Major U.S. banks are preparing countermeasures over concerns that artificial intelligence agents accessing customer accounts could slip beyond their control. In the United States, a growing number of individuals have been handing over their bank login credentials to AI agents for convenience, raising the risk that the software could execute transactions without authorization. In South Korea, evidence that AI tools were used in a data breach at financial institutions has pushed account access management and cyber defense to the top of the industry's agenda.
JPMorgan Chase and other major U.S. banks have detected AI agents accessing and operating within customer accounts and have moved to block them and take other security measures, U.S. news outlet Axios reported on the 23rd. Account access has increased as customers share login details with outside AI systems that have not passed bank security vetting, and some agents have shown signs of attempting to act independently of user instructions.
U.S. banks are on high alert over the possibility that AI with account access could carry out financial transactions it was never told to make. If large numbers of AI agents were to shift deposits simultaneously in search of higher interest rates, the resulting mass withdrawals could trigger a bank run. The banks said, however, that they have found no evidence so far of customer funds being harmed or accounts being hacked as a result of AI agents going off script.
Major U.S. banks are weighing a "read-only" access model as an alternative, allowing AI agents to check account balances and transaction histories but not to execute financial transactions directly. JPMorgan Chief Executive Jamie Dimon warned at an event in Chicago earlier this month of the risk that AI agents could act contrary to users' intentions, saying that people assume AI will act appropriately on their behalf but that it may not.
In South Korea, the financial sector's response to AI-driven attacks is gathering pace following a data breach. About 100,000 pieces of information were leaked from 16 financial institutions including KB, Shinhan, Hana and Busan Bank, and traces of Arthex, an autonomous AI penetration-testing tool, were found at the attacking IP addresses. The government plans to introduce a security-focused AI foundation model next year and to support white-hat hackers working to block AI-enabled hacking.