Some US banks say AI agents are logging into customer accounts with the customer's own credentials

Some of the largest US banks say AI agents are logging into customer accounts using the customers' own usernames and passwords, and that they often cannot tell whether a given action was really approved by the account holder. The issue surfaced in an Axios report on October 22 and has since been picked up across the financial and tech press.

According to that reporting, Morgan Stanley, JPMorgan Chase, Bank of America, Wells Fargo and Citi are all taking steps to limit third party agents. Sources told Axios that some agents attempted actions that appeared to go beyond what the user had asked for, including contacting bank call centers on a customer's behalf without being told to. Reuters said it could not independently verify the specific incidents, and Morgan Stanley said it had not seen rogue AI agents accessing its platforms.

The core problem is authentication. A bank can confirm which credentials were used to sign in, but not whether the activity behind them is a person, an agent the customer sent, or an agent interpreting a task in a way the customer never intended. Even with the customer's consent, handing a login to software breaks most banks' terms of service. JPMorgan has moved to block outside agents, and CEO Jamie Dimon said the bank will not let "just any outside agent" in because it is too risky for clients. Bank of America, Citi and Charles Schwab have restricted automated access or transactions.

The timing follows a surge in consumer agents. Gizmodo noted that Meta's Muse agent passed ten million US downloads in its first forty days, and that OpenAI and Anthropic have launched always-on agents of their own. Later reports say Morgan Stanley, JPMorgan and Bank of America are also drawing up recovery plans for a major AI related incident, though they say they have found no evidence that uncontrolled agents have affected customer funds.

Why it matters for builders: if your product acts for users inside banks, brokerages or any site with a login, credential sharing is turning into a dead end. Expect more blocking, read-only access and contract terms that put the liability on the user. The durable path is delegated, scoped access that the institution can see and revoke, rather than an agent replaying a password.

What's next: watch for banks publishing official agent access programs or APIs, for regulators weighing in on who is liable when an agent moves money, and for agent makers adding clearer consent and audit trails.

Building with AI? See this week's hot AI repos and how to use each one.