DeSantis Warns of AI Agents Accessing Bank Accounts as Financial Institutions Confront New Risks
Florida’s governor raises questions about accountability and consumer protection as banks assess the growing use of autonomous AI tools.
Florida Gov. Ron DeSantis is warning that artificial intelligence agents with access to financial accounts could create serious risks for consumers, raising questions about who would be responsible if an automated system caused large-scale losses.
In an October 22 post on X, DeSantis described a hypothetical scenario in which a rogue AI agent liquidates a person’s bank account and investments. He questioned whether an AI company could compensate consumers if losses occurred across millions of accounts, and suggested that criminal liability for AI executives might help deter wrongdoing but would not necessarily repair damage after it occurred.
His comments followed reporting that major financial institutions are confronting the use of third-party AI agents in customer accounts. The reports have prompted a broader discussion about the line between a customer’s use of an AI assistant and an agent acting beyond what a customer intended.
What Is an AI Agent?
An AI agent is software that can take steps toward a goal rather than simply answer a question. Depending on its design and the access it receives, an agent may browse websites, complete forms, review information or carry out other tasks on a user’s behalf.
In a financial setting, a customer might want an assistant to review spending or organize bills. More powerful tools could potentially interact with an account or initiate transactions if they are given the necessary access.
That distinction matters. Asking AI to explain a bank statement is different from giving a tool access to an account, and access to view information is different from permission to move money.
What Has Been Reported
Reuters reported that banks have been working to block third-party AI agents from their systems, including situations in which customers provided account credentials to those tools. Morgan Stanley told Reuters it had blocked third-party agents but had not observed unauthorized or rogue AI agents.
The available reporting should not be read as evidence that AI agents have independently drained millions of accounts. DeSantis’s mass-liquidation example was a warning about a possible future scenario, not an announced finding that such an event had occurred.
The word “unauthorized” also requires care. A customer might choose to give an AI tool access even if that access conflicts with a bank’s rules. That is a different situation from an agent exceeding the customer’s instructions or a criminal gaining access without the customer’s permission. Each raises different questions about security and responsibility.
Who Would Be Responsible?
DeSantis’s warning focuses in part on what happens after something goes wrong. If an AI tool makes an unauthorized transaction, customers may look to their bank, the company behind the tool or another service involved in the transaction for answers.
Responsibility can depend on the facts, the type of account and transaction, applicable law and the agreements involved. The governor’s suggestion of criminal liability for AI executives is a policy argument; his post did not establish a new law or guarantee a particular remedy for customers.
For financial institutions, the challenge is not only identifying automated activity. It is also determining whether an action was requested by the account holder, whether the tool had appropriate access and how to stop a problem before money moves.
What Customers and Businesses Can Do
Consumers and business owners do not need to assume that using AI automatically gives it access to their bank accounts. The practical issue is what information and permissions a particular tool receives.
Steps to consider include:
- Review connected apps and remove services you no longer recognize or use.
- Avoid giving an AI assistant unrestricted bank passwords or transaction access.
- Ask your financial institution which connections it supports and whether a read-only option is available.
- Use account alerts and multifactor authentication where available.
- Keep a person responsible for reviewing and approving transfers, particularly for business accounts.
- Contact the bank promptly if you see unfamiliar activity.
These steps can reduce risk, but no safeguard can guarantee that an account will never be compromised. Businesses should also discuss payment controls and response procedures with their banks and professional advisers.
A New Test for Digital Trust
AI agents could make everyday financial tasks more convenient, but the same ability to act on a user’s behalf makes limits and oversight important. Banks, technology companies and regulators will need to address how access is granted, how instructions are verified and how customers are protected when an automated action goes wrong.
For now, DeSantis’s warning is part of a larger debate about how quickly autonomous tools are entering sensitive systems and whether the safeguards around them are keeping pace.
