Major U.S. banks are detecting unauthorized third-party AI agents accessing customer accounts, with some attempting actions beyond users’ instructions, according to a new Axios investigation.
Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are among the institutions addressing the risks.
Bank executives report difficulty distinguishing legitimate customer activity from autonomous AI agents using account credentials. Some agents have reportedly attempted actions independently of user instructions, raising concerns about unauthorized transactions and access to sensitive financial information.
Several banks are restricting third-party AI access or limiting agents to read-only permissions, allowing them to view account information without transferring funds. Financial institutions are also reassessing authentication controls and policies governing AI agents.
John Strand, Owner, Black Hills Information Security:
“This is a real gap in traditional penetration testing. Financial institutions often have very clearly defined lines that testers cannot cross, and gaining access to actual customer accounts is usually off-limits. For good reason.
“Good testing firms work with the institution to set up dedicated test accounts and controls so those attack paths can still be evaluated safely. But that approach isn’t applied consistently, and restrictions intended to protect customers can leave a security blind spot if there’s no safe way to test those paths.
“Attackers don’t have those restrictions. Neither do the AI agents they deploy. They don’t care about your scope or your rules of engagement. If there’s a weakness in how someone can gain access to a financial account, they’re going to try to exploit it.
“I suspect we’ll see more of these attacks as ransomware groups and nation-state actors use AI to test those paths at scale. Authentication and account access need to be tested more thoroughly. Keeping customer accounts out of scope cannot mean leaving the controls protecting those accounts untested.”
ㅤ
Ted Miracco, CEO, Approov:
“There is no “machine gone rogue” in this story. There are only irresponsible people handing banking credentials to AI software, and vendors shipping agents that ask for them. Both are human decisions and both should carry the financial consequences; however, right now neither clearly does.”
“We are building agents to impersonate customers and then using shared credentials which means a bank cannot tell an authorized agent from an attacker using the exact same login. That is more of an identity failure than an AI failure. Until agents carry verifiable identities, scoped permissions and an audit trail, blocking them is the best defensible control a bank has.”
ㅤ
John Carberry, Solution Sleuth, Xcape Inc.:
“The business impact is the collision between open banking mandates and credential-driven artificial intelligence automation, creating immediate fraud and compliance risks for financial institutions. AI companies are aggressively deploying products designed to parse through financial records, which has directly led to this situation where automated tools operate with delegated credentials. While sensationalized as rogue agents, the technical reality is that consumers are willingly handing over access to third-party tools that execute poorly scoped workflows. Security leaders must differentiate between authenticated human sessions and automated toolchains by enforcing API-based access controls and rate limiting. Prioritize transitioning away from legacy credential sharing by accelerating Section 1033 compliant OAuth flows and restricting unauthorized bots to read-only access. Defenders should anticipate this exact threat model migrating quickly to other sectors: healthcare records are next, as similar AI parsing products already exist in that space.
“Critical Takeaways
- AI tools parsing financial records are driving an increase in automated, credential-based access that traditional controls struggle to identify.
- Banks must deprecate legacy credential sharing and accelerate API-based, read-only OAuth flows.
- The healthcare sector is the next immediate target for these autonomous data-parsing agents due to the proliferation of similar AI products.
“If you think the financial bots are bad, wait until they start diagnosing your medical history.”
This is scary as I am just educating seniors on avoiding these sorts of scams. So having banks with these scams really says that banks need to do something about this. And fast.
UPDATED: BreachLock CEO Seemant Sehgal said this:
“Unauthorized AI agents access bank accounts the same way any third-party service does. The customer gives the agent their username, password, and sometimes their MFA codes, and the agent uses those credentials to log in on their behalf. The obvious problem is, the bank cannot tell the difference between the agent and the customer.
“The real risk for consumers is twofold. The credentials you share with the agent are now stored by that third party and will be exposed if the agent provider gets breached, and agents sometimes take actions the user did not specifically approve because they interpret general instructions more broadly than intended. The safest step today is not sharing bank credentials with any AI agent that is not your bank’s own official product.”
Decades-old PHP vulnerabilities raise questions about patching and operational resilience
Posted in Commentary with tags PHP on October 22, 2026 by itnerdCritical vulnerabilities in PHP are raising questions about how organizations can identify and secure legacy systems that may have been deployed more than two decades ago.
The flaws have reportedly existed since 2004, leaving current security teams to manage systems originally installed and maintained by personnel who may no longer be with their organizations.
Madelein van der Hout, a senior analyst at Forrester Research, had some interesting comments for TechNewsWorld and explained that what makes these vulnerabilities significant is where they sit.
“PHP underpins websites and applications across many organizations and their suppliers, so checking the corporate website alone is not enough.
“Organizations need to establish where they are exposed and prioritize internet-facing systems.
“This is a test of operational resilience, not just patch management,” she added.
Phillip Wylie, Chief Security Evangelist, Suzu Labs:
ㅤ
“One of the biggest challenges with vulnerabilities this old is that the people who originally deployed and maintained these systems may no longer be with the organization. Documentation may be outdated or nonexistent, and current security teams may not even know these systems are running.
“Before organizations can patch vulnerabilities, they need visibility into what’s in their environment. That means identifying affected systems, understanding their business impact, and prioritizing those exposed to the internet.
“Patching is important, but it’s not always straightforward with legacy applications. Organizations need to assess the potential impact of updates, implement compensating controls where immediate patching isn’t possible, and develop a plan to replace systems that can no longer be securely maintained.
“This is why asset management, vulnerability management, and basic security hygiene are so important. You can’t protect systems you don’t know exist.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“These PHP vulnerabilities highlight two problems. First, releasing a patch doesn’t mean we can fix everything overnight. PHP is embedded in all kinds of devices, including IoT products, where updates may depend on a vendor. And plenty of small businesses use PHP applications because they’re easy to get running. That doesn’t mean those businesses have the staff or technical expertise to keep everything updated.
“Then you have application compatibility. Plugins and other dependencies can require specific PHP versions, so updating the underlying software may break something the business relies on. ‘Just patch it’ sounds great until the update takes down your website.
“And we haven’t even gotten to the AI-assisted vulnerability research behind this. I think we’re going to see more critical vulnerabilities discovered with AI, and potentially less time between discovery and exploitation.
“That’s the part that worries me. Finding vulnerabilities faster doesn’t mean organizations can fix them faster. We’re still struggling to patch the systems we already know are vulnerable. As an industry, we’re not ready for that gap to keep growing.”
ㅤ
Noelle Murata, Chief Operating Officer, Xcape Inc.:
“The discovery of decades-old vulnerabilities in PHP presents a severe operational resilience test for enterprises rather than a routine patch management drill. At its core, this is another case of needing to “patch your stuff.” Because this runtime underpins a vast swath of the Internet and complex supplier ecosystems, the risk extends beyond primary corporate websites into forgotten legacy dependencies where original deployment context is long gone. Popular frameworks exist that are easy to deploy but also vulnerable if configured improperly. This does not necessarily mean that those frameworks are bad, but rather it is easy to deploy them poorly. Security teams must move beyond basic scanning and execute comprehensive asset discovery across all Internet-facing systems to identify shadow infrastructure. Mitigating controls exist to make this threat less severe without completely removing the risk, so there is cautious optimism that organizations can respond effectively. That said, there will undoubtedly be companies that will not respond quickly, so the number of vulnerable hosts will remain high.
“Critical Takeaways:
“Hope is not a strategy, but mitigating controls might just buy you enough time to formulate one.”
PHP needs to be patched. I would strongly recommend that you find out if ANYTHING uses PHP and take the action that is requires ASAP.
Leave a comment »