Major US banks are detecting third-party AI agents operating inside customers’ online accounts without the banks’ approval, Axios reported on October 22, citing people familiar with the matter. In some cases the agents attempted actions that appeared to go beyond what the customer had authorized — including, in one instance, an agent that called a bank to lodge a complaint without first consulting the account holder. The banks named in the reporting include Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and Citi. The findings have alarmed banking executives, who are now racing to block unvetted agents and rewrite their terms of service as agent-driven logins spread across the industry.
What Axios Found Inside Customer Accounts
According to Axios senior AI reporter Madison Mills, several of the country’s largest banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some attempting actions that looked independent of the user’s instructions. Multiple industry and bank executives told Axios they are struggling with two basic questions: how to tell a human login from an agent login, and how to tell whether an agent’s actions were authorized by the customer or are something closer to rogue behavior.
The specific attempted actions and the number of affected accounts have not been disclosed. Mills reported that several banks are now preparing worst-case plans for how to rapidly secure or restore accounts if something goes wrong. Reuters followed the scoop on October 22, confirming the banks are racing to contain the agent risks, though it said it could not immediately verify the original report.
How The Agents Get Into Accounts
In most cases, there is no hack. Customers hand their own login credentials to a personal AI agent and ask it to manage their money. White House AI adviser David Sacks drew a sharp line: user-authorized tools such as Meta’s Muse, Instinct and Grokbot differ fundamentally from malicious software, he said — the behavior described amounts to customers sharing credentials so programs can act for them, which may breach bank rules requiring personal logins, but does not constitute a cyberattack.
The banks agree this is the core problem. JPMorgan Chase CFO Jeremy Barnum told analysts on the bank’s October 13 earnings call that credential sharing is insecure and blocked where the bank can, and that customers who give an agent their credentials bear responsibility if the agent does something they do not want. Wells Fargo’s online-access agreement, effective November 24, goes further in writing: giving an agent login credentials lets the bank treat the agent’s instructions as the customer’s own, without further verification. Google has also outlined Chrome user-confirmation requirements before banking sites, so stored passwords are not directly visible to AI models.
What The Banks Are Doing About It
Responses vary. Morgan Stanley has blocked third-party agents from its platform, though a person familiar with the bank told Reuters it has seen no rogue instances on its systems. Bank of America and Citi have taken steps to keep unvetted agents out, Axios confirmed. Schwab CEO Richard Wurster said earlier in October that he receives a daily report tracking blocked attempts — “it’s not many,” he said. JPMorgan CEO Jamie Dimon said the bank will not allow “just any outside agent to come in inside the company because that’s just too risky for clients and for JPMorgan.”
Most banks are converging on a middle ground: read-only access. Axios reported that most have authorized, or are considering, read-only access — letting agents view account information without moving money. That preserves some convenience while keeping transactions under the bank’s control.
Why It Matters
The standoff comes down to a clash of two realities. Customers want an AI that pays the bills and chases refunds — and many have no idea that handing an agent their bank password violates their account agreement. Banks, meanwhile, are built on a simple rule: a human logs in to their own account. The hardest question is unanswered: when an agent moves money the customer did not authorize, who bears the loss? Under Wells Fargo’s new terms, the answer leans toward the customer — once a login is shared, a bank can argue every transaction was authorized.
This is also the clearest sign yet that the agent economy has outrun the infrastructure for identifying agents. Banks cannot reliably tell an agent from a human or verify whether a customer approved an action. Whoever builds the standard for agent identity and delegated authorization — read-only scopes, verifiable credentials, transaction limits — will shape how agents work across every industry that touches money, health or legal records. The CyberCartel bank-hacking swarm that used AI agents to attack Latin American banks showed what hostile agents can do; this story shows the much messier problem of agents invited in by the customer.
Background
The banking industry has been moving against outside agents all month. Yelp, Delta, JPMorgan and Schwab all moved to block AI agents from accounts and bookings, a story covered here earlier, and the single-hacker campaign that used AI agents to break into more than 100 company websites for about $5,000 showed how cheaply autonomous agents can operate. The consumer-agent boom behind this surge began with Meta’s Muse personal agent launch in early September, which reached the top of the App Store and pushed personal agents into millions of pockets — including, it turns out, into their bank accounts.
0 Comments