Some of the people logging in to accounts at America's largest banks aren't the account holders. Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, Axios reported Thursday, and some appear to act independently of user instructions.
The more troubling detail is what banks can't see. Many can't determine whether agent activity is user-directed, and one executive told Axios the bank struggles to distinguish between an agent a customer authorized from one that has gone rogue.
The reporting leans on unnamed sources, and Morgan Stanley's spokesperson said the bank hasn't observed "rogue AI agents accessing our platforms." Still, the industry's response over the past two weeks suggests the concern is real. And the most revealing response isn't a block—it's a contract.
Take away the AI, and this is an old problem. Most of the access Axios describes involves customers handing an agent their own login credentials, which already violates most banks' terms. Security teams have seen it before with screen scraping, when data aggregators logged in as customers until the industry pushed toward tokenized API access.
The difference now is autonomy. An aggregator reads balances, while an agent with purchase or transfer authority acts. Axios also reports agents contacting bank call centers. That pushes the problem into voice channels, where verification often relies on knowledge-based questions that an agent holding the customer's data can answer.
For detection teams, a credential-sharing agent collapses three identities into one session: the customer, an agent the customer authorized, and an agent operating without anyone's permission. Account takeover analytics flag deviations from the customer's baseline. An authorized agent is a deviation by definition, though, and a compromised agent can look identical to an authorized one. The signal banks need is who delegated what authority to whom, and a username and password can't carry it.
JPMorgan moved first. On the bank's October 13 earnings call, CEO Jamie Dimon said JPMorgan would block outside agents from logging in to or acting on customer accounts, warning, "You don't want rogue agents." Within days, Citi and Bank of America imposed their own restrictions. Citi said it won't let third-party agents log in or transact on its digital platforms, and Axios reports Morgan Stanley has begun blocking them, as well.
The emerging compromise is read-only access, the same kind banks already give budgeting tools like Quicken. Security isn't the only pressure, though. The restrictions followed Meta's September launch of its Muse assistant, which revived fears that agents would sweep idle deposits into higher-yield accounts. For practitioners, the precedent matters more than the motive, because the controls built now will define how agents can transact.
Dimon also told analysts that customers who authorize outside agents need to understand the "liability transfer" involved. Wells Fargo has written that transfer into its terms.
The bank's updated Online Access Agreement, effective November 24, states that every transaction by a customer's delegates, including their AI agents, counts as authorized by the customer, "including those you did not want or intend." Customers are also made solely responsible for supervising those agents.
The wire transfer section deserves a closer read. It says that giving an AI agent access may undermine the "commercially reasonable" security procedures the customer agreed to, and that the customer accepts that risk. Under UCC Article 4A, that standard determines who absorbs the loss on a fraudulent wire. The clause establishes in advance that the customer chose agent access.
The agreement also defines an unauthorized transfer under Regulation E narrowly: a transaction the customer authorizes, even one induced by fraud, doesn't qualify. If an agent's actions count as the customer's own, the account takeover protections customers expect may not apply. Whether that holds when an agent exceeds its instructions, or when an agent provider's credentials are stolen, remains untested.
The agreement frames these agent obligations as applying once the bank permits agents at all. The liability framework is arriving before the access it governs.
Banks are writing contracts instead of building integrations partly because the regulatory foundation is unsettled. The U.S. Consumer Financial Protection Bureau's (CFPB) Section 1033 open banking rule is enjoined and being rewritten. Even the data-sharing standards the market is converging on were built to read data, not act on it. Customers have no widely-adopted way to grant an agent narrow transactional authority that a bank can verify, log, and revoke, such as "pay this bill, up to this amount, until this date." Until that exists, the choice is binary: block the agent, or accept a session nobody can attribute.
Treat agents as identities, not borrowed sessions. That means distinct credentials, scoped and revocable tokens, and logs that attribute actions to the agent rather than just the account. Require human confirmation on a trusted device for money movement, and give agent-originated calls their own verification path in the contact center.
Just as important, make sure terms of service, fraud operations, and incident response tell the same story. If the legal agreement says agent actions belong to the customer, dispute workflows need evidence to separate an agent acting within scope from one that exceeded it or was compromised. That evidence has to be captured at authentication time, not reconstructed after the customer calls.
Then rehearse the bad day. Axios reports banks are running "day after" scenarios to quickly secure or restore customer access. In practice, that means confirming you can revoke agent sessions at scale without handing control back to a compromised agent.
None of this is unique to banking. Any organization with a customer portal will soon have agents logging in with borrowed credentials, if it doesn't already. The question is whether you'll know when one does, and whose problem it is when one goes wrong.