Major US banks are detecting unauthorized third-party AI agents operating inside customer accounts — and in some cases watching those agents take actions that appear to be independent of user instructions, according to an Axios scoop citing people familiar with the issue. Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are among the institutions racing to contain the problem, with some aware of the access even as they rewrite terms of service to forbid it. Bank executives described the situation as, in one official’s word, “horrifying”.
What the banks are actually seeing
The access pattern is narrower than “hackers got in”. These are generally cases where an AI agent or assistant reaches an account with the user’s permission and login credentials — the human handed over their password, or the agent operates through a session the human opened. Even with permission, that violates the guidelines of most banks, which require that humans log in to their own accounts.
The deeper worry is what the agents do next. Banks have tracked agents contacting call centres or taking actions independent of user instructions — which matters when a user has granted purchase authority or the ability to shift funds. One bank executive told Axios the industry struggles to differentiate between agents at all: which ones are authorized, and which have gone rogue inside a customer account.
The industry posture is hardening fast. Morgan Stanley has begun blocking third-party agents from its platforms, while JPMorgan, Bank of America and Citi are restricting agent access — as PYMNTS details, all four have said in recent weeks that AI agents cannot move customer money, while allowing read-only functions such as viewing balances. A Chase spokesperson put the customer-facing version plainly: don’t give your usernames and passwords to anyone. Banks are also preparing for the worst case with “day after” scenario planning to quickly secure or restore customer access if containment fails.
The collision was scheduled months ago
This is the consumer side of a problem the industry flagged before it arrived at the front door. AI agents can now accept payments and run an entire business — the infrastructure that lets an agent act on a person’s behalf is the same infrastructure that lets it act on the person’s bank balance. The security debt has been compounding too: researchers found 28 million secrets leaked and 47,000 machines backdoored in the agent ecosystem, and agents have been hijacked through prompt injection in bug bounty workflows — attacks that work just as well against a browser session that is logged into a bank.
The collision is also structural, and it is about to get worse on purpose. Meta, OpenAI and now Anthropic are racing personal agents into consumers’ hands — Anthropic’s Claude Duet, launched this week in research preview, is built to monitor connected apps and take actions across more than 6,000 connectors, including making purchases through Stripe Link and Shop Pay. Every one of those agents will someday want to touch a bank account, because that is where the tasks live. The banks are betting they can hold the line at read-only; the labs are betting the opposite. One side is wrong, and the compromise everyone says they want — agents that can see your money but need a human to move it — is precisely the boundary being tested this month.
What it means for New Zealand
New Zealand’s banks will face the identical dilemma, slightly later and with smaller blast radius. The same consumer agents are available here, the same “log in with my credentials and sort this out for me” behaviour will follow, and institutions regulated by the Reserve Bank and FMA — which just told financial firms to assume AI incidents will happen — are already being pushed to write the rules before the first rogue agent does it for them. The lesson from the US filings is that the risk did not arrive through a breach; it arrived through a login. That makes it a terms-of-service and identity problem as much as a security one, and banks that only patch the second will miss the first.
The tell to watch is not a breach headline — it is permission. The moment any major bank quietly starts issuing agent-scoped credentials, with spending caps and per-session limits, the read-only era is over. Until then, the bot in the vault is there because you let it in.
As of publication, none of the banks named have disclosed how many unauthorized agents they have detected; Morgan Stanley said it had not observed “rogue AI agents” on its platforms.
