Michael JohnsonGiving an AI agent the login credentials for a bank account gives it a path to the same actions available through a regular login. On October 22, 2026, Axios reported that major US banks are detecting third-party agents in customer accounts; sources also told the outlet about cases in which agents contacted call centers or, by all appearances, took steps beyond the user’s instructions.
According to Axios, Morgan Stanley, JPMorgan, Bank of America, and Citi are imposing or considering restrictions. It is important to distinguish between two scenarios: a customer may give an agent their own credentials, while some observed actions, according to sources, appeared to be autonomous. A Morgan Stanley spokesperson told Axios that the bank had not observed cases of “rogue AI agents” accessing its platforms. The report is based on conversations with sources and does not give the number of affected customers or confirm financial losses.
Why banks distinguish viewing from transactions
An agent logging in with a customer’s password may gain access to an interface designed for a human and to the permissions available through it. If the account allows money transfers or purchases, automation goes beyond simply reading a balance. Banks also say it is difficult to determine exactly which agent is accessing the system and whether it is acting within the user’s authorization.
According to Axios, many banks allow or are considering read-only access through authorized channels. This mode can provide financial information while keeping transfers and payments outside the third-party agent’s permissions. The practical boundary therefore comes down to the type of access: reading data and carrying out transactions require different permissions and controls.
What to check before connecting
Users should find out whether a service asks for their bank password or connects through a bank-approved provider, what data it receives, and whether it can initiate payments or transfers. If a service asks you to enter your credentials on its own page, check your bank’s terms and the service’s data-handling policy; do not share your password without understanding how to revoke access.
This risk is also familiar from financial apps that connect through so-called screen scraping: a document for the CFPB describes an approach in which a service uses credentials supplied by the user to log in to a financial institution’s website. The agency notes that direct API connections may be a more secure and reliable way to exchange data. With an AI agent, it is especially useful to check whether access is limited to viewing and whether it can be revoked through the bank.
Bank terms are beginning to account for agent-related scenarios. For example, a version of the Wells Fargo agreement listed as taking effect on November 24, 2026, describes AI agents, representatives’ authority, and customer responsibility for actions taken through delegated access. This is a future version of the terms as of publication, so customers should consult their own bank’s current agreement rather than assume Wells Fargo’s provisions apply to other institutions.
While banks establish access boundaries, the clearest option for users is to connect only through explicitly authorized channels, prefer read-only access where available, and avoid confusing “the agent can see my balance” with “the agent is allowed to manage my money.” The October 22 report makes that distinction an urgent practical consideration, although Axios’s sources have not publicly disclosed details of individual incidents or the scale of the issue.