U.S. Banks Prepare for Worst-Case AI Scenarios and Plans to Restore Customer Access
Key Facts
The largest U.S. banks are working to prevent worst-case AI scenarios, while also making plans for what happens after a catastrophe, according to an Axios report published on October 23. Institutions are preparing to secure or quickly restore customers’ access to their accounts if a large-scale attack occurs. This planning coincides with the growing use of AI agents that may access financial accounts and take actions on behalf of their owners. The banks identified in the report include Morgan Stanley, Bank of America, JPMorgan and Wells Fargo. These concerns involve the limits of an agent’s authorization and its ability to follow user instructions, alongside separate concerns about risks from frontier models.
Some agents access accounts using login credentials provided by customers with their permission, but this practice violates the guidance of most banks, which require people to log in themselves. Axios said some banks had observed agents contacting customer service centers or appearing to take actions independently of user instructions. This raises a practical question for institutions: Can they tell whether account activity was initiated and directed by the customer, or whether the agent acted on its own? The report said many banks currently cannot distinguish user-directed activity from other activity at scale. This uncertainty makes controlling access and restoring control of accounts part of their risk response plans.
Banks’ current response is to block external agents or restrict their permissions. Morgan Stanley has begun blocking third-party agents from accessing its platforms, while JPMorgan, Bank of America and Citi are also restricting their access. Jamie Dimon said JPMorgan does not allow any external agent to enter or act on customer accounts because of security risks. By contrast, most banks allow, or are moving toward allowing, read-only access, enabling agents to view financial information without taking action. This approach is an effort to preserve the ability to query accounts while limiting agents’ ability to transfer money or change account details.
Bank planning includes a “day after” scenario for a potential catastrophe, so institutions can secure or quickly restore customers’ access after a large-scale attack. The Axios report distinguishes this preparedness from concerns about agents’ activity inside accounts, saying fears about frontier systems have led banks to invest in prevention and preparation for the worst. At an Axios event on October 20, the head of the Federal Deposit Insurance Corporation raised the question of how much authority depositors would delegate to agents to move money. The head of Alpaca said that determining liability when an agent acts incorrectly remains an open question. This puts authorization and accountability among the issues institutions face as agents move into financial services.
In a separate development, other security warnings concern two critical vulnerabilities in PHP, which runs about 70% of websites worldwide, according to an Associated Press report. On October 21, PHP released updates that it said address two vulnerabilities that could allow remote code execution without authentication. The patched releases were 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP had rated each vulnerability 9.2 in severity on the CVSS v4.0 scale in its advance notice issued on October 20. These vulnerabilities concern the security of websites and servers that use PHP, and do not establish a causal link to the risks posed by agents accessing bank accounts.
A warning from the FBI’s cyber division urged website operators to take sites offline temporarily if they could not install the update immediately. The Associated Press reported that some government services were disrupted or operating with limited capabilities while protective measures were implemented. In Japan, officials said they had received no reports of damage from attacks linked to PHP vulnerabilities. The PHP Foundation said the vulnerabilities had been known since at least 2024 and described the delay in fixing them as a structural failure. OpenAI said it had led a coalition of developers, researchers and security providers during the previous two months to address PHP vulnerabilities, while Wiz researchers discovered the two vulnerabilities independently.
Salesforce CEO Marc Benioff had posted the phrase “code red” on X, quoting an Anthropic employee who warned that the security situation would get worse before it got better. The phrase came in the context of warnings about PHP vulnerabilities, not as an announcement by Benioff of a banking emergency. The developments thus bring together two parallel issues: controls on agents’ access to accounts, and the remediation of vulnerabilities in website and server infrastructure. For banks, the steps described remain blocking or restricting access, while most institutions allow or are moving toward read-only access. The immediate security update announced by PHP requires installing one of the patched releases listed in the October 21 notice.