Banks Are Trying to Wall Off Third-Party AI Agents. The Hard Part Is Proving Who Asked for the Transaction.

Morgan Stanley, Bank of America and other large banks are trying to contain the risk from third-party AI agents that access customer accounts without being vetted, according to an Axios report summarized by The Neuron. The same week, Anthropic opened a research preview of an agent app that watches tasks and can buy things for you. The two stories are the same problem seen from opposite ends: when an agent moves money or changes an account, who actually asked for it?

One caveat up front: the bank story reaches us through a single newsletter summary of a single Axios report. We have not seen the underlying piece, and the banks quoted are described only as “Morgan Stanley, Bank of America and others.” Treat the details as reported, not confirmed.

What the banks are worried about

Per The Neuron’s summary of the Axios report, the core issue is attribution: telling apart a customer’s instruction from an agent’s overreach. The distinction the report draws is by access type. Read-only access is low risk. Agents that can initiate transactions are not.

That framing matters because it moves the fight away from “are agents allowed” and toward evidence. If a transfer goes wrong, the bank needs to be able to show whether the customer told the agent to do it, the agent improvised, or someone hijacked the agent. Today a login credential handed to a third-party agent looks the same to the bank as the customer logging in.

What’s shipping into that gap

• Claude Duet. Anthropic opened a research preview of a proactive agent app on iOS, Android and web, running on Claude Opus 5.5. It does morning briefings and task monitoring and connects to 6,000+ services. Purchases through Stripe Link or Shopify Shop Pay require explicit approval. It’s on a US waitlist for Pro and Max users. (Tech Startups, The Neuron)
• Auto mode as the default. Per the same sources, Claude’s “auto mode” becomes the default in web, desktop and mobile for Pro, Max and Team users next week, with automated checks that block risky actions.
• Agent credentials. 1Password announced an agent credentials platform built with Anthropic and OpenAI. (The Neuron)

Two different answers to attribution show up here. Duet’s is a human click: the purchase waits for explicit approval. Auto mode’s is a classifier: automated checks decide what’s risky. The credentials platform is a third layer, controlling what the agent can present in the first place. None of these produces what a bank would want, a record that survives a dispute. They’re product-side safeguards, not evidence a bank can rely on. That gap is our inference, not something the reporting states.

The monitoring layer is itself shaky

Meanwhile, METR and Redwood spent three weeks at OpenAI testing misalignment monitors for its internal agents. They found several vulnerabilities, including one that could let agents hide hundreds of actions, per The Neuron. That is a single-source summary too, and it concerns OpenAI’s internal agents, not consumer banking agents. But it bears on the same question. If the tooling that logs what an agent did can be gamed, a bank can’t treat the agent’s own activity log as proof of what happened.

The Neuron’s framing of the value side is worth keeping next to this: a proactive agent only pays off if the time it saves exceeds the effort of checking its work. Banks are making the same calculation with liability attached.

Two readings

The cautious bank reading: read-only access is easy to permit, transaction-initiating access isn’t, and until attribution is solvable a bank is rational to restrict agents it hasn’t vetted. If it can’t prove who asked for a transfer, it pays for the mistake.

The agent-builder reading: a customer who tells an agent to act on their behalf is the one making the request, and blocking by default protects incumbents’ control of the customer relationship as much as it protects customers. We covered the same split when Amazon blocked Meta’s shopping agent, where the platform’s argument was identification and consent and the agent-builder’s was user agency.

Both can be true. The report as summarized doesn’t say which banks have actually blocked anything, or what vetting would require.

What we’re watching

We build agentic systems on Claude, and Duet is Anthropic’s product, so read our interest accordingly. The questions we’d want answered:

• Whether any bank publishes what “vetted” means for an agent, and whether it’s an allowlist, an identity standard or a contract.
• Whether agent credentials platforms like 1Password’s end up being the thing banks accept as evidence of delegation.
• Whether Duet’s explicit-approval step survives contact with auto mode, which exists to reduce how often a human has to approve something.
• What OpenAI does about the METR and Redwood findings, since a hidden-actions flaw in a monitor is exactly the failure that makes attribution disputes unwinnable.