{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T17:40:31.642Z", "tag": { "id": "morgan-stanley", "label": "Morgan Stanley", "isStack": false, "url": "https://pwn.watch/t/morgan-stanley", "feed": "https://pwn.watch/t/morgan-stanley/feed.xml" }, "counts": { "incidents": 1, "live": 1, "notFullyPatched": 1, "patched": 0 }, "incidents": [ { "slug": "us-banks-unauthorized-ai-agents-customer-accounts", "title": "Major U.S. banks detect unauthorized third-party AI agents inside customer accounts", "url": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts", "json": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts.json", "status": "live", "severity": "medium", "patchStatus": "partial", "product": "Online banking accounts at major U.S. banks (Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo, Citi)", "tags": [ "ai", "jpmorgan", "bank-of-america", "morgan-stanley", "wells-fargo", "citi", "banking", "ai-agents" ], "cveIds": [], "affectedVersions": [ "Customer accounts where a third-party AI agent logs in with the customer's banking username and password" ], "fixedVersions": [ "Morgan Stanley: blocking third-party agents", "JPMorgan, Bank of America, Citi: restricting agent access", "Most banks: moving to read-only access through authorized data connectors" ], "startedAt": "2026-10-22", "closedAt": null, "updatedAt": "2026-10-22T16:53:42+02:00", "summary": "Axios reports that major U.S. banks, including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo, are detecting third-party AI agents operating inside customer accounts. In most cases the agent logs in with the customer's own credentials and permission, which breaks bank rules that require people to log in themselves. Some banks also saw agents contact call centers or take actions that appeared independent of user instructions, and executives say they often can't tell a human from an agent, or an authorized agent from a rogue one. No account takeovers, fraud losses or specific AI agent products have been reported. Morgan Stanley is blocking third-party agents and JPMorgan, Bank of America and Citi are restricting them. Don't give an AI agent your bank username and password.", "xPost": null } ], "posts": [ { "authorName": "*Walter Bloomberg", "handle": "DeItaone", "avatarUrl": "https://pbs.twimg.com/profile_images/2088360110095478784/El9anzXH_bigger.jpg", "text": "MAJOR U.S. BANKS DETECT UNAUTHORIZED AI AGENTS ACCESSING CUSTOMER ACCOUNTS — AXIOS\n\nMajor banks, including $JPM, $BAC, $MS and $WFC, are confronting security risks from third-party AI agents accessing customer accounts, according to Axios.\n\nSome agents have reportedly attempted actions beyond user instructions, raising concerns about unauthorized transactions and fund transfers.\n\nMorgan Stanley has begun blocking third-party agents, while JPMorgan, Bank of America and Citi are restricting access.\n\nBanks warn they cannot reliably distinguish legitimate user activity from autonomous AI agents, even when customers have voluntarily shared their credentials.", "date": "2026-10-22T13:58:38.000Z", "url": "https://x.com/DeItaone/status/2113268796618068421", "media": [], "incident": "us-banks-unauthorized-ai-agents-customer-accounts" }, { "authorName": "Axios", "handle": "axios", "avatarUrl": "https://pbs.twimg.com/profile_images/1641458976049995776/GtO-0zYe_bigger.jpg", "text": "SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions. https://t.co/QGmAmvmtEK", "date": "2026-10-22T13:56:18.000Z", "url": "https://x.com/axios/status/2113268208371126348", "media": [], "incident": "us-banks-unauthorized-ai-agents-customer-accounts" }, { "authorName": "Madison Mills", "handle": "MadisonMills22", "avatarUrl": "https://pbs.twimg.com/profile_images/1784997467039170560/0Vttab_c_bigger.jpg", "text": "SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.\n\nThe findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.\n\nSeveral banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.\n\nSeveral bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.\n\nRead my latest for Axios here: https://t.co/Q3bda5In8q", "date": "2026-10-22T12:48:05.000Z", "url": "https://x.com/MadisonMills22/status/2113251043173683683", "media": [], "incident": "us-banks-unauthorized-ai-agents-customer-accounts" } ], "changes": [ { "incident": "us-banks-unauthorized-ai-agents-customer-accounts", "incidentTitle": "Major U.S. banks detect unauthorized third-party AI agents inside customer accounts", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Axios scoop: major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, some taking actions that appear independent of user instructions. Morgan Stanley is blocking agents and JPMorgan, Bank of America and Citi are restricting them.", "body": null, "sourceUrl": "https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access", "url": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts" }, { "incident": "us-banks-unauthorized-ai-agents-customer-accounts", "incidentTitle": "Major U.S. banks detect unauthorized third-party AI agents inside customer accounts", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Chase tells Axios that customers should not give their usernames and passwords to anyone. Morgan Stanley says it hasn't observed \"rogue AI agents accessing our platforms.\"", "body": null, "sourceUrl": "https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access", "url": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts" }, { "incident": "us-banks-unauthorized-ai-agents-customer-accounts", "incidentTitle": "Major U.S. banks detect unauthorized third-party AI agents inside customer accounts", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Reuters picks up the Axios report and says it could not immediately verify it.", "body": null, "sourceUrl": "https://www.thestar.com.my/tech/tech-news/2026/10/22/us-banks-detect-unauthorized-ai-agents-in-customer-accounts-axios-reports", "url": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts" }, { "incident": "us-banks-unauthorized-ai-agents-customer-accounts", "incidentTitle": "Major U.S. banks detect unauthorized third-party AI agents inside customer accounts", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-13", "title": "JPMorgan says it blocks outside AI agents from operating retail customer accounts. Jamie Dimon warns of \"rogue agents\" and says customers who use them should understand there's a \"liability transfer\".", "body": null, "sourceUrl": "https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html", "url": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts" } ] }