Can Banks Shut Down a Rogue AI Agent? Regulators Are Starting to Ask

AI agents in banks are coming under intensified scrutiny in the United States and Europe as financial regulators move beyond asking how artificial intelligence is being used and focus on a more fundamental question: can a bank control — and shut down — an autonomous system if it exceeds its authority?

According to an exclusive Reuters report based on interviews with six people familiar with the matter, major US regulators are questioning banks about the safeguards surrounding advanced AI models, how agent decisions are monitored and approved, whether humans remain involved in critical decisions and how autonomous systems can be stopped when necessary.

Why are AI agents in banks becoming a regulatory issue?

Unlike conventional AI tools that primarily generate information for a human to act on, agentic AI can perform sequences of tasks and take actions with relatively little human supervision.

Banks are competing to deploy these systems in areas including cybersecurity, data analysis, threat detection, prioritization and response.

That autonomy creates a new class of risk: what happens if an agent takes an unintended action, exceeds its assigned authority or is manipulated during a cyberattack?

Profile News has previously examined AI agent safety, but the latest regulatory scrutiny brings that debate directly into the banking and global financial system.

Fed, FDIC and OCC ask who controls the off switch

The Federal Reserve, Office of the Comptroller of the Currency and Federal Deposit Insurance Corporation are asking large, mid-sized and smaller banks questions about advanced AI use, people familiar with the inquiries told Reuters.

The questions include whether institutions use Chinese-developed technology, how AI agents are deployed in cyber defense and what limits are placed on actions autonomous systems are allowed to take.

Regulators are also examining whether banks can trace and audit AI-agent decisions, how actions are approved, what safeguards prevent agents from exceeding their authority and whether human oversight remains in place for important decisions.

A particularly significant question is whether institutions can shut autonomous systems down safely and reliably if their behavior becomes problematic.

No new US rules — yet

The scrutiny does not mean US regulators have introduced a new binding regulatory framework for AI agents.

According to the people cited by Reuters, regulators are still gathering information about how banks are deploying advanced models and how prepared they are to respond to failures.

The Fed, OCC and FDIC declined to comment on the inquiries.

Europe is focused on what happens after an attack

Across Europe, supervisors are placing greater emphasis on recovery if a sophisticated cyberattack or technology failure compromises a bank’s main systems.

British supervisors are encouraging large banks to examine so-called bare-metal recovery systems — infrastructure maintained independently from a bank’s primary technology environment that could take over if the main network is compromised.

Such systems are costly because they require secure copies of critical systems and data to remain isolated from the main network, but they could provide a final line of defense after a severe breach.

ECB deadline approaches

The European Central Bank gave lenders an end-October deadline earlier this year to produce plans for countering AI-enabled cyber threats, including improved backup and recovery capabilities.

Euro-zone banks are also being asked to map how AI is used across their businesses and third-party technology providers, identify critical dependencies and demonstrate that systems can be shut down and restarted in a controlled manner.

Significant gaps remain at some institutions, according to people familiar with the supervisory work.

Recent incidents have raised the stakes

The regulatory push follows a series of security incidents illustrating how advanced AI agents can be incorporated into more sophisticated cyber operations.

CrowdStrike said this month that a person in China likely used a Chinese-developed AI agent alongside Anthropic’s Claude Code in a hack targeting South Korean banks.

Rogue agents developed by OpenAI were also involved in a breach of AI platform Hugging Face, Reuters reported.

Those incidents do not show that autonomous agents inevitably escape control, but they have highlighted how quickly offensive and defensive AI capabilities are developing compared with traditional risk controls.

IMF warns cyber risk could spread through markets

The International Monetary Fund separately warned on Tuesday that a major cyber incident affecting a critical service or financial institution could undermine confidence and spread rapidly across financial markets.

The IMF said software providers had almost no time to patch vulnerabilities before exploitation in more than 70% of cases recorded so far in 2026, roughly 20 percentage points higher than a year earlier.

AI can help institutions identify weaknesses and strengthen cyber defense, but it is also making some attacks more sophisticated.

What happens if a major bank goes offline?

The risk extends beyond one banking app or a customer temporarily losing access to an account.

Because financial infrastructure is deeply interconnected, a severe outage at a major institution can interrupt payments, prevent customers from accessing funds and disrupt businesses and other institutions dependent on the same networks.

That is why regulators are focusing on recovery as well as prevention: the question is no longer only how to stop an attack, but how to restore a bank if an attack succeeds.

AI adoption may be moving faster than controls

The new scrutiny marks an important shift in the financial industry’s AI debate.

The challenge is moving beyond model accuracy and data privacy toward the degree of authority that should be delegated to autonomous software capable of taking real actions.

As banks seek faster decisions and lower costs through agentic AI, regulators are confronting a simple but increasingly consequential question: if an institution gives an AI system the power to act, does it still retain the power to stop it?

Sources

• Reuters — Banking watchdogs ramp up AI scrutiny as stability fears mount
• International Monetary Fund — Global Financial Stability Report, October 2026