Over the past few weeks, global banks and other companies that conduct online transactions have been ringing alarm bells about new personal AI agents, such as Meta’s Muse, over security and AI agent governance risks.
The concerns cover a range of serious issues that violate security policies, and as a result many banks are now banning financial transactions that are conducted by personal AI agents. Digging deeper, experts are citing examples of uncontrolled account access, rogue automated transactions, unclear legal liability and mass deposit flight.
My question, and the focus of this blog, is this: Should government websites follow the lead of banks and block personal AI agents for financial transactions such as renewing driver’s licenses, paying taxes and other activities that require verification of identities and/or legal digital signatures?
Going further, should personal AI agents be able to log on to government websites using your credentials to pay your bills or book a campground reservation?
IN THE HEADLINES
Before we go further, allow me to demonstrate what I’m talking about regarding the urgency of this issue. Consider these headlines:SFIST: Banks Are Freaking Out Over Personal AI Agents Accessing Customer Accounts – “As the popularity of personal AI agents like Meta’s Muse begins to grow, banks are already seeing issues with agents conducting unauthorized activities, and they’re already rewriting their terms of service to ban the use of these bots.”
AXIOS: Scoop: Unvetted AI agents are accessing U.S. bank accounts – “Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources tell Axios. …
“Banks including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and others are racing to contain agent risks. Some are aware of unauthorized access, people familiar with the issue said.
“These are generally situations when an agent or AI assistant accesses a human’s account with the user’s permission and login credentials. Even if permitted by the user, this goes against the guidelines of most banks requiring that humans log in to their own accounts.”
FT: Citi becomes latest US bank to restrict AI agents from accessing accounts – “Citigroup and Bank of America have become the latest US banks to restrict AI agents from accessing client accounts…
“Citi said it does not permit ‘third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms,’ adding that this was designed to help safeguard customer accounts and information.
“Bank of America’s Brian Moynihan also suggested the bank was restricting AI agents’ access to consumer deposits while it comes up with protocols to determine which entity was ultimately liable for payments authorized by artificial intelligence.
“’We strongly believe there should be a human in the loop to authorize money moving out of your account,’ Moynihan told CNBC on Wednesday. ‘We’re working with the agentic agent providers to say “Hey, you really don’t want consumers coming back and say money moved over from my account and I don’t know why and I don’t know where it went and the agent did it.”‘ A person familiar with the matter confirmed that BofA had restricted access.”
CNBC: JPMorgan Chase blocks outside AI agents like Muse, Instinct from directly accessing accounts – “JPMorgan Chase won’t allow outside artificial intelligence agents to access customer accounts and operate on their behalf, CEO Jamie Dimon said Tuesday, citing risks to the company and its customers as tech firms including Meta release autonomous assistants.
“’We’re not going to allow just any … outside agent to come in inside the company, because it’s just too risky for clients and for JPMorgan,’ Dimon told analysts on the bank’s third-quarter earnings call.
“’You don’t want rogue agents, and it could be thousands of them,’ he added, describing the potential threat to customers. In July, an OpenAI model hacked into AI company Hugging Face’s servers.
“The stance from Dimon, the longtime CEO of the biggest U.S. bank by assets and a de facto spokesman for the U.S. financial sector, is reminiscent of an earlier fight with fintech firms over access to customer data. JPMorgan moved to charge data middlemen including Plaid for access, a dispute that similarly pitted the bank’s security concerns against tech firms’ demands for access.”
PYMTS: Banks Crack Down on Unauthorized AI Agents Operating Inside Customer Accounts – “Charles Schwab CEO Rick Wurster said the brokerage is blocking unauthorized AI agents a double-digit number of times every week, JPMorganChase CEO Jamie Dimon said outside agents would not get inside the bank, Bank of America CEO Brian Moynihan said that a human should stay in the loop to approve money moving out of an account, and Citigroup said the bank does not let third-party agents log into accounts or transact, according to media reports.
“While the four firms do not allow AI agents to move money, they do allow them to perform read-only functions such as seeing balances, according to the report.”
ARE GOVERNMENT WEBSITES READY FOR THIS?
“Are you a human?” Many online portals have been asking users for years, but the stakes are getting much higher in October 2026.
For decades, state and local governments have conducted many online transactions with users such as paying property taxes, utilities, parking fines and toll fees, to renewing driver’s licenses or vehicle registrations, and issuing vital records or business permits.
While monthly payments for utility bills and other similar transactions have long been automated via scheduled tasks, the initial setup and verification of identity is generally established at the beginning of the process by a human.
Note that many financial institutions do allow “read-only” access to some accounts by AI agents, but those permissions can be complex to administer.
Legal experts often say, “Delegation is easy. Proving a payment was actually authorized and who bears the risk when something goes wrong is harder.”
In 2024, New York state legislators limited the use of AI in automatic renewal of driver’s licenses and public benefits. “But the New York law, passed on June 5, goes after an even more controversial aspect of the technology, the ability to automate government decisions, without a real person signing off on the process.”
There are many other legal aspects to these questions that go beyond the scope of this blog, and this article covers many of those topics. Here is a brief excerpt of questions from that piece, but I recommend visiting that website for more details:
- “What exactly does the agent do? List every action it can take, not the marketing description. Include tools, systems and data it can reach.
- Does it perform a regulated activity? Adjusting claims, giving financial or health guidance, screening applicants, collecting debts and similar work can trigger licensing, registration or conduct rules.
- Does it make or influence decisions about people? Hiring, lending, insurance, housing, healthcare and education decisions attract the strictest anti-discrimination and explanation rules.
- Where do its users and affected people live? Rules attach to where people are, not only where your company sits. List every state and country.
- What data does it touch? Personal, health, financial and children’s data each bring their own privacy, security and retention duties.
- Do people know they are dealing with an AI? Many rules require disclosure, and some require a way to reach a human.
- Where is the human in the loop? Decide which outputs a person must review, which actions need approval, and how someone can override or stop the agent.
- Can it spend money, settle claims or commit your company? Payment authority and settlement recommendations raise the stakes sharply.
- What do your vendors and models contribute? Third-party models and tools do not transfer your obligations. Check contracts, data flows and who is responsible for what.
- Can you prove it? For each applicable rule, you need a control, a test and a record showing the control works.”
MORE ON PERSONAL AI AGENTS
According to Yahoo! Finance, “Agentic commerce means AI agents browse, book and buy online on a consumer’s behalf, and Meta hopes to collect a take rate, a percentage of each transaction.
“Jefferies tested Muse on several hundred leading US e-commerce, airline, online travel agency, hotel and reservation websites: about one-third blocked its access, one-third challenged or restricted it, and one-third were easy to navigate. …”
Several powerful personal AI agents have launched to compete directly with Meta’s Muse. Unlike standard conversational chatbots, these agents are “always-on” background workers that can log into tools, manage files, and execute multistep tasks for you.
Some of these other personal AI agents include:
- OpenAI Dots: Launched as OpenAI’s flagship “always-on goal agent.” It is tightly integrated into the ChatGPT ecosystem, focusing on background research, planning and task execution.
- Anthropic Claude Duet: Built primarily as a personal agent for the workplace. It acts as a long-running knowledge worker, operating directly on your local folders and files to read, extract, and build deep reports.
- Google Gemini Spark: Google’s ecosystem-native agent. It handles deep personal workflows directly inside Google Workspace, taking actions seamlessly across Gmail, Google Docs and Google Calendar.
- xAI Grok Bot: An agent built with a persistent, cloud-based virtual computer environment. It excels at handling highly repetitive data and work tasks in the background while your laptop is closed.
- Instinct: A prominent consumer agent that runs entirely over iMessage, SMS and phone calls without needing a standalone app. It functions as a context-aware personal representative for handling consumer tasks.
- Hermes Agent: An open-source, autonomous AI agent framework developed by Nous Research released in February 2026 under the MIT license. Unlike traditional single-session chatbots, Hermes Agent runs persistently on your own infrastructure and stays active 24/7 to handle long-running workflows.
BACK TO THE ORIGINAL QUESTION
Circling back to the beginning: Should government websites follow the lead from banks and block personal AI agents now for financial transactions on government portals? Or stated more directly, should agents be able to log on for users?
My answer is that governments should follow the lead from our major banks. They have much better cybersecurity than most governments, and they are acting now to stop these personal AI agents.
I am not a lawyer, but I am a cybersecurity expert who has been working on identity projects in a government portal context for more than two decades going back to the launch of michigan.gov in 2001.
I can say emphatically that virtually all government user policies strictly prohibit third parties from using or accessing your account. State agency terms of use, acceptable use policies and digital service agreements across the United States uniformly contain clauses requiring users to keep their login credentials confidential and explicitly banning unauthorized account sharing.
It is these types of policies that the banks and others are updating now to prohibit personal AI agents from acting on the user’s behalf in their online portals.
While the legal framework will likely change in the future, AI agents are currently categorized as third parties, and using them to log on to government accounts should be a violation of user policies.
However, banks are updating policies to make this clear, and governments should do the same in this former Michigan CISO’s opinion.
Some of those bank announcements with new wording include:
- Wells Fargo: We Are Updating Our Online Access Agreement
- JPMorgan Chase: Terms of use
There are numerous other banks that have issued statements of “outright bans” of AI agents in their accounts, but we do not have those banks’ wording for user accounts at the time this blog was written. See this article from The Times of India for other examples of statements.
FINAL THOUGHTS
I was one of the first security leaders in the U.S. to learn firsthand that cyber pros were generally seen as “party poopers” and in response to proclaim that “CISOs need to get to yes.” This started when I almost got fired from my Michigan CISO role in 2004 for opposing Wi-Fi.
I have written extensively that CISOs need to be enablers on cloud computing AI and many other technology solutions. I believe that AI is a priority for state and local governments, and constantly offer solutions in that regard for several years now.
I believe the time will come in the future when personal AI agents will work (well) with government portals, but this is not that time.
The vast majority of state and local governments are not ready for these personal AI agents to conduct online government business on their portals. The security and legal risks are vast and go well beyond the scope of this article.
CIOs, CTOs, CISOs, CFOs and others in the C-suite, as well as legal teams, in government need to take action to examine your portal and policies and terms of use, and make necessary adjustments to people, process and technology activities to ensure our portals maintain integrity and trust.
Act now to prohibit personal AI agents from conducting online government business until your portals and teams are truly ready.
Leave a Reply