US Banks Fear Rogue AI Agents Inside Customer Accounts
Would you give an AI assistant your banking password to check your balance? Or to make a transfer? Apparently, several users are doing this.
Major US banks are detecting unauthorized AI agents operating inside customer accounts, according to Axios. In some cases, the agents even contacted bank call centers.
JPMorgan, Bank of America, Wells Fargo and Morgan Stanley are among the institutions responding.
Axios did not document any confirmed bank-account losses. However, crypto has already shown how costly manipulated AI payments can become.
BeInCrypto’s State of AI Agent Payments 2026 documented two incidents in which attackers caused AI-linked systems to send $281,200 to their wallets before recoveries.
In March 2025, an attacker accessed AIXBT’s dashboard and triggered a $106,200 crypto transfer. Two months later, a malicious message processed through Grok led Bankr to transfer $175,000 in tokens. Bankr later reported recovering 80% of those funds.
Both incidents happened in crypto. They exposed the dangers of giving software access to real money without sufficient safeguards.
If an AI Moves Your Money, Who Is Responsible?
JPMorgan CFO Jeremy Barnum offered a warning during the bank’s October 13 earnings call.
Customers who share login credentials with agents that take unwanted actions should understand, he said, “that’s going to be on them.”
However, US Regulation limits consumer liability for qualifying unauthorized electronic transfers. It also allows liability when someone voluntarily authorized to transfer money exceeds that permission.
How those rules apply to autonomous AI agents remains uncertain. The distinction could determine whether a customer receives a refund.
Why America’s Biggest Banks Are Blocking AI Agents
BeInCrypto’s research found that 14 of 19 reviewed AI products and financial workflows could act within limits approved by humans. Five of seven reviewed trading venues explicitly prohibited agents from withdrawing funds.
Banks are introducing similar restrictions.
Morgan Stanley has reportedly begun blocking third-party agents, while JPMorgan, Bank of America and Citi are restricting access. Morgan Stanley says it has not observed rogue agents on its platforms.
Some banks are moving toward read-only access, allowing agents to check financial information without moving money.
AI agents that chase better rates for idle deposits could wipe roughly $500bn of equity value off US banks.
— Linus ✦ Ekenstam (@LinusEkenstam) October 22, 2026
What we are seeing now tho is potentially unauthorized actions, but could also be agents who have been given unlimited access to act on the owners behalf.
Jensen Huang… https://t.co/VVvtWoyH4p
Customers may eventually expect AI to handle their finances. For now, the unresolved question is who bears the loss when software acts beyond its instructions.