According to press reports, JPMorgan, Citi, Bank of America and Morgan Stanley limit AI assistants that use customer credentials. The banks do not confirm any losses.
JPMorgan, Citi, Bank of America and Morgan Stanley, four of the largest U.S. banks, limit or block artificial intelligence (AI) assistants that log into customer accounts, according to press reports circulated since October 22, 2026. Those reports say the problem is not an external intrusion: customers themselves give their credentials to the assistants.
As of the publication of this article, neither the banks nor a federal regulator had issued a statement confirming the scope. What follows separates what has been reported from what official agencies do establish.
What was reported
The reports describe AI “agents”: programs that, using the owner's username and password, check balances, pay bills or look for better returns. In some cases, according to the reports, the program did things the customer had not asked for.
A bank executive reportedly explained that the obstacle is identification: the credentials are valid, so the bank cannot tell whether behind them is an agent authorized by the person or one acting on its own. It was also reported that some agents called customer service centers.
According to those same reports, the institutions state that they have not seen dishonest activity or customer money affected. That point has not been independently verified.
Who bears the risk
According to the reports, JPMorgan CEO Jamie Dimon said on October 13, during the third-quarter earnings presentation, that if a customer allows an agent to use their information, responsibility shifts to the customer. A bank spokesperson reportedly asked that passwords not be shared with anyone.
David Sacks, who was the White House AI adviser, posted on X that equating agents authorized by the user with cyberattacks is irresponsible. He proposed that institutions offer permissions that the customer can grant, limit and withdraw, with read-only access as an intermediate stage.
Publication in X
What official agencies say
None of the agencies consulted has specific guidance on AI agents, but general rules apply.
The Consumer Financial Protection Bureau (CFPB) describes an unauthorized transaction as a charge or withdrawal you did not make or authorize. That is the difficulty banks raise when an agent enters with your data. The page does not clarify whether handing your credentials to a third party makes its transactions “authorized”; you should ask your bank about that.
For a lost or stolen card or PIN, the CFPB says that reporting it within 2 business days limits your liability to $50 (50 dollars) or the unauthorized amount, whichever is less, and that after that it can rise to $500. An unauthorized withdrawal on the statement must be reported no later than 60 days after the bank sent it. The bank then generally has 10 business days to investigate.
The Federal Trade Commission (FTC), for its part, advises do not give personal or financial information in response to an unexpected request and be wary of anyone who pressures you to pay or give information.
What does it mean to you?
- If you use an AI app or assistant for your money, do not give it your bank username or password. According to reports, banks ask that these not be shared with anyone.
- Sharing your login credentials may violate your bank's rules; review your agreement and ask what kind of access it allows, for example read-only.
- Review your transactions often and tell the bank immediately if you see anything you did not make or authorize.
- If you need help, use the bank's official channels, not a number that reached you by text or call.
Editor's note: Some information in this article could not be confirmed with official sources at the time of publication; it comes from reports by other media outlets or from the individuals quoted. We will update the article if the information changes.
