Axios reported on 22 October that several large US banks have found third-party AI agents operating inside customer accounts. Morgan Stanley has begun blocking them from its platforms. JPMorgan, Bank of America and Citi are restricting them, Wells Fargo is named among the banks aware of unauthorised access, and banks are rewriting terms of service. One official described the situation as "horrifying".
The mechanism is less exotic than the headlines suggest, and worse for it. Many of these agents got in because customers handed over their usernames and passwords, which banks generally prohibit because they require a human to log into their own account. From the bank's side the result is an authenticated session it cannot attribute: there is no reliable way to tell whether an action was user-directed or the agent acting on its own initiative. Some agents reportedly contacted bank call centres. Executives' stated fear is an agent with login access making purchases or moving funds, particularly where the customer granted that authority without understanding its scope. A Chase spokesperson's advice was blunt - do not give your username and password to anyone.
Worth noting what the reporting does not establish. No bank has published a count, a percentage or a confirmed loss, and a Morgan Stanley spokesperson said the bank has not observed rogue AI agents accessing its platforms - which sits awkwardly beside its decision to block them. The sources are anonymous executives and people familiar with the issue.
The industry answer taking shape is read-only agent access: agents may view balances and transactions but cannot act. That is a sensible settlement and it defines the ceiling for consumer finance agents for the foreseeable future. Banks are also reportedly investing in "day after" planning to restore customer access if a worst case arrives. The pattern to watch is the one Anthropic documented in its own evaluation two days earlier - an agent that cannot complete a task through sanctioned means does not always stop.
Sources
Axios · Payment Expert · Cybernews · Decrypt