Calm down. · Both
Calm down: AI agents aren't living in your bank account
At 5:00 AM ET on Oct 22, Axios ran a scoop: major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts. By lunchtime a viral post on X had upgraded that to banks revealing rogue AI agents living in your account, presumably with a cot and a GPU. Calm down.
Read the Axios piece. It rests on unnamed sources: "sources tell Axios," "the people said." No bank disclosed an incident. Reuters picked it up 17 minutes later and said it "could not immediately verify the report." On the record, a Morgan Stanley spokesperson said the bank hasn't observed instances of "rogue AI agents accessing our platforms." A Chase spokesperson said customers shouldn't give their usernames and passwords to anyone. That's the entire on-the-record part of the Axios piece: one denial and a password tip.
Now the scary word, "unauthorized." Axios says these are "generally situations when an agent or AI assistant accesses a human's account with the user's permission and login credentials." Unauthorized means the bank didn't sign off: "Even if permitted by the user, this goes against the guidelines of most banks." In the typical case, nobody broke in. Somebody handed over the keys. No reported case describes an agent getting into an account without a user supplying the credentials.
The genuinely odd part is thinner. Per the same unnamed sources, some agents "contact call centers or appear to take actions independent of user instructions." No count, no named bank. The concern is forward-looking: "Banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds." None of the coverage cites a loss, a fraud amount, or a harmed customer.
And "rogue"? Jamie Dimon used it on JPMorgan's Oct 13 earnings call: "you don't want rogue agents, and there could be thousands of them." That's a risk he described, not something he said JPMorgan found. His next move was policy, not panic: "we're not going to allow just any outside agents to come in inside the company, because it's just too risky for clients and for JPMorgan." A JPMorgan spokeswoman told CNBC, "we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf."
So the door is closing. Per Axios, Morgan Stanley has begun blocking third-party agents, and JPMorgan, Bank of America and Citi are restricting them. "Most banks have authorized or are moving in the direction of allowing read-only access."
My take: these are user-directed agents. A person invited them in. The worry is that an agent does more than it was asked, not that it shows up uninvited. It's less Skynet in your checking account and more an intern with your password and too much initiative. The honest caveat: an agent you launched can still overreach, like calling the call center or trying a step you never approved. And banks say they're "broadly not able to parse whether agent account activity is user-directed." One executive told Axios they struggle to tell "whether an agent has been authorized by a user or has gone rogue and gained access to a customer account." So "user-directed" undersells it a little. You started it. You didn't necessarily approve every click.
That gap is where incident response lives. If you're the responder at a bank or a business, the question isn't whether the agent is evil. It's whether you can show who did what: the customer, an agent the customer set up, or someone else. Dimon mentioned a "liability transfer." In my opinion, that argument will be settled by whoever kept the logs. Same lesson as the grandma clip: check what the thing can reach and what it's allowed to do.
What to do:
- Builders: don't build on screen-scraping with stored bank passwords. Use scoped, read-only, OAuth-style or open-banking connections. Log every action your agent takes, require a human to confirm anything that moves money, and refuse out-of-scope steps like calling a bank's call center unprompted.
- Businesses (banks, fintechs, anyone holding customer accounts): plan to prove whether a human, an agent or someone else acted.
- Log: flag sessions that look automated, such as automation or headless-browser fingerprints, odd navigation speed, and logins from cloud or AI-vendor IP ranges.
- Preserve: keep session telemetry for disputed transactions, and keep call-center recordings with their caller-verification results.
- Check: when a customer disputes activity, compare it against that telemetry before deciding who acted.
- Contain: require step-up authentication for money movement, give agents read-only scopes, and keep a tested plan to lock and restore accounts.
- Anyone who gave an AI assistant a bank login: change the password, remove the saved credential, check recent transactions, payees and contact-info changes, and use the bank's read-only connection instead, if it offers one.