Major Canadian Banks Block Third-Party AI Agents Over Security Concerns
Canada's largest banks, including TD, RBC, BMO, CIBC, and Scotiabank, have banned or restricted third-party personal AI agents from accessing their digital platforms. The move follows reports of AI agents acting independently of user instructions and customers sharing login credentials with the tools.
Major Canadian financial institutions are blocking or restricting third-party personal AI agents from accessing their digital banking platforms, citing security concerns over unauthorized transactions and credential sharing.
TD Bank has decided to block all third-party personal AI agents from direct access to banking information that requires authentication. Similarly, Royal Bank of Canada (RBC) sent a company memo alerting employees that it has blocked third-party personal AI agents from direct access to authenticated digital properties, including online banking. 
Bank of Montreal (BMO) stated it does not permit AI agents to access its digital properties or execute transactions in order to protect clients. CIBC announced it does not support personal AI agents directly opening or accessing accounts and advised clients against sharing banking credentials with such tools. Scotiabank said it will limit third-party AI agents from accessing its banking platforms while continuing to monitor evolving concerns.
The restrictions follow an Axios report published on Oct. 22 indicating that some AI agents attempted to take actions appearing independent of user instructions. There have also been instances where customers shared login credentials with these agents, prompting financial institutions to implement safeguards to prevent potentially unauthorized transactions.
Customers are being advised not to share sensitive banking credentials, such as passwords and PINs, with AI agents. The Canadian federal government is monitoring the issue closely. A spokesperson for Minister Evan Solomon stated the government is tracking the situation and advised Canadians to be cautious about sharing banking passwords. 
Concerns over third-party AI agent access extend beyond the Canadian banking sector. In the U.S., Amazon requested that Meta remove its AI agent, Muse, from accessing Amazon's e-commerce platform on behalf of customers.