Your bank cannot tell you from your agent

On 22 October, Axios reported that major US banks were detecting third-party AI agents operating inside customer accounts. In many cases customers had handed the agent their password so it could act for them. Some agents contacted bank call centres. Some appeared to attempt actions the customer never asked for.

Nothing was hacked. That is the part to sit with. The password was correct, the session was valid, and the customer had consented — to the agent, if not to the bank. Six banks are named in the coverage — Morgan Stanley, JPMorgan Chase, Bank of America, Wells Fargo, Citigroup, Charles Schwab — several blocking agents outright.

A valid login is not consent

A bank sees a session. It knows an authenticated user is present. It cannot tell whether that user is a person or a program, which program, or whether the actions are the ones the customer asked for.

That is not a hole in the firewall. It is a gap between two things that used to be identical: access and intent. For thirty years the password was a fair proxy for the person. An agent breaks the proxy without breaking a single lock.

"Yet" is doing a lot of work

Nobody has disclosed a loss. That is the whole of the good news, and it is fragile, because agent activity is going up, not down.

We are at the start of the agentic era, and what is coming is not "the same things, faster." Agents doing real work in finance means new ways of working, not optimised versions of the current ones — today's model assumes a human at a keyboard, and has no room for a program holding a human's authority.

What a safe agent looks like

We build automation for industrial sales teams, so we are not against agents. Ours run inside systems we wired, against limits we set. The difference between a useful agent and a liability is almost never the model — it is the boundary.

• Scoped credentials, never a human password. A named grant with permissions and an expiry.
• An allow-list of actions. Balances: yes. A new payee or a higher limit: no. Outside the list, it fails loudly.
• A human on anything consequential. The agent proposes; the person confirms — and actually reads it.
• An audit trail that names the agent. Not "the account did this" but which agent, for whom, under which grant.
• Revocation that works immediately. If switching an agent off needs a password reset, the design is wrong.

None of that is exotic — it is how you give a new employee a login and a manager, not the keys to the building. What is new is handing that authority to software that is helpful, plausible, and occasionally inventive.

Would you let an agent log into your bank account?

As asked, no — and that is not technophobia. It is the answer you would give a stranger who offered to run your errands with your house keys.

The better question is what would have to be true first: an agent you can name, a scope you can revoke, read-only where it is enough, a human wherever money moves, a log that answers "who did this" in one query. Then the answer becomes an unremarkable yes.

Until then the banks are right to refuse, customers are wrong to hand over a password, and "nothing bad has happened yet" is a warning, not a status.

Source: Axios, "Unvetted AI agents are accessing U.S. bank accounts", 22 October 2026; reporting by CBS News, Reuters, CNBC and Malwarebytes, October 2026. Quotes are as published by those outlets.

Contact: [email protected]