US banks are restricting AI agents that use customers' passwords. Your firm's agents need accounts of their own

AI agents are assistants that can sign in to websites and act for a person, not only answer questions. On 22 October the news site Axios reported that several large US banks had found such agents working inside customer accounts, signed in with usernames and passwords the customers had handed over.

According to people familiar with the issue, some of these agents contacted bank call centres, and some appeared to act without the customer's instruction. Axios's sources said Morgan Stanley has begun blocking outside agents, and JPMorgan, Bank of America and Citi are restricting them. Most of the banks are moving towards letting an agent see an account but not act in it. A Chase spokesperson said customers "should not give their usernames and passwords to anyone" (Axios, via Yahoo Finance). The report describes no money lost.

The companies that make and secure agents have been moving in the same direction this month. On 8 October Google said its new "coworker" agents will each get a Workspace account of their own, with an email address, and that such an agent "acts under its own identity rather than yours" (Google Cloud). On 22 October, the same day as the Axios report, the password manager 1Password launched a service that signs agents in to websites without ever showing them the password.

So the banks do not want agents holding customers' passwords, 1Password wants to keep passwords away from agents, and Google is giving agents separate accounts. A small firm faces the same choice as soon as someone connects an AI assistant to the firm's email or files, because that assistant then works under that person's login. Should an AI agent ever log in as you? The answer depends on how agents get into accounts, what goes wrong when they use yours, and what a small firm can set up instead.

The three ways an AI agent gets into an account

An ordinary AI assistant becomes an agent when it is allowed to act: to sign in, read and send email, fill in forms or make payments. To do any of that in one of your accounts it needs a way in, and there are three.

1. It uses your username and password. You type them into the chat, or let it work in a browser where your logins are saved. This is what the US banks found.
2. It connects to your account. You click "Allow" on a screen from Google or Microsoft, and the agent gets whatever access that screen listed. It never sees your password, but everything it does is done in your name.
3. It has an account of its own. Someone sets up a login for the agent itself, with its own permissions, and its actions are recorded under its own name. Google's coworker agents work this way. Microsoft offers something similar called Entra Agent ID, which is aimed at organisations that build their own agents.

1Password's new service makes the first route safer. When the agent reaches a sign-in page, 1Password asks the person to approve on their own device and then fills in the password itself. Once the agent is signed in, though, it is still working inside that person's account. Only the third route keeps what the agent does apart from what you do.

What goes wrong when an agent works under your login

Two problems apply whether the agent has your password or a connection to your account.

The first is reach. An agent signed in as you can do anything you can do in that account, not only the job you gave it. The UK's National Cyber Security Centre (NCSC), part of GCHQ, said in its advice on AI agents in August that "The credentials available to an AI agent form part of its potential 'blast radius' if it behaves unexpectedly." In plain terms, if your login can approve payments, delete client files and email every client, an agent using it can do all of those too. The NCSC advises giving an agent "only the permissions it needs for the task being performed."

The second is the record. When an agent sends an email or changes a file under your login, your systems record your name. If something goes wrong, nobody can tell which actions were yours and which were the agent's. That is also the banks' difficulty: an agent using a customer's password looks to the bank like the customer. The NCSC advises that agents should have "their own unique identity", separate from the people they work for. Google says its agents do this: "every action Gemini takes is written to an audit trail and attributed to the agent rather than to a person."

Handing over a password adds two more problems. Nothing limits the agent to the task you set. 1Password's own blog says that pasting a password into a prompt "means allowing the agent to have access to your credential, potentially beyond the task at hand." And you cannot take a password back. To stop an agent that has yours, you have to change the password, which signs you out too. A connection, by contrast, can be removed from your account settings in a minute.

Why agents need limits even when nothing has gone wrong

The banks in the Axios report have not described any losses, and a Morgan Stanley spokesperson said it has not seen "rogue AI agents accessing our platforms". The case for limits rests on how agents behave, not on a run of incidents.

Goldman Sachs's chief information officer, Marco Argenti, put it this way at a conference in New York on 22 October: "You have to embrace the fact that any agent could misbehave." He explained: "They're not deterministic machines, they're stochastic machines" (Banking Dive). That means an agent given the same instruction twice will not always do the same thing. So the limits have to be in place before an agent does something nobody expected. We described one such case last week, when an agent with "always allow" permission gave a buyer its owner's home address.