Unvetted AI agents inside US bank accounts: what JPMorgan, Wells Fargo and four other firms have said

On 22 October 2026, Axios reported that several of the largest US banks were detecting third-party AI agents operating inside customer accounts, and that some of those agents appeared to take actions beyond what their users had asked for. The same day, Reuters reported, citing people familiar with the matter, that major US lenders had been blocking third-party agents from operating inside customer accounts and making transactions.

The story did not come out of nowhere. In the ten days before it, the chief executives of JPMorgan Chase, Bank of America and Charles Schwab had each said in public that outside agents would not be allowed to move their customers' money. Within a day of the report, the OECD's AI incident monitor had logged the episode as an AI incident under robustness, digital security and privacy.

This post collects what each institution has said on the record, and separates it from what is still reported second-hand.

How the agents got in

No bank has described a technical breach. The access in every account of the story starts the same way: a customer gives an AI assistant their online banking username and password, and the assistant signs in as them. To the bank, the session looks like the customer. Every password check passes, because the password is correct.

That is why the problem is hard. As Andre Durand, the chief executive of Ping Identity, put it to USA TODAY, the challenge is “how can we detect that it is an agent and not a human asking.” He described the current moment as “a window of vulnerability where the systems, the banks, the users are all vulnerable.”

Bank by bank: what has been said

JPMorgan Chase

On the bank's third-quarter earnings call on 13 October, Jamie Dimon said, as reported by Fortune: “We're not going to allow just any outside agent to come inside the company.” He added: “You don't want rogue agents.” A spokesperson said the bank does not allow third-party agents that obtain customers' banking credentials, and that it supports customer-authorised data sharing through open-banking providers. The bank is also building its own agentic tools for clients.

Wells Fargo

A spokesperson told USA TODAY that the bank has “taken steps to block unauthorized agents from accessing customer accounts.” The more consequential change is contractual. Wells Fargo's updated online access agreement, effective 24 November 2026, adds a section on third-party AI agents. It says instructions an agent initiates are “deemed to have been initiated and authorized directly by you,” that use of an agent is “AT YOUR OWN RISK,” and that the bank may require customers to register agents or block them altogether. We read that section clause by clause in a separate post.

Bank of America

Brian Moynihan told Bloomberg on 15 October, as quoted by USA TODAY: “When you give the agent your credentials, it is you authorizing the payment.” The bank is restricting agents' access to consumer deposits and working with technology companies on agent protocols. Bank of America is also one of six banks behind a September paper on trusted agentic commerce, which we cover in a close reading.

Citi

Citi's statement to USA TODAY was the most direct: “We do not permit third-party AI agents or assistants to log into a customer's account.” Customers can still give read-only access to approved open-banking providers. Citi said it had not seen reports of agents accessing client accounts.

Morgan Stanley

Axios reported that Morgan Stanley had begun blocking third-party agents, but a spokesperson said the firm had not seen unauthorised or rogue agents on its systems. Read together, that suggests at least part of the industry's response is pre-emptive policy rather than reaction to a specific incident.

Charles Schwab

On Schwab's earnings call on 15 October, Rick Wurster called an agent logging in for a client “not safe” and said “We are not going to allow that,” American Banker reported. Schwab blocks agents that use client login credentials or browser automation. The next day, Wurster told Bloomberg Television that the firm stops big agents “in the tens and twenties” each week, and that it plans read-only access for outside AI tools so they can check balances and do research but not move money, according to TNW. His summary of the problem: “We can't control it, the client can't control it, something could go wrong and who's liable?”

Why now

Two things changed in September and October. First, consumer agents that can act on accounts arrived at scale. Meta launched its Muse assistant in September with a finances feature that connects to accounts through Plaid, Fortune noted, and USA TODAY reported that Muse reached 10 million users by 21 October. Second, security teams already had agents on their risk list: a 2026 Palo Alto Networks study cited by USA TODAY found that two-thirds of chief information security officers in financial services and software ranked agentic AI among their top three cybersecurity risks.

Customers are wary too. A Ping Identity consumer survey from October, also cited by USA TODAY, found that 22% of respondents refuse to trust AI with any financial transaction.

What is still unknown

• Scale. No bank has said how many accounts saw agent sessions, and none has published a loss figure.
• Which actions. The reports say some agents attempted transactions or contacted call centres. The specific actions have not been disclosed.
• Sourcing. The original reports rest on people familiar with the matter. Two of the six firms, Citi and Morgan Stanley, said they had not seen the behaviour themselves.
• Liability. Who pays when an agent the customer invited does something the customer did not intend is not settled. Bank terms, federal rules on unauthorised transfers and the agent providers' own terms all point in different directions.

What it means

Strip away the detail and every bank is answering the same two questions. Is a person at the controls of this session, or software? And if it is software, did the person approve this particular action? Passwords cannot answer either one, because the agent has the password.

For now, the industry's answer is to split “see” from “do”: let agents read through approved connectors, and keep money movement for the customer. We look at that split, and how long it can last, in Read-only is the new default.