Banks block third-party AI agents: build for read-only now

Big US banks are shutting the door on third-party AI agents. According to an Axios scoop published October 22, Morgan Stanley has started blocking outside agents from its platforms, and JPMorgan, Bank of America and Citi are restricting them. Nine days ago we wrote about JPMorgan doing this alone. Now it is an industry position. If any of your bookkeeping or cash-flow automation logs into a bank portal as you, assume it has an expiry date.

What actually happened

Axios, citing people familiar with the decisions, reported that banks are finding third-party AI agents inside customer accounts. Most of that access starts with customers who give their banking username and password to an AI assistant. Decrypt's write-up of the report adds that some agents took steps beyond what the user appears to have asked for, and that banks have trouble telling one agent from another, or an authorized agent from one gone rogue.

Two points to keep straight:

• Not every bank says it saw rogue agents. A Morgan Stanley spokesperson told Axios the bank has not seen "rogue AI agents" on its platforms. Its block looks preventive.
• No losses have been reported. The coverage names no fraud totals, no account takeovers and no specific agent products. This is banks drawing a line before the first big incident, not after it.

Executives told reporters that customers will want these agents, so a full ban is unlikely to hold. The middle path most banks are moving toward is read-only access: the agent can see balances and transactions but cannot move money. That is the same deal budgeting apps already get.

Why read-only access is the design target for your business

Read-only is not a downgrade. It is the correct split for most finance automation we build anyway.

Let the agent read; keep the human on "send." Reconciliation, cash-flow forecasts, invoice matching and anomaly flags only need to read. Payments get drafted by the agent and approved by a person in the bank's own interface.

Use tokens, not passwords. A scoped, revocable connection through your bank's API or an established aggregator survives a bank's anti-agent rules. A saved password in an AI assistant does not, and it puts every action the agent takes on you.

Audit before the bank does it for you. If an automation scrapes a bank portal today, it will break the day the block reaches your account, usually at month-end. Find it now and move it to a read-only feed.

Sources: Axios, Decrypt via Yahoo Finance.