[medium] Major U.S. banks detect unauthorized third-party AI agents inside customer accounts

Thu, 22 Oct 2026 14:53:42 GMT

Axios reports that major U.S. banks, including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo, are detecting third-party AI agents operating inside customer accounts. In most cases the agent logs in with the customer's own credentials and permission, which breaks bank rules that require people to log in themselves. Some banks also saw agents contact call centers or take actions that appeared independent of user instructions, and executives say they often can't tell a human from an agent, or an authorized agent from a rogue one. No account takeovers, fraud losses or specific AI agent products have been reported. Morgan Stanley is blocking third-party agents and JPMorgan, Bank of America and Citi are restricting them. Don't give an AI agent your bank username and password.

Status: live · Patch: partial · Fixed in: Morgan Stanley: blocking third-party agents, JPMorgan, Bank of America, Citi: restricting agent access, Most banks: moving to read-only access through authorized data connectors

Latest updates:

2026-10-22: Axios scoop: major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, some taking actions that appear independent of user instructions. Morgan Stanley is blocking agents and JPMorgan, Bank of America and Citi are restricting them. (source)
2026-10-22: Chase tells Axios that customers should not give their usernames and passwords to anyone. Morgan Stanley says it hasn't observed "rogue AI agents accessing our platforms." (source)
2026-10-22: Reuters picks up the Axios report and says it could not immediately verify it. (source)

pwn.watch: Banking incident updates

[medium] Major U.S. banks detect unauthorized third-party AI agents inside customer accounts