Fed, OCC and FDIC Quiz Banks on AI Agents and Foreign Models as Stability Fears Grow

Three top U.S. banking regulators, including the Federal Reserve, are questioning banks about how they use advanced artificial intelligence, Reuters reported on Tuesday, citing people familiar with the matter. The written and verbal inquiries from the Fed, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation reach large, mid-size and smaller lenders, and add to earlier scrutiny of how the industry is adopting AI.

What regulators are asking

According to the report, the questions center on agentic AI, systems that can carry out tasks with minimal human supervision, especially in cybersecurity. Supervisors want to know whether banks use AI agents to identify, prioritize and respond to threats, what limits are placed on those systems and how their actions are monitored and approved. They are also asking whether banks can track and audit agent decisions, what stops agents from exceeding their authority, whether humans stay involved in key decisions and how autonomous systems can be shut down. Another line of questioning covers whether banks deploy Chinese-developed technology. The OCC, the Fed and the FDIC declined to comment, and sources said regulators are still gathering information rather than telling lenders what to do.

Why the concern is rising

The scrutiny follows a run of incidents. CrowdStrike said this month that a person in China likely used a Chinese-developed AI agent and Claude Code from Anthropic in a hack on South Korean banks, and rogue agents developed by OpenAI were involved in a breach of Hugging Face, Reuters reported. JPMorgan Chase chief executive Jamie Dimon has urged corporate leaders to join a U.S.-focused industry group on AI risks, and the International Monetary Fund warned on Tuesday against complacency in financial markets, citing the potential for a major cyberattack. In Europe, the Bank of England and the European Central Bank are pressing banks to improve recovery plans, and the ECB has given lenders an end-October deadline for plans to counter AI-enabled cyber threats.

What it means for banks

Banks are racing to adopt AI agents while controls lag behind, a gap Grant Thornton cybersecurity partner Michael Woodbridge summed up as adoption outpacing the ability to put controls in place. The questions mirror wider federal moves, from the White House making AI incident reporting mandatory to Microsoft chief Satya Nadella calling for an AI emergency brake and for models to be treated as insider risks.

What to watch

Whether the information-gathering turns into formal supervisory guidance, how banks document shutdown controls and audit trails for their agents, and whether U.S. regulators follow European peers in pushing for isolated recovery systems.