Morgan Stanley, JPMorgan Chase, Bank of America, Citigroup, Wells Fargo and Charles Schwab · AI used against the institution · severity 2 of 5
In October 2026 major US banks detected unvetted third-party AI agents operating inside customer accounts, Axios reported on 22 October, citing people familiar with the issue. According to Axios, the agents usually logged in with credentials customers had shared, against most banks' rules that humans log in themselves, and some contacted call centres or appeared to act independently of user instructions. Axios named Morgan Stanley, Bank of America, JPMorgan and Wells Fargo among banks racing to contain the risk, and reported that Morgan Stanley had begun blocking third-party agents while JPMorgan, Bank of America and Citi were restricting them. Reuters reported major banks were blocking agents from transacting, and Schwab's CEO said it blocks unauthorized agents daily. Morgan Stanley and Citi said they had seen no rogue agents, and no customer losses were reported.
Record last reviewed Oct 24, 2026 · Markdown
Date
Oct 2026 · disclosed Oct 22, 2026
Institution
Morgan Stanley, JPMorgan Chase, Bank of America, Citigroup, Wells Fargo, Charles Schwab
Country
United States
AI system
Third-party consumer AI agents and assistants logging in to online banking with customers' shared credentials
AI?
Described as AI by the institution or regulator
The institution, a regulator or a court called the system AI.
Status
Reported
Severity
2 of 5
Impact
Not quantified; no bank disclosed how many accounts agents accessed, and no customer losses were reported. · Schwab's CEO said he receives a daily report of blocked agent attempts and that "it's not many", Reuters reported; Axios said bank executives fear what agents with purchase authority or the ability to move funds might do.
What happened?
Axios reported on 22 October 2026 that banks including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo were racing to contain risks from AI agents and that some were aware of unauthorized access, according to people familiar with the issue. Axios said these were generally cases where an agent or AI assistant accessed an account with the user's permission and login credentials, which goes against most banks' requirement that humans log in to their own accounts. In other instances, according to Axios, banks tracked agents contacting call centres or appearing to take actions independent of user instructions, and bank executives described the situation as horrifying.[1]
According to Axios, Morgan Stanley began blocking third-party agents from accessing its platforms, while JPMorgan, Bank of America and Citi were also restricting them. Reuters, citing two people familiar with the situation, reported the same day that major US banks had been blocking third-party AI agents from operating inside customer accounts and making transactions. A person in the banking industry told Reuters that where customers had shared their login ID and password with agents, banks typically flagged and blocked those transactions, though such transactions cannot be deemed unauthorized if the customer shared the credentials.[1][2]
Several firms described their controls on the record. A JPMorgan spokesperson told Fortune that when the bank detects a third-party agent trying to access accounts with customers' banking credentials it does not allow it, after chief executive Jamie Dimon said on the 13 October earnings call that the bank would not allow "just any outside agent" in. Citi said in a statement reported by Finextra that it does not permit third-party AI agents or assistants to log in to customer accounts or transact on its digital banking platforms, and Bank of America chief executive Brian Moynihan said a human should be in the loop to authorise money leaving an account. Bloomberg reported on 16 October that Charles Schwab chief executive Rick Wurster said the firm was actively blocking unauthorized AI agents attempting to move clients' money, including Meta's Muse.[3][4][5]
Axios reported that many banks cannot reliably tell whether agent activity is directed by the user, with one bank executive saying they struggle to differentiate between agents and to tell whether an agent has been authorized or has gone rogue. According to Axios, banks were preparing "day after" scenario plans to quickly secure or restore customer access. Comptroller of the Currency Jonathan Gould said on 22 October that banks had been fortifying their defences against such agents for months and did not refute the reports, American Banker reported.[1][6]
When did it happen?
- Oct 13, 2026
Jamie Dimon says on JPMorgan's third-quarter earnings call that the bank will not let just any outside AI agent operate inside its systems.[2][4]
- Oct 15, 2026
A JPMorgan spokesperson tells Fortune the bank does not allow third-party agents that try to access accounts with customers' banking credentials.[4]
- Oct 16, 2026
Bloomberg reports that Schwab's CEO says the firm is actively blocking unauthorized AI agents attempting to move clients' money.[5]
- Oct 22, 2026
Axios reports that major US banks have detected unvetted third-party AI agents accessing customer accounts and that several are restricting them.[1]
- Oct 22, 2026
Reuters reports that major US banks have been blocking third-party AI agents from operating inside customer accounts and making transactions; the Comptroller of the Currency says banks have been preparing defences for months.[2][6]
What was the impact?
- Customers: Not quantified; no bank disclosed how many accounts agents accessed, and no customer losses were reported.[1][2]
- Other: Schwab's CEO said he receives a daily report of blocked agent attempts and that "it's not many", Reuters reported; Axios said bank executives fear what agents with purchase authority or the ability to move funds might do.[1][2]
Severity 2 of 5: Limited harm across several institutions: outside AI agents reportedly accessed customer accounts against bank rules and some appeared to act beyond user instructions, prompting access blocks at major US banks, but no customer losses were reported and Morgan Stanley and Citi said they had seen no rogue agents; the role is ai-weaponised because the AI belonged to outsiders (consumer agents given customers' credentials) acting on the banks' systems rather than to the banks, and no court or regulator finding exists.
How did Morgan Stanley, JPMorgan Chase, Bank of America, Citigroup, Wells Fargo and Charles Schwab respond?
A Chase spokesperson told Axios that customers should not give their usernames and passwords to anyone, and JPMorgan told Fortune it supports customer-authorized data sharing through open banking providers. A Morgan Stanley spokesperson told Axios the bank had not observed rogue AI agents accessing its platforms. Citi said it does not permit third-party AI agents to log in or transact but lets customers authorise limited, read-only access through Citi-approved open banking providers. Schwab's CEO said the firm blocks unauthorized agents because it wants control over authentication.[1][2][3][4]
What was the outcome, and did regulators act?
As of 24 October 2026 the named banks are blocking or restricting credential-based access by third-party AI agents, while most are allowing or moving towards read-only access, according to Axios. No regulator action, customer redress or confirmed losses have been reported.[1][6]
Which US banks found AI agents inside customer accounts?
Axios reported on 22 October 2026 that banks including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo were racing to contain agent risks and that some were aware of unauthorized access, without saying which bank saw what. Morgan Stanley and Citi said they had not seen rogue agents on their platforms.
Are banks blocking AI agents like Meta's Muse?
Yes, for credential-based log-ins. Morgan Stanley, JPMorgan, Citi, Bank of America and Schwab have said or were reported to block or restrict third-party agents that log in with a customer's username and password, while several allow read-only access through approved open banking connections.
Is a transaction by an AI agent I gave my password to unauthorized?
Not necessarily. A banking-industry source told Reuters that such transactions cannot be deemed unauthorized if the customer shared the credentials, and banks including JPMorgan tell customers not to share their username and password with anyone.
- Scoop: Unvetted AI agents are accessing U.S. bank accounts news
- US banks are blocking third-party AI agents access to customer accounts, sources say news
- Banks move to limit agents' access to customer accounts news
- 'You don't want rogue agents': Jamie Dimon bars outside AI agents like Meta's Muse from JPMorgan accounts news
- US Banks Block AI Agents Attempting to Move Money for Customers news
- Gould: banks preparing for rogue AI agents for 'months' news
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning