U.S. Banks Find Unauthorized AI Agents, Axios Reports

Major U.S. banks are detecting third-party artificial intelligence agents operating within customer accounts without authorization, with some of these agents attempting to execute actions that the customer did not request. This information comes from an exclusive Axios report published on October 22, based on sources monitoring the issue, and has been echoed by Reuters, attributing the data to Axios. Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo are among the institutions cited as rushing to contain the risk.

The crux of the issue is not an attack but an identity problem. According to the report, agents often gain access to accounts using the customer's login and password, a practice that contradicts the rules of most banks. From the bank's perspective, the session appears legitimate. Sources interviewed by Axios state that institutions struggle to distinguish one agent from another and to ascertain whether each action truly reflects the user's instruction.

How Each Bank is Responding

Morgan Stanley has taken the strictest stance, beginning to block third-party agents on its platforms, according to Axios sources. At the same time, a spokesperson for the bank stated that the institution has not observed cases of "dishonest AI agents accessing our platforms." The two statements do not contradict each other: the bank is shutting a door before seeing anyone pass through it.

JPMorgan, Bank of America, and Citi have opted for restriction rather than prohibition, according to the report. JPMorgan blocks external agents attempting to operate on behalf of retail clients; they can consult data such as account balances in read-only mode when an aggregator like Plaid has the user's credentials, but cannot transfer money or pay bills. Most of the cited banks have authorized or are moving towards authorizing this read-only access.

The report does not document confirmed financial losses caused by these agents. Besides Morgan Stanley, the other banks mentioned had not publicly commented on the report's details at the time of writing.

The U.S. Regulatory Gap

The problem exposes a difference in infrastructure between markets. In the United States, sharing banking data with third parties largely depends on aggregators that use customer credentials. The CFPB's open banking rule, outlined in section 1033 of the Dodd-Frank Act, was reopened for review by the agency itself in 2025, and the market still lacks a mandatory API access standard. An AI agent receiving the user's password inherits this model, with one key difference: instead of merely reading statements, it may attempt to take action.

In the United Kingdom and the European Union, the technical rule of PSD2 has restricted access via screen scraping with customer credentials since 2019, and British Open Banking requires dedicated interfaces with explicit consent. In theory, an AI agent wanting to operate a European account must go through an authorized provider and a defined-scope API, which gives the bank a point of control that the American model does not offer.

In Brazil, Open Finance has operated on recorded consents and standardized APIs since 2021, with scopes separating data reading and payment initiation. The architecture allows, at least conceptually, for an agent to be granted permission to check a balance without being allowed to move money, exactly the separation that American banks are now trying to improvise through unilateral blocking.

What This Means for Agent Vendors

For consumer agent providers and the companies that integrate them, the message from American banks is that access via customer credential is time-limited. Those building products that depend on user login and password run the risk of having their integration cut off without notice, as Morgan Stanley has begun to implement.

For banks, the underlying issue is one of accountability. If a client-authorized agent executes a transfer that the client did not intend, the liability for the loss currently lacks a clear owner in the United States. In markets with structured consent via API, such as the United Kingdom and Brazil, a record of who authorized what already exists and should serve as the basis when the first such dispute reaches a court or regulator.