automatically authorise changes to payments. The safe boundary needs to be built into what the software is allowed to do.
Instructions alone are a weak substitute for permissions. Telling an assistant not to transfer money is less dependable than using an integration that gives it no ability to transfer money in the first place.
This is why a read-only starting point can be valuable. It lets a business test whether the analysis is useful without simultaneously granting financial authority.
Agents may read webpages, emails or documents while completing a task. An attacker can place instructions in that material and try to make the system treat them as commands rather than untrusted content.
This is known as prompt injection. Depending on the agent's access, it could lead to an attempt to disclose confidential information or perform an action the customer never requested.
There is no confirmation that prompt injection caused the reported banking incidents. It is a potential route to misuse, not an established explanation for those reports.
The National Cyber Security Centre advises organisations to limit what agents can access and do, monitor their actions and retain a reliable way to stop them. Those measures reduce reliance on the AI consistently recognising every misleading instruction.
Researchers have also raised concerns about AI becoming harder to monitor when models use unreadable shorthand or provide fewer written reasoning steps.
For a business using financial automation, the practical lesson is not to treat the agent's account of its own behaviour as the only audit trail. An explanation can be incomplete, and a plausible description does not prove that the underlying action was authorised.
Keep independent records of the original request, the approval, the recipient, the amount and the transaction outcome. Payment controls should continue working even if the agent's explanation is unclear or unavailable.
A narrower payment flow can keep the customer involved at the point where money changes hands. The source describes an integration from Sierra and Stripe that allows somebody to discuss a bill with an AI telephone agent and then choose to pay during the same call.
Sierra says healthcare billing company Cedar is already using the integration. The customer enters card details on the telephone keypad, Stripe processes the payment and the agent confirms the result.
This differs from handing an assistant broad authority to operate a bank account. The customer participates in the payment decision rather than leaving the software to decide when and how to move money.
It is still necessary to check the amount, recipient and purpose. Protecting card details is an important part of the process, but it does not by itself establish that every payment is correct.
UK open banking already distinguishes services that view financial information from services that initiate payments. An account information service can help display balances and analyse transactions. A payment initiation service can initiate a payment with the customer's consent.
The FCA's guidance on account information and payment initiation services says providers must have the appropriate registration or authorisation and permission for the activities they offer.
Connecting a tool does not necessarily require giving it a banking password or unrestricted control. Check the provider, understand the consent process and review exactly which permissions are requested.
Regulatory status is not a guarantee that every feature or AI output is suitable for your needs. It is one part of checking the service, alongside its access arrangements, terms and security controls.
Comments from US executives about customer responsibility should not be treated as a definitive statement of UK rights. Responsibility for an error or disputed transaction depends on the circumstances and applicable rules. If you notice an unauthorised payment, the FCA advises contacting your bank as soon as possible.
Begin with a narrow task, such as preparing a cash-flow summary, and use read-only access where possible. Check the results against your records before considering wider permissions.
If payments are required, ensure that the payment system itself enforces safeguards rather than asking the agent to remember them:
- Require appropriate human approval before money is sent.
- Set limits on amounts and permitted recipients.
- Keep records showing what was requested, approved and carried out.
- Make it straightforward to revoke access and stop further activity.
- Assign a named person to review permissions and investigate unexpected behaviour.
Test these controls before relying on the workflow. Confirm what happens when an instruction is ambiguous, an approval is missing or the proposed payment exceeds a limit.
For help protecting business accounts, connected tools and confidential information, our Cyber Security Services page explains how we can support a safer approach.
AI banking risks are not a reason to dismiss every financial assistant. Useful automation can save time and help people make better-informed decisions.
The safer approach is to separate analysis from action, grant only the access a task needs and enforce payment safeguards independently of the AI. Customers and staff should understand what they have authorised, while someone remains responsible for checking the work.
An assistant may be able to do much more than you asked. Good financial controls ensure that it cannot simply turn that capability into permission.