Axios reported Thursday morning that several of the largest banks in the U.S. have been finding AI agents working inside customer accounts without the bank's permission. In a scoop by Madison Mills, sources named Morgan Stanley, Bank of America, JPMorgan and Wells Fargo among the banks trying to get a handle on it, and said some of the agents had tried to do things the customer apparently never asked for. Bank executives told Axios the situation was horrifying.
By lunchtime the story had spread across X in all caps, and a lot of the posts read as if a bank robbery was underway. Nothing in the Axios report describes one. In most of the cases, the customer opened the door.
How the agents got in
Somebody signs up for an AI assistant and, to save some time, gives it their bank username and password so it can pay bills, move money between accounts or keep track of spending. This fall's assistants are designed around exactly that kind of errand. Meta's Muse, OpenAI's Dots and Anthropic's Duet are all marketed as helpers that get on with your to-do list in the background while you do something else.
Most banks, though, require a person to log into their own account, so an assistant using your password is breaking the bank's rules even if you set it up yourself. For the bank there's a bigger problem. When it looks at the activity, an agent you sent and one somebody else sent can look almost exactly alike.
People familiar with the issue told Axios that banks have watched agents phone customer service and take steps that didn't seem connected to anything the user had asked for. One executive said they often have no way of knowing whether an agent has the customer's blessing or has gone rogue. Morgan Stanley said it hasn't seen rogue agents on its platforms, though it has started blocking third-party agents regardless. JPMorgan, Bank of America and Citi are putting limits on them. Chase's spokesperson kept it short and told customers not to share their username and password with anyone.
Looking versus doing
Banks have let outside apps see account data for years. Quicken has done it for budgeting, and most banks are heading toward giving AI agents the same look-but-don't-touch access. What scares them is an agent that has been given permission to buy things or move money. An assistant like that could misunderstand an instruction, follow a command planted in a scam email, or decide on its own to ring the call center to speed things up, and the customer might not notice until money had left the account.
Some banks are already rehearsing for it. Axios reported they're doing "day after" planning so they can lock down or restore accounts fast if an agent causes damage before anyone catches it.
A day earlier, the agents belonged to criminals
On Wednesday, The Information reported, based on research from the security startup Straiker, that a hacking group called CyberCartel had used a team of AI agents against more than 400 banks, payment companies and other financial targets in Latin America.
The way the group divided up the work is unsettling. According to the reporting, agents running on xAI's Grok researched the targets, several Claude agents argued over the best way in, and a separate Claude model inside the coding app Cursor directed the operation. Whenever Claude refused a job, the attackers passed it to a smaller model from China's Moonshot AI. The Information said it confirmed that sensitive data was stolen from at least one institution, and Anthropic said it cut off the group's access to Claude once Straiker told it what it had found.
Straiker's 400 is a count of targets rather than confirmed break-ins, and the firm hasn't said which institutions were involved. Still, it's one of the most detailed public accounts so far of a small criminal crew pointing AI at hundreds of banks at the same time.
Why the banks are nervous
Taken together, the two reports explain why bank executives are reaching for words like horrifying. Criminals spent the week using AI agents to probe financial companies by the hundreds, and now the banks have acknowledged they can't reliably tell a customer's agent from a stranger's. Any agent holding your password is one more way into your account, whether you meant to create it or not.
The convenience pitch has run into trouble more than once this week. In our story on Black October, we covered Meta's Muse exposing shared conversations that included a small-business loan application and a bank fraud alert. AI companies want access to people's email, calendars and bank logins, and the banks on the receiving end were never asked.
The banks will probably make room for agents at some point. Customers are asking for it, and executives told Axios they know they'll have to meet them partway. The likeliest outcome resembles the arrangement banks already have with Quicken, where an approved app gets its own limited access and never touches your password. Nothing like that exists for AI agents yet, so one sitting in your bank account today is there only because you put it there.
What to do now
If you've given an AI assistant your bank login, consider taking it back. Change the password, turn on two-step login, and keep in mind that sharing your credentials probably violates your bank's terms. If you want an agent helping with your finances, use read-only access where your bank offers it, and keep anything that can move money under your own control for the time being.
