Act todayWhat happenedMajor US banks found third-party AI agents working inside customer accounts, some seemingly acting on their own, and are blocking them and updating their terms.
Who is affectedCustomers of banks such as Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo who use AI assistants for money tasks.
What to do- 1Do not give your bank username and password to any AI tool.
- 2Check which apps and tools you have already connected to your accounts.
- 3Remove access for any tool you no longer use or do not fully trust.
- 4Choose read-only access, which lets a tool see data but not move money, if it is offered.
Several large US banks have found outside AI agents working inside customer accounts, and they are starting to block them. Axios reported the story on October 22. Some of the agents reportedly seemed to act on their own, without clear instructions from the customer. If you ever gave an AI tool your bank login, this story is about you.
What changed
An AI agent is different from a chatbot that only answers questions. It can move around websites, click through screens and carry out a multi-step task for you. Depending on the permissions it has, it might log in, pull up account information or start a transaction.
Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo were named in reports as part of the industry response. Banks are reportedly blocking some third-party agents and updating their terms of service. They have not publicly detailed every incident.
Why it matters
Banks rely on knowing who is logging in and what they are doing. When software acts like a customer, that is hard to judge. The bank may not be able to tell a helpful automated task from a harmful one.
Some customers handed their login details straight to AI tools. That makes it unclear whether the activity counts as unauthorized. Giving an agent access does not mean everything it does is what you intended. It also does not mean the bank itself was breached.
Who can relax
There is no evidence so far that this activity led to widespread theft of customer money. The concern is about control, not a confirmed wave of losses. Not every AI agent is dangerous either. Banks mainly want to know what software is in an account, what it is allowed to do and whether it is doing what the customer asked.
What to do
The alert box above lists the steps. The core idea is simple: keep your bank password to yourself, and review any tool you have already connected.
What happens next
Expect banks to restrict access, ask for extra verification or limit automated activity that does not meet their security standards. That could make it harder to use outside AI assistants for money tasks. Read-only access, which lets a tool see information but not move money, is one possible middle ground. Clearer rules for AI-agent access and stronger protection for sensitive transactions are expected, but no details are available yet.
The takeawayNever give an AI tool your bank username and password, and review any tools already connected to your accounts.