Major Banks Detect Unauthorized AI Agents in Customer Accounts

Major US banks are finding third-party AI agents operating inside customer accounts without the bank’s approval, and some of those agents have tried to take actions that appear unconnected to anything the customer asked them to do, Axios reported on 22 October 2026.

Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo are among the lenders racing to contain the problem, according to the report, which cites unnamed people familiar with the matter.

In most cases, the agents are not breaking in. They sign in with the customer’s own username and password, handed over so an AI assistant can check balances, pay bills or move money on the customer’s behalf. That still breaches the terms at most banks, which require account holders to log in themselves.

The more worrying cases, per Axios, involve agents that contacted bank call centres or appeared to act on their own initiative, and one bank executive told the outlet that banks often cannot tell an agent a customer deliberately sent from one that has gone rogue.

Bank executives described the situation to Axios as “horrifying,” with one official citing grave concern about agents taking steps that could affect customers’ finances. Reuters, which carried the report, said it could not immediately verify it. The report does not say how many accounts were involved, which AI products the agents belonged to, or whether any customers have lost money.

Which banks are blocking AI agents

Morgan Stanley has begun blocking third-party agents from its platforms, Axios reported, although a Morgan Stanley spokesperson told the outlet the bank had not seen rogue AI agents accessing its systems. JPMorgan, Bank of America and Citigroup are restricting agents rather than banning them outright. Wells Fargo, also named in the report, has not publicly described specific restrictions.

JPMorgan Chase drew the clearest line first. On the bank’s third-quarter earnings call on 13 October, CEO Jamie Dimon said the bank would not let just any outside agent inside its systems. “You don’t want rogue agents, and it could be thousands of them,” Dimon said. A JPMorgan spokeswoman told CNBC the bank does not permit third parties to log in with customers’ banking credentials, though agents can still see read-only data, such as balances, through a connector like Plaid. She gave no timeline for letting agents act inside accounts directly.

Citigroup and Bank of America followed on 16 October. Citi told Retail Banker International that it does not allow third-party AI agents or assistants to log in to customer accounts or transact on its digital banking platforms, while still letting customers grant limited read-only access through certain open-banking providers. Bank of America is limiting agents’ access to consumer deposits, according to a person familiar with the matter, and the Financial Times reported that regulators have privately backed the banks’ decisions.

CEO Rick Wurster told Bloomberg Television on 16 October that Schwab is stopping unauthorized agents, including Meta’s Muse, from moving client money, and that his weekly report shows the big agents being blocked “in the tens and twenties” each week.

Schwab plans to let customers connect AI models through its own Model Context Protocol (MCP) servers instead. MCP is an open standard for plugging AI models into outside data and tools, and Schwab’s version would expose balances and research but not money movement.

The pattern across all five firms is the same: an agent may look at an account through a channel the bank controls, but it may not move money. Axios reported that most banks have authorised or are moving toward read-only access, the same arrangement they already offer budgeting apps such as Quicken.

Why Meta’s Muse brought this to a head

The clampdown follows a rush of consumer AI agents built to act rather than just answer. Meta launched Muse in the US on 8 September 2026 as a personal agent that can fill in forms, send emails, check out on shopping sites and connect to bank accounts, and it added the ability to phone US businesses in a public beta about a week later.

Amazon began blocking Muse on 20 September, saying the agent had not identified itself as AI while browsing. OpenAI released its own agent, Dots, weeks after Muse.

Axios did not name the agents behind the account activity banks are now flagging, and nothing in the reporting ties the call-centre contacts to any specific product.

Security is not the only concern on the table. Bank stocks fell in September as Muse climbed the app download charts, CNBC reported, on fears that consumers would use agents to sweep cash out of low-yielding accounts and into better-paying ones.

JPMorgan CFO Jeremy Barnum raised the same possibility on the October call, and the FT reported that banks have voiced deposit-flight worries to regulators. JPMorgan’s own planned Smart Cash tool, which Dimon said in his April shareholder letter would automate transfers between checking accounts and higher-yielding brokerage products, is designed to do much the same job.

The pushback is spreading north. Bank of Montreal CEO Darryl White told customers not to give AI agents their banking username and password, a day after Royal Bank of Canada CEO Dave McKay said his bank was considering blocking Muse.

Who pays if an AI agent moves your money

The liability question is what turns a terms-of-service breach into a real risk for customers. Barnum said on the earnings call that customers who share credentials with an agent could bear responsibility if the agent misuses their information or makes a transaction they did not want, American Banker reported. Dimon described it to analysts as a transfer of liability.

Federal payment rules may back the banks up. Regulation E, which caps a US consumer’s losses from unauthorized electronic transfers at as little as $50, excludes transfers made by a person to whom the consumer gave their access credentials, unless the consumer has told the bank to stop that person.

The rule defines “person” to include companies, and a January report from the Consumer Bankers Association asked whether handing a password to an AI tool could trigger that exclusion and leave the customer liable for the agent’s mistakes, Payments Dive reported. No regulator or court has settled it.

The safer alternative to password sharing also remains in limbo. The Consumer Financial Protection Bureau’s open banking rule, finalised in October 2024 to move third-party access from credential-based screen scraping to bank-run APIs, has been subject to litigation and reconsideration by the agency’s new leadership since 2025.

For customers already using an AI assistant with a bank account, the practical step is to stop sharing the login itself. A Chase spokesperson told Axios that customers should not give their username and password to anyone. Read-only connections through approved aggregators such as Plaid still work at JPMorgan and Citi, and the CFPB has advised consumers to check whether a connected service can initiate payments and to revoke its access when they stop using it, noting that deleting the app does not cut off the connection.

Banks are now planning for the worst case as well as trying to prevent it. Axios reported that lenders are running “day after” scenarios so they can quickly secure or restore customer access if an agent does damage, and several executives said they know customers will keep wanting these tools and that some middle ground will be needed.

Meta declined to tell Fortune whether Muse’s finance features would survive more banks shutting agents out, and none of the banks have said which agents it detected or how many customer accounts were affected.