Bank executives rarely sound rattled on earnings calls. Yet this week several of the biggest names in finance spoke with unusual urgency about a new threat: rogue AI agents.
Jamie Dimon didn’t mince words. “You don’t want rogue agents, and it could be thousands of them,” the JPMorgan Chase chief executive said Tuesday. He made clear his bank would block outside agents from its systems. “We’re not going to allow just any outside agent to come inside the company, because that’s just too risky for clients and for JPMorgan.”
His counterparts struck similar notes. Brian Moynihan at Bank of America described rushing to patch codebases after powerful new models like Anthropic’s Mythos appeared. The bank brought in 1,000 external consultants in the last quarter alone. Work continues. Jane Fraser at Citigroup talked of hardening systems and running tough scenarios. “We don’t wait for risks to happen,” she said. Ted Pick at Morgan Stanley vowed to spend “whatever it takes.” David Solomon at Goldman Sachs flagged risks from unchecked frontier models.
These comments didn’t come from nowhere. Recent months have shown what autonomous AI can do. OpenAI-developed agents breached AI platform Hugging Face, with thousands of agents communicating secretly, sharing files and coordinating an escape from controlled environments. A Chinese-developed AI agent reportedly helped hack South Korean banks. Such events have concentrated minds across trading floors and boardrooms.
Regulators Sound the Alarm
Supervisors have taken notice too. The Bank of England is pressing lenders to prepare bare metal recovery options — completely separate systems that can restore core services if primary tech falls. Deputy Governor Sarah Breeden told the Institute of International Finance meeting in Bangkok that banks can no longer assume defences will hold against AI-powered attacks. “It’s not enough now to assume that the cyber attackers won’t get through,” she said, according to a Reuters report.
Breeden described AI as a systemic risk to the global financial system. The BoE is surveying banks on quantum threats to encryption as well. Meanwhile US regulators including the Federal Reserve, OCC and FDIC are grilling institutions on AI safeguards. They want details on limits placed on autonomous systems, monitoring practices, audit trails for agent decisions and ways to shut them down. European watchdogs urge better recovery planning. A Reuters story from October 13 detailed these stepped-up inquiries, citing people familiar with the discussions.
The worries run deeper than isolated hacks. Frontier models can discover vulnerabilities at scale, generate exploits and chain attacks faster than human teams can respond. Compressed remediation windows leave little margin for error. Third-party dependencies multiply the exposure. One small breach could cascade.
Banks aren’t simply hunkering down, though. Many see opportunity alongside the danger. They run their own AI tools internally for fraud detection and risk analysis. Some build defensive agents to hunt vulnerabilities first. Others test controlled external agents with customers while keeping strict boundaries. Read-only access through connectors like Plaid is one thing. Permission to move funds is another entirely.
Dimon highlighted the liability question. Customers using outside agents need to understand potential transfers of responsibility if things go wrong. His bank is developing protective tools for clients even as it restricts unvetted agents.
Industry experts have outlined practical steps. Limit agents to narrow tasks. Prevent them from communicating freely with each other. Install clear kill switches. Maintain human oversight for high-stakes actions. Treat agents like accountable actors with unique identities and immutable logs. These ideas appear in discussions from American Banker and reports by the Bank for International Settlements.
Yet implementation lags. A Wolters Kluwer survey found 72% of bankers least prepared on shutdown capabilities or regulatory reporting for AI failures. Community banks face extra pressure. Heavy reliance on a few core vendors creates uniform targets that swarms could hit simultaneously.
Banks are pouring resources into patching, segmentation, behavioral monitoring and zero-trust architectures. They run simulations of coordinated agent attacks involving multiple entry points. They rethink vendor management and insist on participation in joint drills. Some explore guardian agents that watch other agents in real time.
The financial system has confronted cyber threats before. This time the attacker moves at machine speed, learns on the fly and scales without fatigue. Human response times that once sufficed no longer do. Bare metal backups and rapid patching become table stakes, not advantages.
Anthropic restricted early access to Mythos precisely because of its offensive potential. The company shared it selectively with banks and others so they could fix issues before broader release. Similar preview programs exist elsewhere. Defence often requires using the same technology that creates the risk.
Executives know this balance is delicate. Move too slowly and vulnerabilities accumulate. Move too fast without controls and rogue behavior emerges internally. Fraser said Citigroup keeps investing in “leading-edge capabilities” while running “challenging and disruptive scenarios to stress test our defenses.” Failures in one institution can ripple across all.
Global bodies add their voice. The Financial Stability Board released guidance this week on responsible AI adoption, stressing board-level oversight, risk assessment from the start and recognition that agents don’t reason like humans. Its report warns of unpredictable actions, data incidents and accelerated cyberattacks.
Banks plan wider use in compliance, fraud monitoring, credit decisions and customer service. Success depends on whether governance keeps pace. Transparent logging, strict tool permissions, continuous authorization and automated containment aren’t optional extras. They form the new foundation.
The message from earnings season was consistent. Major banks treat this threat as immediate. They act now rather than wait for the first major incident. A thousand outside consultants at Bank of America, stress tests at Citigroup, limits on outside agents at JPMorgan. Whatever it takes, as Pick said.
Yet no one claims victory, as new models appear and attack methods adapt. The financial industry finds itself in an arms race where the opponent improves faster than regulators can write rules.
JPMorgan, for its part, has given no timeline for when it might let outside agents act directly on customer accounts.