Wells Fargo’s new AI-agent terms, clause by clause: who pays when an agent gets it wrong

Most of the reporting on banks and AI agents in October 2026 was about blocking. Wells Fargo did something more durable. It rewrote its contract. The bank's updated online access agreement, which takes effect on 24 November 2026, adds a section titled “Third-Party Artificial Intelligence Agents or Agentic AI”, and threads agents through the rules on delegates, transfers, wires and indemnity.

The opening summary frames the whole thing carefully. The agreement covers “your responsibilities for artificial intelligence agents, if and when we permit the use of such agents.” In other words: this is not an invitation. It is a statement of who carries the risk if agents are allowed in, or get in anyway.

Below is a plain reading of each clause, followed by what it means for customers, for agent makers and for other banks. This is analysis, not legal advice.

The new section, clause by clause

15(a): What counts as an AI agent

The definition is deliberately wide: “any software, application, program, or other technology that takes autonomous, semi-autonomous, or non-autonomous action” on someone's behalf. That covers a consumer assistant like Muse or ChatGPT, a browser extension, a script a developer wrote over a weekend, and anything in between. If software acts in the account, it is an AI agent under this agreement, whether or not it uses AI.

15(b): The bank is not the agent's keeper

“We do not provide, control, or endorse any AI Agent,” and the bank is “not responsible for AI Agents or their activities.” This separates Wells Fargo's own assistants from third-party ones, and stops a customer arguing that the bank vouched for a tool by letting it connect.

15(c): Consent to share data

By using an agent, the customer “expressly consent[s] to the sharing of your financial, account, and personal information with such AI Agent.” Practically, this covers the bank for the data the agent reads once it is in.

15(d): The agent's instructions are yours

This is the core clause. “Any instructions, actions, or transactions initiated by the AI Agent are deemed to have been initiated and authorized directly by you,” and the bank “may rely on any such instructions” as valid and binding. It matches what Bank of America's chief executive said the same month, as reported by USA TODAY: “When you give the agent your credentials, it is you authorizing the payment.”

15(e): At your own risk

The clause is in capitals in the original: “Your use of any AI Agent is AT YOUR OWN RISK.” The customer is “solely responsible” for a list that reads like a catalogue of how agents fail, including “unintended actions performed by the AI Agent, actions resulting from incomplete, inaccurate, or manipulated inputs,” and “the AI Agent exceeding the authority granted by you.” It adds that the bank does “not monitor, screen, or review AI Agent activities.”

“Manipulated inputs” is worth pausing on. It is the contract's word for prompt injection: instructions hidden in a web page, email or document that an agent reads and follows. Security researchers at Brave showed in 2025 that an agentic browser could be steered this way while it was operating “with the user's full privileges across authenticated sessions”, including banking. Under 15(e), the losses from that kind of attack sit with the customer, subject to the law.

15(f): Revocation

The customer “remain[s] responsible for all the AI Agent” activity until they give notice of revocation, to the extent the law allows. Revoking an agent is therefore something the customer must tell the bank, not just something they do in the agent's app.

15(g): The bank's controls

The bank reserves the right to “limit, prohibit, prevent, suspend, or terminate access by any AI Agent,” to require customers to “register your AI Agents with us,” and to “change, limit, restrict, or discontinue any application programming interface (API) or other access method for AI Agents.” Registration is the interesting word. It points toward a world where agents are named and permitted, rather than hidden inside a customer's login.

15(h): Eligibility

Customers under 18, or otherwise prohibited by law, may not let an agent use the service on their behalf.

Agents elsewhere in the agreement

• Delegates. Section 2 treats transactions by an authorised representative or delegate, “including the transactions of their AI Agents,” as the customer's, and makes the customer “solely responsible for supervising” them. A bookkeeper's agent counts as the business owner's.
• Security procedures. For transfers and wires, letting “an AI Agent or other third party access to the Service” may “adversely impact” the security procedures the customer agreed to, and the customer accepts that risk. This matters because, for business wires, liability often turns on whether the agreed procedure was followed.
• Indemnity. The customer's indemnity to the bank applies regardless of whether the claim arises from use of the service by the customer or by “any of the AI Agents” of the people they authorised.

What the contract cannot do

A bank's terms sit under federal law, and the agreement says so repeatedly with “unless applicable law prohibits”. For consumer accounts, the most important law is Regulation E, which limits a consumer's liability for unauthorised electronic transfers. Its definition of an “unauthorized electronic fund transfer” excludes transfers initiated by “a person who was furnished the access device to the consumer's account by the consumer, unless the consumer has notified the financial institution that transfers by that person are no longer authorized.”

Whether handing a password to an AI agent is “furnishing an access device” to a “person”, and what happens when a third party manipulates that agent, are questions no regulator or court has answered yet. We set out the arguments in a separate explainer. The short version: the Wells Fargo terms are written to put the customer on the hook wherever the law allows, and the law has not yet said where that stops.

What it means

For customers

If you give an agent your banking login, assume everything it does is legally yours, including mistakes and actions a stranger tricked it into. Revoke access with the bank, not just in the app.

For agent makers

Logging in as the user is now explicitly a risk the user carries alone. That is a poor product promise. The industry is already moving toward named, scoped access instead: the draft Personal Agent Protocol describes today's situation as “all or nothing: the company blocks the agent, or the agent signs in as the person and can do anything they can.”

For other banks

Contract terms decide who pays after the fact. They do not stop the wrong transfer. The six-bank paper Building Trust in Agentic Commerce asks for something more useful at the moment of the action: “auditable records to evidence consumer instructions, authentication, intent, and transaction decisions and outcomes.” When a dispute comes, the question will be simple and hard: was the customer in control when this money moved? A bank that can answer that with evidence, at the moment of the transfer, is in a better place than one relying on a clause in capitals.