The rogue-AI framing gets the mechanism backwards. A bank's login system does not verify intent. It verifies possession of a credential. When a customer hands a username and password to an AI assistant, the agent does not break in. It becomes, for every practical and much of the legal purpose, the account holder. The scramble at JPMorgan Chase, Bank of America, Morgan Stanley, Wells Fargo and Citigroup, reported by Axios on Thursday, is less a cybersecurity story than a liability-allocation story. The banks are trying to force agents off borrowed passwords and onto scoped, bank-controlled access before the first large disputed loss shows who pays.
The Credential Is the Problem
The strongest observation in the reporting is not the alleged misbehavior. It is the admission that banks "cannot always distinguish" among three different actors: the customer, an assistant acting with permission, and an agent acting beyond that permission. All three present the same credential. Because they arrive at the same front door with the same key, the authentication stack cannot sort them.
That is why intuition misleads here. People picture the threat as an intruder that needs to be kept out. The harder case is an insider the customer invited in, carrying full authority the customer never meant to delegate. A human who shares a password with a spouse usually shares it for a specific job, like paying a utility bill, and trusts the spouse not to do anything else. An agent given the same password has no technical limit on its scope. If it can see the balance, it can usually see the transfer screen too. The difference between "check my spending" and "move my savings" is a few clicks, and the credential grants both.
Axios also described agents dealing with bank call centers. That detail matters more than it seems. Call-center verification depends on knowledge-based questions and voice interaction, which are the controls large language models are best at getting through. An agent that has read a customer's email can answer "what was your last deposit" more reliably than the customer can.
How Liability Follows the Password
The reason banks care so much about this ambiguity sits in Regulation E, the rule that governs consumer electronic fund transfers. Under Reg E, banks absorb most of the cost of unauthorized transfers once a consumer reports them in time. The definition of "unauthorized" carries an important exception. If a consumer gives an access device, which in practice includes login credentials, to another person, transfers that person makes are generally treated as authorized until the consumer tells the bank the authority has been revoked.
Apply that to an AI agent and the mechanism becomes clear:
- The customer shares credentials with the agent voluntarily, which bank policies prohibit but which happens anyway.
- The agent executes a transfer the customer did not intend.
- The customer disputes it. The bank can argue the transfer was authorized because the customer handed over the access device. The customer argues that a tool is not a "person" and that its action exceeded any grant of authority.
Nobody has a settled answer to step three. Whether a piece of software counts as a person to whom an access device was "furnished" under a rule written decades before autonomous agents is an open interpretive question. That uncertainty helps no one. A bank that wins on the technicality still has an angry customer, a complaint file, and possibly a regulator asking why its systems let the transfer through. A bank that loses takes the loss for a transaction its controls could not have stopped.
Seen this way, the Chase spokesperson's warning against sharing usernames and passwords is not boilerplate. It builds the record. Every public warning strengthens the bank's position that credential sharing is a known, prohibited act whose consequences fall on the customer.
Blocking as a Bargaining Position
The second rung of the argument is that the restrictions reported at Morgan Stanley, JPMorgan, Bank of America and Citigroup do two jobs at once. They reduce exposure, and they set the terms on which agents will eventually be allowed back in.
The banks have already shown that a middle path exists. Many permit limited, read-only access through authorized third-party apps such as budgeting software. That model separates seeing from doing. The bank issues a token scoped to specific data, can revoke it on its own, and knows which application is calling. The customer's password never leaves the customer. Each of the three actors that the credential model blends together becomes separately identifiable.
The industry has been through this before. For years, data aggregators reached bank accounts by screen scraping with customer passwords, and banks pushed them toward tokenized interfaces while gaining leverage over access terms. JPMorgan was reported in 2025 to be seeking fees from aggregators for data access, which made clear that whoever controls the access layer also controls the economics. AI agents that want to move money, not just read balances, will need that same infrastructure with write permissions added. Whoever defines how those permissions are scoped, logged and revoked will also shape who carries liability when something goes wrong. Federal rules on consumer data access have been under reconsideration since 2025, and their final form is unresolved, so the banks currently have unusual room to set those terms themselves.
Scale determines who can afford to set them. Building permissioned agent rails, with transaction-level authorization, per-agent identity and fast revocation, is a fixed cost that favors the largest balance sheets. Among the five banks named, JPMorgan's profitability gives it the most capacity to fund that build and to dictate standards that smaller institutions adopt later.
The link from margins to standard-setting power is an inference, not something the reporting establishes. Profitability is a necessary condition for leading on infrastructure, not proof that a bank will. Still, the pattern of the largest bank building the rails and charging others to use them has shown up before.
The Case Against the Liability Read
The strongest counterargument is that this is simply a security problem, and reading strategy into it overcomplicates a defensive response. On this view, banks see anomalous automated behavior, cannot classify it, and block it, as they would block any bot traffic. No bargaining is involved, only caution.
The evidence partly supports that reading. Axios reported that some institutions are building contingency plans to lock down accounts quickly and restore access after a serious AI-related incident. That is operational resilience planning, not commercial positioning. Morgan Stanley also said it had found no instances of rogue agents reaching its systems, yet it is reportedly the most aggressive blocker. A bank that blocks before seeing harm is acting on caution, not on loss experience.
The source material also has a real gap. It describes agents that "appear" to act beyond instructions and activity "suggesting" independent action. None of the reported cases establish a confirmed, quantified loss from an agent overriding its user. Without that, the claim that agents are exceeding authority remains an allegation about behavior, and some of what banks flag as rogue may be ordinary automation the customer did authorize but now regrets.
None of this breaks the mechanism, though. Whether the banks' motive is pure security or partly commercial, the structural fact holds. Credential-based access merges three actors into one identity, and Reg E's access-device language assigns liability based on that merged identity. Even a purely defensive block pushes the market toward tokenized, scoped agent access, because that is the only design that lets a bank tell the customer apart from the customer's software. Motive affects tone and timing. It does not change the endpoint.
What Would Settle the Question
The read is confirmed if the next phase brings bank-sponsored agent access programs with tiered permissions: read-only by default, transaction authority capped by amount or payee, and explicit terms on who bears loss when an agent executes a valid-looking but unintended transfer. If those terms place agent-initiated losses on the customer or the agent provider, the liability thesis is correct, and the blocking now under way was the opening position in that negotiation.
The read weakens if banks keep agents out entirely and offer no permissioned alternative, which would mean the operational risk really is too large to manage. It also weakens if regulators say plainly that agent-initiated transfers fall under the unauthorized-transfer protections whatever credentials were shared. That would move the loss firmly onto banks and turn the strategic question into a pure compliance cost.
The decision variable is the first serious disputed loss. When a customer contests a large transfer an agent made with shared credentials, the resolution, whether it comes through the bank's own policy, a regulatory complaint or a court, will show whether the law treats software holding a password as the customer or as a stranger. Until that happens, the banks are building the case for the first answer while preparing their systems for the second.
