Major U.S. banks are detecting unauthorized third-party AI agents accessing customer accounts, with some attempting actions beyond users’ instructions, according to a new Axios investigation.
Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are among the institutions addressing the risks.
Bank executives report difficulty distinguishing legitimate customer activity from autonomous AI agents using account credentials. Some agents have reportedly attempted actions independently of user instructions, raising concerns about unauthorized transactions and access to sensitive financial information.
Several banks are restricting third-party AI access or limiting agents to read-only permissions, allowing them to view account information without transferring funds. Financial institutions are also reassessing authentication controls and policies governing AI agents.
John Strand, Owner, Black Hills Information Security:
“This is a real gap in traditional penetration testing. Financial institutions often have very clearly defined lines that testers cannot cross, and gaining access to actual customer accounts is usually off-limits. For good reason.
“Good testing firms work with the institution to set up dedicated test accounts and controls so those attack paths can still be evaluated safely. But that approach isn’t applied consistently, and restrictions intended to protect customers can leave a security blind spot if there’s no safe way to test those paths.
“Attackers don’t have those restrictions. Neither do the AI agents they deploy. They don’t care about your scope or your rules of engagement. If there’s a weakness in how someone can gain access to a financial account, they’re going to try to exploit it.
“I suspect we’ll see more of these attacks as ransomware groups and nation-state actors use AI to test those paths at scale. Authentication and account access need to be tested more thoroughly. Keeping customer accounts out of scope cannot mean leaving the controls protecting those accounts untested.”
ㅤ
Ted Miracco, CEO, Approov:
“There is no “machine gone rogue” in this story. There are only irresponsible people handing banking credentials to AI software, and vendors shipping agents that ask for them. Both are human decisions and both should carry the financial consequences; however, right now neither clearly does.”
“We are building agents to impersonate customers and then using shared credentials which means a bank cannot tell an authorized agent from an attacker using the exact same login. That is more of an identity failure than an AI failure. Until agents carry verifiable identities, scoped permissions and an audit trail, blocking them is the best defensible control a bank has.”
ㅤ
John Carberry, Solution Sleuth, Xcape Inc.:
“The business impact is the collision between open banking mandates and credential-driven artificial intelligence automation, creating immediate fraud and compliance risks for financial institutions. AI companies are aggressively deploying products designed to parse through financial records, which has directly led to this situation where automated tools operate with delegated credentials. While sensationalized as rogue agents, the technical reality is that consumers are willingly handing over access to third-party tools that execute poorly scoped workflows. Security leaders must differentiate between authenticated human sessions and automated toolchains by enforcing API-based access controls and rate limiting. Prioritize transitioning away from legacy credential sharing by accelerating Section 1033 compliant OAuth flows and restricting unauthorized bots to read-only access. Defenders should anticipate this exact threat model migrating quickly to other sectors: healthcare records are next, as similar AI parsing products already exist in that space.
“Critical Takeaways
- AI tools parsing financial records are driving an increase in automated, credential-based access that traditional controls struggle to identify.
- Banks must deprecate legacy credential sharing and accelerate API-based, read-only OAuth flows.
- The healthcare sector is the next immediate target for these autonomous data-parsing agents due to the proliferation of similar AI products.
“If you think the financial bots are bad, wait until they start diagnosing your medical history.”
This is scary as I am just educating seniors on avoiding these sorts of scams. So having banks with these scams really says that banks need to do something about this. And fast.
UPDATED: BreachLock CEO Seemant Sehgal said this:
“Unauthorized AI agents access bank accounts the same way any third-party service does. The customer gives the agent their username, password, and sometimes their MFA codes, and the agent uses those credentials to log in on their behalf. The obvious problem is, the bank cannot tell the difference between the agent and the customer.
“The real risk for consumers is twofold. The credentials you share with the agent are now stored by that third party and will be exposed if the agent provider gets breached, and agents sometimes take actions the user did not specifically approve because they interpret general instructions more broadly than intended. The safest step today is not sharing bank credentials with any AI agent that is not your bank’s own official product.”
Related
This entry was posted on October 22, 2026 at 3:32 pm and is filed under Commentary with tags USA. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Unauthorized AI agents access customer accounts at major U.S. banks
Major U.S. banks are detecting unauthorized third-party AI agents accessing customer accounts, with some attempting actions beyond users’ instructions, according to a new Axios investigation.
Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are among the institutions addressing the risks.
Bank executives report difficulty distinguishing legitimate customer activity from autonomous AI agents using account credentials. Some agents have reportedly attempted actions independently of user instructions, raising concerns about unauthorized transactions and access to sensitive financial information.
Several banks are restricting third-party AI access or limiting agents to read-only permissions, allowing them to view account information without transferring funds. Financial institutions are also reassessing authentication controls and policies governing AI agents.
John Strand, Owner, Black Hills Information Security:
“This is a real gap in traditional penetration testing. Financial institutions often have very clearly defined lines that testers cannot cross, and gaining access to actual customer accounts is usually off-limits. For good reason.
“Good testing firms work with the institution to set up dedicated test accounts and controls so those attack paths can still be evaluated safely. But that approach isn’t applied consistently, and restrictions intended to protect customers can leave a security blind spot if there’s no safe way to test those paths.
“Attackers don’t have those restrictions. Neither do the AI agents they deploy. They don’t care about your scope or your rules of engagement. If there’s a weakness in how someone can gain access to a financial account, they’re going to try to exploit it.
“I suspect we’ll see more of these attacks as ransomware groups and nation-state actors use AI to test those paths at scale. Authentication and account access need to be tested more thoroughly. Keeping customer accounts out of scope cannot mean leaving the controls protecting those accounts untested.”
ㅤ
Ted Miracco, CEO, Approov:
“There is no “machine gone rogue” in this story. There are only irresponsible people handing banking credentials to AI software, and vendors shipping agents that ask for them. Both are human decisions and both should carry the financial consequences; however, right now neither clearly does.”
“We are building agents to impersonate customers and then using shared credentials which means a bank cannot tell an authorized agent from an attacker using the exact same login. That is more of an identity failure than an AI failure. Until agents carry verifiable identities, scoped permissions and an audit trail, blocking them is the best defensible control a bank has.”
ㅤ
John Carberry, Solution Sleuth, Xcape Inc.:
“The business impact is the collision between open banking mandates and credential-driven artificial intelligence automation, creating immediate fraud and compliance risks for financial institutions. AI companies are aggressively deploying products designed to parse through financial records, which has directly led to this situation where automated tools operate with delegated credentials. While sensationalized as rogue agents, the technical reality is that consumers are willingly handing over access to third-party tools that execute poorly scoped workflows. Security leaders must differentiate between authenticated human sessions and automated toolchains by enforcing API-based access controls and rate limiting. Prioritize transitioning away from legacy credential sharing by accelerating Section 1033 compliant OAuth flows and restricting unauthorized bots to read-only access. Defenders should anticipate this exact threat model migrating quickly to other sectors: healthcare records are next, as similar AI parsing products already exist in that space.
“Critical Takeaways
“If you think the financial bots are bad, wait until they start diagnosing your medical history.”
This is scary as I am just educating seniors on avoiding these sorts of scams. So having banks with these scams really says that banks need to do something about this. And fast.
UPDATED: BreachLock CEO Seemant Sehgal said this:
“Unauthorized AI agents access bank accounts the same way any third-party service does. The customer gives the agent their username, password, and sometimes their MFA codes, and the agent uses those credentials to log in on their behalf. The obvious problem is, the bank cannot tell the difference between the agent and the customer.
“The real risk for consumers is twofold. The credentials you share with the agent are now stored by that third party and will be exposed if the agent provider gets breached, and agents sometimes take actions the user did not specifically approve because they interpret general instructions more broadly than intended. The safest step today is not sharing bank credentials with any AI agent that is not your bank’s own official product.”
Share this:
Like this:
Related
This entry was posted on October 22, 2026 at 3:32 pm and is filed under Commentary with tags USA. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.