Cybersecurity News Today: AI Agents Inside Bank Accounts, Holding Your Password
The lead story in cybersecurity news today is not a hack of a bank. It is a handover by the banks' own customers. On October 22, 2026, Axios reported that major US banks have detected unauthorized third-party AI agents operating inside customer accounts. The agents did not break in. They logged in with credentials the customers themselves supplied to agent services, and once inside, the banks say, they cannot reliably tell the agent's activity from the customer's own, or confirm whether the customer authorized a given action. The audit below scores the access you have handed out, because that access is the part of this story you control.
Honest scope, read this first: this page reports the Axios story as reported, and parts of it are contested. Reuters could not initially verify the Axios detection report, but it has since confirmed with its own sources that the banks are blocking these agents; the detection claims themselves remain partly unverified.Morgan Stanley told Axios it has NOT observed rogue agents on its platforms, a denial on the record from one of the banks named. And nothing in the reporting establishes that customer funds were stolen or that accounts were widely compromised; what is described is agents logging in with user-supplied credentials and banks racing to contain them, not a breach of the banks themselves. What is not contested is the reader's side of it: people are handing real banking passwords to AI agent services today, and a shared password cannot be scoped, cannot be revoked for one agent only, and cannot be told apart from its owner. That problem is real no matter how the Axios story resolves.
Update, October 22, 2026: Reuters confirms the banks are blocking the agents
Later the same day, Reuters published its own version of this story, built on its own sources rather than the Axios report. Two people familiar with the situation told Reuters that major US banks have been blocking third-party AI agents from operating inside customer accounts and making transactions. The story has moved past detection: the banks are actively shutting these agents out.
Reuters also carried the legal point that makes credential sharing so costly. In some cases, customers have shared their login ID and password with agents. Banks typically flag and block those transactions, but a person in the banking industry told Reuters that such a transaction cannot be deemed unauthorized if the customer shared the credentials. In plain terms: hand an agent your password and the bank may treat whatever it does as something you did. That is the exact risk the audit on this page scores.
Morgan Stanley's position is now on the record with Reuters as well. A person familiar with the matter said the bank has blocked third-party agents from accessing its platforms, but had not seen any instances of unauthorized or rogue AI agents. The denial stands, and Reuters is carrying it too. JPMorgan's Jamie Dimon put his bank's position in one line: "We're not going to allow just any outside agent to come in inside the company because that's just too risky for clients and for JPMorgan." PYMNTS notes that JPMorgan, Citi, Bank of America and Schwab still allow agents read-only functions such as balance checks while blocking transactions.
The story, exactly as reported
The detection: Axios reported on October 22, citing people familiar with the matter, that major US banks are detecting third-party AI agents inside customer accounts, and that some agents attempted actions appearing independent of the user's instructions. Agents reportedly contacted bank call centers as part of their activity.
The banks named: Morgan Stanley, Bank of America, JPMorgan and Wells Fargo in the main coverage; PYMNTS adds Citigroup and Charles Schwab.
How the agents got in: with login credentials the users themselves gave the agent services. Banks note that logging in as the customer still violates most banks' rules that accounts are for the human account holder.
The core problem, in the banks' own framing: once an agent is logged in as you, the bank cannot reliably distinguish its activity from yours, and cannot confirm whether you authorized a specific action it takes.
The response on record: many banks are limiting agents to read-only access: view balances and transactions, no moving money and no buying stocks.
Schwab: CEO Rick Wurster says Charles Schwab blocks unauthorized agents a double-digit number of times every week.
JPMorgan: Jamie Dimon says outside agents will not get inside JPMorgan, and has warned of thousands of rogue agents operating across the industry. A Chase spokesperson put the customer rule plainly: never give your username or password to anyone, including AI agents.
Bank of America: CEO Brian Moynihan's position is a human in the loop: a person approves money leaving the account. Citi: third-party agents may not log in or transact at all.
The counterpoints: Morgan Stanley told Axios it has not observed rogue agents on its platforms. U.S. Bancorp's Kedia said on October 15 that the bank had not encountered cash-sorting agents. Reuters could not immediately verify the report.
6major US banks named across the coverage: Morgan Stanley, Bank of America, JPMorgan, Wells Fargo, Citigroup, Charles Schwab
Double-digittimes per week Charles Schwab blocks unauthorized agents, per CEO Rick Wurster
Read-onlythe access level many banks are now limiting agents to: balances yes, moving money no
US$0in customer funds the reporting establishes as stolen. The confirmed problem is uncontrolled access, not a confirmed theft
WION's broadcast coverage the same day added the industry's other worry: banks are preparing emergency plans to secure or restore customer accounts quickly if an agent incident goes wrong. Read that for what it is. The institutions are not scrambling because money has been shown to be gone. They are scrambling because they have found a class of account activity they cannot attribute, cannot scope and cannot switch off cleanly, inside accounts that hold people's savings. Put a number on the confirmed harm and it stands at $0 in established stolen funds, which is precisely why the access itself is the story.
Why this cybersecurity news today matters: your password is not a permission system
A bank password was designed for one job: prove that the person logging in is you. Hand it to an AI agent service and it silently takes on three more jobs it cannot do. It cannot scope: the agent that holds it can do everything you can do, including move money, unless the bank separately limits it. It cannot attribute: every action the agent takes is recorded as your action, which is why the banks in this story cannot tell the agent from the customer. And it cannot revoke one holder: the password exists in copies you cannot see, in the service's systems, and the only way to cut off one agent is to change the password and cut off everyone, including yourself, at once. The banks' fixes all point the same way, toward scoped connections, read-only limits, approval steps and kill switches. Those controls exist today for business agent deployments. The audit below applies the same questions to the access you have already granted.
Audit your agent access: did you hand an AI your bank login?
Answer for the widest access you have granted to any one service or person. If you have handed access to more than one, run the audit once per grant and act on the worst score. Everything runs in your browser; nothing is sent anywhere.
Cut an agent's access to your bank account: the order matters
Inventory first: list every service and person that can reach the account: AI agents, budgeting and accounting apps, aggregators, assistants, family. Most people find at least one grant they forgot. Forgotten grants are the ones nobody watches.
Change the password before you revoke anything else: revoking inside one app's dashboard does nothing about copies of your password held elsewhere. One password change kills every shared copy at once, including the ones you do not know about. It is the only true kill switch a shared password has.
Reconnect only through the bank's official connection: use the linked-account or OAuth flow that starts inside your bank's own app or website. You approve a scoped token, and the bank records which service is acting. If a service only offers "enter your bank password here," that is the service telling you it has no scoped way in. Believe it.
Drop anything that can move money to read-only: balances and transaction history are what budgeting tools and most agents actually need. If a service cannot operate read-only, remove it rather than upgrade its access.
Revoke in both places: the connected-apps or linked-services list inside your bank's settings, and the service's own dashboard. Then confirm with a sign-in and activity review that nothing unknown remains connected.
Turn on alerts and read them: an alert for every transfer out, a daily balance summary, and a monthly scan of the connected-services list. Detection you have is worth more than access rules you meant to set.
For a business account, add the approval step: Bank of America's stated position is a human in the loop before money leaves. Apply it to your own agents: no agent moves money without a person approving that specific payment, and a per-agent allowlist limits which accounts and payees it can touch at all.
Agent Auth Gateway, Ingenious AI's authorization layer for AI agents, is built around the controls the banks in this story are scrambling to retrofit: each agent gets a scoped credential instead of a master password, an allowlist bounds which systems and actions it can reach, an approval queue puts a human in front of high-impact actions like moving money, and a kill switch revokes one agent in one step without disturbing the rest. See how Agent Auth Gateway works.
FROM INGENIOUS AI
Agent Auth Gateway is built for exactly this: scoped agent credentials, allowlists, approval queues for money movement, and a kill switch that revokes one agent at a time.
1. Per the Axios report, how did the AI agents get into customer accounts?
2. What do banks say they cannot reliably do once an agent is logged in as a customer?
3. What does Schwab's CEO say the bank does every week?
4. What is the honest status of the Axios report itself?
5. What is the single fastest way to cut off every agent holding your bank password?
Frequently asked questions
What is the bank AI agent problem, in plain terms?
The bank AI agent problem is what happens when people hand AI agent services their real bank username and password. The agent logs in as the customer, so the bank cannot tell the agent from the owner, cannot limit what the agent does to viewing only, and cannot revoke the agent's access without cutting the customer's too. The password was never built to be a permission system.
Did an AI agent steal money from bank customers?
Nothing in the reporting establishes that. Axios reported on October 22, 2026 that banks detected agents inside customer accounts and that some agents attempted actions appearing independent of user instructions. Reuters said it could not immediately verify the report, and WION noted the detections do not establish stolen funds or widespread compromise. The confirmed problem is uncontrolled access, not a confirmed theft.
Which banks are named, and what are they doing about agents?
Coverage names Morgan Stanley, Bank of America, JPMorgan and Wells Fargo, and PYMNTS adds Citigroup and Charles Schwab. Many banks are limiting agents to read-only access. Schwab's CEO says it blocks unauthorized agents a double-digit number of times weekly, Citi bars third-party agent login and transacting, and JPMorgan's Jamie Dimon says outside agents will not get inside. Morgan Stanley says it has not observed rogue agents.
I already gave an agent service my bank login. What do I do first?
Change your bank password first. Every copy of the old password held by any service stops working at once, which makes it the one revoke that always works. Then reconnect only through the bank's official linked-account connection, set the service to read-only if it offers that, and turn on an alert for every transfer out of the account.
Is the bank's official connection safer than sharing my password?
Yes, in specific ways. An official connection gives the service a scoped token instead of your password: the bank can see which service is acting, limit it to viewing, and revoke that one service without touching your login. A shared password or a screen-scraping login gives the service your full identity, and the bank sees its actions as yours.
Sources: Axios, October 22, 2026 (the original report: banks detecting third-party AI agents inside customer accounts, agents acting on user-supplied credentials, the read-only limits, and statements attributed to Dimon, Moynihan, Wurster, the Chase spokesperson and Citi) · Reuters, October 22, 2026 (the report's summary and the note that Reuters could not immediately verify it) · PYMNTS, October 22, 2026 (Citigroup and Charles Schwab among the banks named) · Gizmodo and Engadget, October 22, 2026 (coverage of the Axios report and the banks' responses) · WION broadcast, October 22, 2026 (the emergency-planning angle and the note that the detections do not establish stolen funds).
Related checks
ARTEX Agent App-Credential Check: the enterprise side of the same problem, where stolen app credentials walked agents into customer tenants
Google Workspace MCP OAuth Deadline Check: from November 11, 2026, Workspace MCP servers reject OAuth clients not marked as agentic, and the flag locks on November 12