Wells Fargo will make customers liable for what their AI agents do as banks block outside bots

Wells Fargo puts AI agents in its contract

Wells Fargo is rewriting the rules for customers who let an AI agent into their bank account, and the new terms put almost all of the risk on the customer. The bank's updated Online Access Agreement, which takes effect on 24 November 2026, adds a new Section 15 titled Third-Party Artificial Intelligence Agents or Agentic AI. Anyone who keeps using Wells Fargo's online or mobile banking after that date accepts it, according to the bank's summary of the changes.

The definition is deliberately wide. An AI agent is "any software, application, program, or other technology that takes autonomous, semi-autonomous, or non-autonomous action on behalf of any person or entity." That covers the new consumer assistants that can browse and fill in forms, but it would also cover simpler scripts and automation tools.

The core rule sits in Section 15(d). If a customer gives an agent their login credentials, or otherwise authorizes it to act for them, then anything the agent does is "deemed to have been initiated and authorized directly by you, without further verification." The bank says it has no obligation to investigate the validity or scope of that authority, and that it may treat the agent's instructions as binding evidence that the customer approved them.

What the new terms make customers responsible for

Section 15(e) opens in capital letters: "Your use of any AI Agent is AT YOUR OWN RISK." It then lists what the customer is solely responsible for. That includes watching what the agent does, making sure it stays within the authority it was given, and checking that the instructions it receives are accurate.

The last item is the one most likely to matter in a dispute. Unless the law says otherwise, the customer is responsible for any result of the agent's interpretation of their instructions, for "unintended actions performed by the AI Agent," for actions caused by "incomplete, inaccurate, or manipulated inputs," and for the agent exceeding the authority it was granted. Manipulated inputs is a broad phrase. It would appear to cover prompt injection, where a web page or message tricks an agent into doing something its owner never asked for.

The bank also says plainly that it does not monitor, screen or review what agents do, including the transactions they start. The same language appears in the sections on authorized representatives and delegates: transactions made by their AI agents, "including those you did not want or intend," count as authorized by the account holder.

Wire and transfer rules get a matching clause. Where the agreement describes the security procedure the customer accepts as commercially reasonable, it now adds that letting an AI agent or other third party into the service "may adversely impact" those procedures, and that the customer accepts the risk. That matters because, under US commercial law, payment orders accepted through an agreed security procedure are generally treated as the customer's own.

Data sharing, revoking access and the right to block

Section 15(c) says that using an agent counts as express consent to share the customer's financial, account and personal information with it, and that what the agent's provider then does with that data is outside the bank's control. Section 15(b) adds that Wells Fargo does not audit or certify any agent's security or privacy practices, and that its own privacy policies do not apply to them.

Turning an agent off is also the customer's job. Section 15(f) says customers must revoke an agent's authorization properly and on time, keep evidence that they did so, and hand that evidence over if the bank asks. Until they notify the bank, they remain responsible for the agent's activity.

None of this means Wells Fargo has decided to welcome agents. The section applies "if and when we permit the use of such agents," and Section 15(g) reserves the right to require customers to register their agents, to change or shut down any API or other access method, and to block agents or restrict certain actions entirely. A bank spokesperson told USA Today that Wells Fargo has already "taken steps to block unauthorized agents from accessing customer accounts."

Why banks are moving now

The new terms arrive as the largest US banks clamp down on outside agents. On 22 October, Axios reported that major banks are detecting unauthorized third-party AI agents operating inside customer accounts, and that some agents appeared to take actions independent of user instructions, such as contacting call centres. Many banks cannot tell whether an agent's activity is directed by the customer.

Most of the activity is more mundane than a rogue AI. Axios said these are generally cases where a customer hands an assistant their username and password, which breaks most banks' rules that humans log in themselves. Reuters reported the same day that banks have been blocking third-party agents from operating inside accounts and making transactions, and noted that activity cannot be called unauthorized when the customer shared the credentials. Morgan Stanley has blocked outside agents but had not seen rogue ones, according to Reuters and Axios.

This follows moves we covered earlier this month, when JPMorgan said it blocks outside AI agents from moving money in Chase accounts, while still allowing read-only data sharing through open-banking providers. Citi told USA Today it does not let third-party agents log in or transact, and offers limited read-only access through approved providers. Schwab's chief executive has said the firm blocks agents every day because it wants control over authentication.

White House AI adviser David Sacks pushed back on the framing. According to CBS News, he wrote on X that most of what Axios described appears to be customers sharing credentials with user-authorized agents, which may break bank terms but is "in no way" a cyberattack. He suggested banks offer read-only access and treat full write access more carefully.

Blocking versus shifting the risk

The banks are taking two different routes. JPMorgan, Citi and Morgan Stanley are mostly saying no to agents that log in with a customer's password, and pointing people toward read-only data sharing. Wells Fargo is also blocking agents it considers unauthorized, but its contract prepares for a world where agents do get in, and makes clear in advance who pays when they make a mistake.

That puts the bank on the opposite side of an argument that regulators have only started to address. The Financial Stability Board's final AI sound practices for banks ask firms to keep humans accountable for agents and to set clear limits on what they can do. Hong Kong's monetary authority has gone further and floated a registry of AI agents. In the United States, consumer protections for unauthorized electronic transfers depend partly on whether a customer gave someone access, and agent providers have not yet been tested on that point.

Tool makers are trying to offer safer ways in. Password manager 1Password, for example, now lets agents sign in without seeing the password, and business bank Mercury lets assistants request payments through approved connections rather than a shared login. Those are the kinds of controlled channels banks say they want before allowing agents to move money.

What customers should know

For now, the practical advice is simple. Giving an AI assistant your bank password is against most banks' terms, may get the session blocked, and at Wells Fargo will soon mean that anything the agent does counts as your own instruction, including mistakes and actions triggered by a malicious web page.

Customers who want an assistant to look at their spending can usually do that more safely through read-only connections that banks already support for budgeting apps. Anyone who has already connected an agent should know how to revoke it, and Wells Fargo customers should keep a record of when they did.

Some details remain unclear. Wells Fargo has not said whether it will ever allow agents to make payments, how it would register them, or how its terms will interact with consumer protection rules in practice. The new agreement applies from 24 November, three days before Black Friday, when shopping agents are likely to be busy.