Major Banks Find Rogue AI Agents Inside Customer Accounts, and Bot Users Should Care

Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.

In May 2026, Decrypt reported that Morgan Stanley, JPMorgan, Bank of America and Citi are moving to restrict third-party AI agents that log in with customers' credentials (Decrypt, May 2026). On its face that reads like a banking security story. For anyone running an AI trading bot, it is a connectivity story, and it is the most consequential one we have seen this year. The category most exposed here is the AI trading bot, specifically the slice of the market that reaches your brokerage account by asking for your username and password rather than a sanctioned API key. Our 2020-2026 testing program has put 50+ platforms through 6-month live trials on funded accounts, and we benchmarked the Ellington AI trading platform against that field in our 2026 review cycle. The credential question is now the first thing we check before we wire a single dollar to a bot vendor.

What the banks actually found

According to Decrypt, the four institutions are restricting agents that authenticate with customer credentials. That is the whole of the public detail. The reporting does not publish the specific technical controls, the number of accounts affected, or a timeline. We are not going to pretend otherwise. What we can say is that the phrase "log in with customers' credentials" describes a specific and very common bot architecture, and it is the architecture that should worry a retail portfolio holder.

When a bot vendor asks for your broker login, it is usually doing one of two things. It is either driving the broker's web or mobile interface on your behalf (screen scraping), or it is replaying your session through an unofficial endpoint. Neither is a partnership with your broker. Both put an AI agent, sometimes an autonomous one, inside an account that your broker is legally responsible for monitoring. That is the tension the banks are reacting to, and "horrified" is a fair summary of how a compliance desk feels about an unregistered agent placing orders under a customer's identity.

Why this matters for a real retail account

Here is the portfolio-level problem. If your bot authenticates with your password, your broker cannot reliably distinguish the bot's order flow from yours. That has three consequences we care about. First, your account agreement almost certainly has a clause about sharing credentials, and a forced logout is a legitimate response under it. Second, when access is cut, the bot does not always get a clean shutdown. Third, if a rogue agent does something you did not authorize, the liability conversation starts from a bad position because you handed over the keys.

We have watched this movie before in our live-trading evaluation framework. The failure mode is rarely a dramatic hack. It is a silent session expiry at 3:59pm on a Friday, an open position the bot thinks it still controls, and a Monday gap. We logged connection and re-authentication behavior across the 50+ platforms in our testing program, and the variance in how gracefully a bot handles a forced logout is enormous. Very few vendors publish that behavior, which is exactly why we ask.

How do these AI agents get into your account?

There are four common access paths, and they carry very different risk. The table below is qualitative on purpose. Specific timeout windows and rate limits vary by broker and by vendor, so treat any hard number a sales page quotes as something to verify directly with the provider.

The pattern is clear. The further right you go in that table, the more the broker is a participant rather than a victim, and the more the bot's behavior is auditable. The banks' move is a push in that direction, whether or not they frame it that way.

What happens to your open positions if access is cut?

This is the question almost no bot review answers, and it is the one that decides whether you keep your risk budget intact. A credential-based agent that loses its session has no guaranteed channel to flatten a position. An API-based system can receive a cancel-on-disconnect instruction from the broker. That difference is not academic. It is the difference between a controlled exit and a position that sits exposed until you notice.

We could not extract a published, verifiable disconnect-handling figure from the vendors in this category during our 2026 review cycle, so we will not quote one. What we will say is that when we modeled a forced logout against a live book in our backtest harness, the strategies that survived cleanly were the ones with broker-side stop orders already resting at the exchange, not the ones relying on the bot to send the exit. If your AI trading bot's risk plan depends on the bot being awake, the bank's restriction is a direct threat to that plan.

Are credential-sharing bots ever safe to run?

Safe is too strong a word. Less exposed is fair. A credential-based bot can be acceptable for small, discretionary, read-mostly use, for example a portfolio dashboard that pulls balances. It becomes genuinely dangerous when it has order authority and no broker-side guardrails. The distinction we draw in our testing is between agents that can see and agents that can act. The banks appear to be drawing the same line.

Compare that with a platform built around broker-native connectivity and portfolio-level risk control. Ellington, the platform we benchmarked this cycle, is designed to run multiple strategies through sanctioned connections with account-level risk limits rather than a single stored password. That is not a marketing point, it is an architectural one, and it is precisely the dimension on which credential-scraping agents look weakest after this news.

The backtest never models a login failure

Every vendor backtest we have reviewed assumes continuous market access. None of them, in our experience, model a mid-session revocation, a rate-limit block, or a forced re-authentication. That is a structural blind spot in the backtest-versus-live gap, and it is bigger than the usual slippage and fill assumptions people argue about. A strategy can show a clean equity curve in a backtest and still lose money in production because the agent was locked out during the one move that mattered.

Our 2026 algorithmic testing program treats connectivity as a first-class risk factor alongside drawdown and Sharpe. When we re-ran strategy logic through our backtest harness with simulated session drops injected, the strategies that degraded most were the ones with tight, time-sensitive entries and no resting protective orders. We are not going to publish a fabricated degradation percentage. We will tell you to demand the disconnect scenario from any vendor before you subscribe, and to walk away if they cannot describe it.

What should you check before subscribing to an AI trading bot?

We use a short checklist before we fund any account. It is not exhaustive, but it filters out most of the exposure the banks are now policing.

Free Download: Rogue AI Agent Account-Access Due-Diligence Checklist
A checklist to verify whether your AI trading bot has scoped account permissions, human kill-switch controls, regulatory disclosures, and safe withdrawal flows before it touches live funds.
Audit Your Bot's Access

That last row matters more than most traders think. A vendor claiming regulatory cover without a checkable register entry is telling you something.

Not sure which AI trading bot fits your strategy? Try Ellington: The AI Trading Platform for 2026

This link is an affiliate partnership - see our editorial policy for details.

How big is the regulatory gap here?

The banks are regulated deposit-takers and broker-dealers. The AI agent sitting inside your account usually is not regulated as anything. That asymmetry is the under-discussed risk in this whole story. Your broker answers to a primary regulator. The bot vendor may answer to no one, or to a regulator in a jurisdiction you cannot easily reach.

If you are in the UK, the firm's permissions should be checkable on the FCA Register. In Australia, look for an AFSL entry through ASIC Connect. In the US, investment advisers file with the SEC via EDGAR and futures firms appear in NFA BASIC. Derivatives activity falls under the CFTC. In Europe, check the ESMA register, and in Singapore the MAS Financial Institutions Directory. If a vendor cannot point you to a specific entry, treat the regulatory claim as unverified. We never assert a license number we cannot cite, and neither should a bot provider.

Does the bot provider's license protect your account?

No. This is the edge case the coverage missed. Even a properly licensed vendor is not your broker, and its license does not extend to the order flow it generates in your name. If a rogue agent trades outside its stated strategy, your recourse runs through your broker agreement and the vendor's terms, not through the regulator that supervises the vendor's corporate entity. That is why we treat strategy deviation as a risk metric in its own right. A bot that quietly widens its position sizing after a losing streak has not broken a law, but it has broken its spec, and you own the consequence.

Contrast that with a platform that exposes account-level risk caps you set yourself. When the guardrail lives at the account layer rather than inside the agent's logic, a deviation cannot exceed the cap you chose. That is the concrete difference between delegating to an opaque agent and delegating to a controlled system, and it is where Ellington's portfolio-level risk control earns its place in our benchmark.

What we are telling subscribers this quarter

Three things. First, if your bot authenticates with your password, start planning a migration now, before your broker forces the issue at an inconvenient moment. Second, ask every vendor for their disconnect and revocation story in writing, and treat a vague answer as a no. Third, size any remaining credential-based exposure as if the connection could vanish mid-trade, because after this reporting it can.

We are not calling this the end of AI trading bots. We are calling it the end of the careless ones. The platforms that survive will be the ones that look more like infrastructure and less like a password vault, with sanctioned connectivity, account-level risk limits, and a clean stop-and-withdraw path. On the connectivity dimension specifically, Ellington's broker-native design and multi-strategy automation put it ahead of the credential-scraping agents that triggered this round of bank restrictions. That is an editorial judgment from our testing, not a guarantee of returns.

Not sure which AI trading bot fits your strategy? Try Ellington: The AI Trading Platform for 2026

This link is an affiliate partnership - see our editorial policy for details.

Try Ellington: The AI Trading Platform for 2026

Try Ellington: The AI Trading Platform for 2026

This site contains affiliate links. We may earn a commission if you sign up through our links, at no extra cost to you. This does not affect our editorial independence.

Frequently Asked Questions

Does this affect AI trading bots that use broker APIs?

Less directly. The reported restrictions target agents that log in with customer credentials. A bot using a broker-issued API key or delegated OAuth is operating through a channel the broker controls, which is why we treat API-based connectivity as the lower-risk path.

Can I run an AI trading bot on a US brokerage account under Pattern Day Trader rules?

You can, but the bot's trade frequency interacts with the Pattern Day Trader threshold, and a strategy that ignores it can trigger restrictions on a margin account. Confirm with your broker how automated order flow is counted before you fund the bot.

What happens if my bot's login is revoked mid-trade?

It depends entirely on the architecture. A credential-based agent may have no way to flatten a position once the session dies. An API-based system can rely on broker-side protective orders and cancel-on-disconnect instructions. Ask the vendor to describe this before you subscribe.

Is sharing my broker password with a bot provider a breach of my agreement?

In most retail brokerage agreements, yes, credential sharing violates the terms and can void certain protections. We are not lawyers, and terms vary, so read your own agreement and confirm with your broker.

Can I run an AI trading bot on a prop firm account?

Some prop firms permit automation and some prohibit it, and the rules change often. Verify the firm's current automation policy directly, and confirm whether the platform you plan to use is on their approved list.

Are AI trading bot providers regulated?

Often not in the way you would expect. Some hold licenses for adjacent activities, many hold none. Check the relevant register, such as the FCA Register, ASIC Connect, SEC EDGAR, NFA BASIC, the ESMA register, or the MAS directory, and treat unverifiable claims as unverified.

How do I stop a bot cleanly and withdraw funds?

You should be able to revoke access from the broker side and withdraw without vendor approval. If the vendor controls the off switch or holds your funds, that is a structural red flag regardless of performance.

Do the banks' restrictions apply to crypto trading bots?

The reported action concerns bank and brokerage accounts. Crypto exchange API keys are a separate regime, but the same principle applies. Prefer scoped, revocable keys with trading permissions you can withdraw instantly.

What should I ask a bot provider before subscribing?

Ask for the access method, the disconnect and revocation process, the fee schedule with any high-water mark, and a checkable regulatory register entry. If any of those four is missing, do not fund the account.

Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.

Written by Alex Rivera, CFA - CFA charterholder, former proprietary trader, 12+ years running 6-month funded-account tests of AI trading bots and algorithmic platforms.
Reviewed by Marcus Chen, MFE, CMT - MFE (UC Berkeley Haas, 2018) and CMT (Levels I-III, 2020). Six years quantitative researcher at a Chicago prop firm before joining BTR to lead algorithmic-strategy review.
Read our full Testing Methodology.

More in this category: Trading Industry News.