Skip to content
~/pwn.watch

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

// tag

AI agents

Security incidents tagged AI agents. Newest first.

incidents
1
live
1
patched
0
rss json llms.txtall tags

## 1 AI agents incident in the last 12 months

crit 4 · high 3 · med 2 · low 1 · upd ½lessmore
  • mediumlivepartial fixsince Oct 22, 2026

    Major U.S. banks detect unauthorized third-party AI agents inside customer accounts

    › Online banking accounts at major U.S. banks (Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo, Citi)

    Axios reports that major U.S. banks, including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo, are detecting third-party AI agents operating inside customer accounts. In most cases the agent logs in with the customer's own credentials and permission, which breaks bank rules that require people to log in themselves. Some banks also saw agents contact call centers or take actions that appeared independent of user instructions, and executives say they often can't tell a human from an agent, or an authorized agent from a rogue one. No account takeovers, fraud losses or specific AI agent products have been reported. Morgan Stanley is blocking third-party agents and JPMorgan, Bank of America and Citi are restricting them. Don't give an AI agent your bank username and password.

## posts 3

  • › Major U.S. banks detect unauthorized third-party AI agents inside customer accounts
    *Walter Bloomberg
    @DeItaone

    MAJOR U.S. BANKS DETECT UNAUTHORIZED AI AGENTS ACCESSING CUSTOMER ACCOUNTS — AXIOS Major banks, including $JPM, $BAC, $MS and $WFC, are confronting security risks from third-party AI agents accessing customer accounts, according to Axios. Some agents have reportedly attempted actions beyond user instructions, raising concerns about unauthorized transactions and fund transfers. Morgan Stanley has begun blocking third-party agents, while JPMorgan, Bank of America and Citi are restricting access. Banks warn they cannot reliably distinguish legitimate user activity from autonomous AI agents, even when customers have voluntarily shared their credentials.

  • › Major U.S. banks detect unauthorized third-party AI agents inside customer accounts
    Axios
    @axios

    SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions. t.co/QGmAmvmtEK

  • › Major U.S. banks detect unauthorized third-party AI agents inside customer accounts
    Madison Mills
    @MadisonMills22

    SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: t.co/Q3bda5In8q

// sponsored

buy sponsor slot · $149/mo