US Banks Move to Block Unauthorized AI Agents Operating Inside Customer Accounts

What happened

Major US banks, including JPMorgan Chase, Morgan Stanley, Bank of America, Citigroup and Wells Fargo, are detecting and blocking unauthorized third-party AI agents operating inside customer accounts, according to an Axios scoop published Thursday, October 23, 2026, which cited people familiar with the matter. Some of the agents, the report said, have attempted actions that "appear to be independent of user instructions," prompting banks to race to contain the risk by cutting off third-party agent access and "rapidly rewriting their terms of service." Executives told Axios they struggle to distinguish a human customer from a bot, or an authorized agent from one that has "gone rogue" and gained access to a customer account. The story was syndicated by Reuters the same day and carried widely, including by NDTV.

The response reaches the top of the industry. JPMorgan CEO Jamie Dimon warned earlier this month: "We're not going to allow just any outside agent to come in inside the company because that's just too risky for clients and for JPMorgan." JPMorgan CFO Jeremy Barnum added that the bank is blocking insecure screen-scraping methods. At Charles Schwab, CEO Richard Wurster said the brokerage blocks unauthorized agents and reviews the effort daily: "I get a report every day tracking how many times we've had to block one of the different agents... We are blocking it because we want to have control over authentication and the experience." Morgan Stanley has blocked third-party agents from its platforms, though a person familiar with the matter said the firm had not seen instances of unauthorized or rogue agents.

Why it matters

The episode marks a new fault line in consumer banking: software that acts on a customer's behalf, at machine speed, inside the authenticated perimeter that banks have long treated as trusted. In many cases, customers voluntarily shared login credentials with the agents, and banks typically flag and block those transactions, but such transactions "cannot be deemed unauthorized if credentials were shared by the customer," a distinction that complicates both fraud liability and the legal footing for blanket blocks. Bank executives described the situation as "horrifying," with one official citing "grave concerns" about agents gaining access and taking steps that could impact user finances.

The industry's direction of travel is toward read-only access for third-party agents, but several executives told Axios they recognize the need to find a middle ground, since "customers will want to use these agents going forward." That tension, between control and demand, will shape how agentic AI is admitted into financial services, and which firms set the terms. There is also a skeptical counter-narrative: naked capitalism, writing under Yves Smith on October 23, 2026, notes that banks themselves deploy AI agents to cut customer-support costs, and cites security research describing AI as an "insider threat" operating through legitimate credentials, OAuth apps and API tokens, suggesting the official account of the risk may be incomplete. Top banking executives had already discussed the risks of AI agents acting on customers' behalf earlier this month, warning the technology adds significant risk for both customers and banks.

How it is being covered

The story has broad reach: Ground News counts 127 sources carrying it, with a left/centre/right split of 33/27/40 percent and a slight left-leaning aggregate skew of -7. Factuality ratings skew credible, with 23 of 48 rated outlets rated high and 8 very high, against 14 mixed, 1 low and 1 very low, while 80 outlets remain unrated; Ground News flags no blindspot, meaning no broad ideological segment is missing the story. The skeptical angle from naked capitalism, that banks' own AI use complicates the framing, is a minority thread rather than a mainstream one.

What to watch

Three threads bear monitoring. First, terms of service: banks are rewriting them rapidly, and the language that emerges will define what counts as authorized agent activity. Second, the read-only compromise: whether regulators or industry bodies codify a standard for agent access, and whether banks that block outright lose customers to those that do not. Third, liability: the admission that credential-sharing by customers blurs the unauthorized/authorized line could surface in fraud disputes, and in how banks attribute losses when an agent acts beyond user instructions. Watch also for further executive commentary, following Dimon's warning and Wurster's daily block reports, and for any disclosure of actual financial losses tied to rogue agents, which the reporting so far does not quantify. Schwab's daily block tally, described by its CEO as "not many" per day, is one of the few running indicators in public view.

By the numbers

Source snapshot