Overview
Bank of America has issued a direct customer advisory urging users not to share their banking credentials — usernames and passwords — with AI assistants or autonomous agents. The email, titled ‘Protecting your finances in the AI World’, warns that sharing credentials with any outside service, including AI-enabled tools, creates significant financial and security risk. The advisory also makes clear that customers bear full liability for any activity resulting from credential access they voluntarily grant.
The warning arrives at a critical inflection point: AI agents capable of executing financial transactions autonomously are becoming mainstream, and both consumers and the financial industry are still developing the norms and infrastructure to support them safely.
Technical Analysis
The core risk vector here is credential-based AI agent access. When a user provides their banking username and password directly to an AI assistant, several threat scenarios emerge:
- Credential leakage via model vulnerabilities: A security flaw in the AI assistant — such as insecure storage, prompt injection, or data exfiltration via tool invocations — could expose the credentials to a third party.
- Unauthorised agentic actions: An AI agent operating with full account credentials can initiate transactions, change settings, or extract account data without explicit per-action user approval, representing a classic excessive agency failure.
- Account lockout: Banks’ fraud detection systems may flag credential use from unusual IP addresses or behavioural patterns associated with AI agents, locking legitimate users out.
- Liability transfer: Unlike OAuth-based delegated access, direct credential sharing shifts legal responsibility entirely to the customer under standard bank account agreements.
The article also references banks grappling with unauthorised agents accessing customer funds, suggesting active exploitation of this attack surface is already occurring in the wild.
Framework Mapping
- AML.T0083 (Credentials from AI Agent Configuration) and AML.T0098 (AI Agent Tool Credential Harvesting) are directly applicable: attackers or flawed agent designs can harvest credentials stored within or passed to agent contexts.
- AML.T0086 (Exfiltration via AI Agent Tool Invocation) applies where a compromised agent exfiltrates credentials through outbound tool calls.
- LLM08 (Excessive Agency) captures the risk of agents taking unsanctioned financial actions.
- LLM06 (Sensitive Information Disclosure) covers credential leakage scenarios.
- LLM09 (Overreliance) reflects the consumer behaviour pattern driving this risk.
Impact Assessment
The affected population is broad — any retail banking customer who has granted or is considering granting an AI assistant their banking credentials. The financial impact could range from fraudulent transactions to full account compromise. The legal impact is particularly sharp: customers who share credentials lose standard fraud protections under most bank account agreements. At the industry level, unresolved agentic payment standards create systemic exposure across multiple financial institutions.
Mitigation & Recommendations
- Never share raw banking credentials with any AI tool; demand OAuth or open-banking API integrations instead.
- Revoke access for any AI tools currently holding banking usernames or passwords.
- Prefer bank-sanctioned agentic integrations that use scoped, revocable tokens rather than full credential access.
- Monitor account activity for anomalous transactions that may indicate agent misuse.
- Financial institutions should accelerate deployment of delegated access standards (e.g., open banking OAuth 2.0 flows) that natively support AI agent authentication without credential sharing.