Bank of America Urges Customers to Stop Sharing Login Credentials with AI Agents
What Happened — Bank of America sent an email to its retail customers titled “Protecting your finances in the AI world,” warning them not to share banking usernames and passwords with generative‑AI agents such as Meta’s Muse, Anthropic’s Claude, or OpenAI’s Dots. The bank cites recent reports that AI agents can request or harvest credentials, contacts, calendar data, and even execute financial transactions on a user’s behalf. Similar advisories have appeared from Citi, Morgan Stanley, Wells Fargo and JPMorgan, which are already blocking certain AI agents from accessing their systems. No breach has been reported; the guidance is preventive, aimed at stopping credential compromise before it occurs.
Why It Matters for Trust & Control Assurance — The advisory spotlights the need for strong credential‑management policies and user‑awareness controls that prevent unauthorized third‑party access.
Who Is Affected — Financial services firms (banks, credit unions, fintech platforms) and any organization that authenticates users to sensitive financial applications.
Recommended Actions
- Update password‑use policies to explicitly forbid sharing credentials with AI agents and communicate the change to all users.
- Deploy technical controls (e.g., web‑application firewalls, conditional‑access rules) that block known AI‑agent user‑agents from logging into banking portals.
- Incorporate AI‑agent risk checks into your existing identity‑and‑access‑management (IAM) governance program.
Source: ZDNet Security
Technical Notes
- Threat vector: credential harvesting by AI agents that request login data during onboarding or via hidden API calls.
- No specific CVE; the risk stems from design choices in AI‑agent platforms that request broad permissions.
Source: ZDNet Security