Major U.S. banks detect unauthorized third-party AI agents inside customer accounts
› Online banking accounts at major U.S. banks (Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo, Citi)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Oct 22, 2026
- status
- ongoing
- CVEs
- none
- sources
- 6
## summary
Axios reports that major U.S. banks, including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo, are detecting third-party AI agents operating inside customer accounts. In most cases the agent logs in with the customer's own credentials and permission, which breaks bank rules that require people to log in themselves. Some banks also saw agents contact call centers or take actions that appeared independent of user instructions, and executives say they often can't tell a human from an agent, or an authorized agent from a rogue one. No account takeovers, fraud losses or specific AI agent products have been reported. Morgan Stanley is blocking third-party agents and JPMorgan, Bank of America and Citi are restricting them. Don't give an AI agent your bank username and password.
severity: Anonymously sourced report (Axios); agents mostly use credentials customers handed over. No account takeovers, fraud or losses reported so far
## affected
- Customer accounts where a third-party AI agent logs in with the customer's banking username and password
## fixed in
- Morgan Stanley: blocking third-party agents
- JPMorgan, Bank of America, Citi: restricting agent access
- Most banks: moving to read-only access through authorized data connectors
## timeline[4]
Axios scoop: major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, some taking actions that appear independent of user instructions. Morgan Stanley is blocking agents and JPMorgan, Bank of America and Citi are restricting them.
sourceChase tells Axios that customers should not give their usernames and passwords to anyone. Morgan Stanley says it hasn't observed "rogue AI agents accessing our platforms."
sourceReuters picks up the Axios report and says it could not immediately verify it.
sourceJPMorgan says it blocks outside AI agents from operating retail customer accounts. Jamie Dimon warns of "rogue agents" and says customers who use them should understand there's a "liability transfer".
source
## news & write-ups[3]
- Scoop: Unvetted AI agents are accessing U.S. bank accountsAxios · Oct 22, 2026
- US banks detect unauthorized AI agents in customer accounts, Axios reportsReuters (via The Star) · Oct 22, 2026
- JPMorgan Chase blocks outside AI agents like Muse, Instinct from directly accessing accountsCNBC · Oct 13, 2026
## posts[3]
MAJOR U.S. BANKS DETECT UNAUTHORIZED AI AGENTS ACCESSING CUSTOMER ACCOUNTS — AXIOS Major banks, including $JPM, $BAC, $MS and $WFC, are confronting security risks from third-party AI agents accessing customer accounts, according to Axios. Some agents have reportedly attempted actions beyond user instructions, raising concerns about unauthorized transactions and fund transfers. Morgan Stanley has begun blocking third-party agents, while JPMorgan, Bank of America and Citi are restricting access. Banks warn they cannot reliably distinguish legitimate user activity from autonomous AI agents, even when customers have voluntarily shared their credentials.
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions. t.co/QGmAmvmtEK
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: t.co/Q3bda5In8q
## notes & caveats
Axios relies on unnamed sources; Reuters could not immediately verify it. Axios names no AI agent products. CNBC's Oct 13 piece mentions Meta's Muse and Instinct (Spear Street Technology) as background on consumer agents; neither is tied to this activity. Wells Fargo is named among banks racing to contain agent risk, but its own actions aren't described. No bank or regulator has confirmed losses, fraud or account takeovers.
