Ex-Meta security chief warns against giving AI helpers your bank logins

Alex Stamos, who used to run security at Meta, says it is "totally insane" to give a personal AI agent the keys to your financial life. He now leads security at Cognition, an AI coding startup. He made the remarks on the Big Technology Podcast, and Business Insider reported them.

What he is seeing

An AI agent is an app that takes actions for you, not just answers questions. Stamos said some people give agents such as Meta's Muse and Instinct, from Spear Street Technology, their entire 1Password vault. That is the file that holds all their saved passwords. Then they ask the agent to "go handle my finances for me" or "go file my taxes."

Why banks are uneasy

Stamos said banks now see a growing wave of activity that is clearly automated but logs in correctly. These are not stolen passwords. The customer handed them over on purpose. That leaves banks stuck between blocking bots and serving customers who want an easier life.

He also claimed Instinct is popular partly because it can get around safeguards that companies use to keep bots out. Stamos described a "crazy tension" between banks trying to prevent automated access and consumers giving their logins to "a company that's existed for six months."

The bank's view on risk

JPMorgan Chase CEO Jamie Dimon raised a similar warning on an October earnings call. "If people are using them, they should understand the risk," he said. He described a "liability transfer" away from the bank, and a risk that customer data is "misused." In plain terms, if something goes wrong, the bank may not be the one holding the bag.

Dimon said JPMorgan is building its own agent tools for clients while guarding the bank against outside agents.

What is not known

Representatives for Instinct did not immediately respond to a request for comment. Meta declined to comment. Meta has said in a blog post that Muse, launched in September, runs on its own computer in the cloud, so no other agent can access it. The material does not say how often these bot logins lead to losses, or how banks would treat a disputed case.

What to take from it

• Think hard before sharing a full password vault with any AI app.
• Know who carries the loss if an agent makes a mistake or misuses your data.
• Ask how long the company has existed and what it does with your information.