AI Agents Are Reaching Bank Accounts: What Banks Have Observed, What Is Reported, and What Remains Unknown

Conceptual illustration of an external AI agent meeting an access-control checkpoint before a bank account. It does not depict a real incident.

US banks are reporting attempts by third-party AI agents to access customer accounts, sometimes using credentials supplied by the customers themselves. Financial institutions are blocking some of this activity, while reports raise questions about whether agents are acting beyond their users’ instructions. What has actually happened, and what remains unverified?

AI agents have reached a boundary that banks protect

AI agents are beginning to encounter a security boundary that banks have spent years protecting: access to customer financial accounts. On October 22, 2026, Axios reported that US financial institutions were detecting unvetted AI agents accessing customer accounts. Citing people familiar with the matter, Axios said some banks had tracked agents contacting call centres or appearing to take actions independent of their users’ instructions.

The report raised a troubling possibility. A customer might authorize an AI assistant to perform a limited task, such as reviewing transactions, but the software could attempt actions the customer did not intend. That does not necessarily mean the agent hacked into the bank. Axios said the situations generally involved customers supplying their own banking credentials, allowing the software to enter accounts on their behalf.

Reuters subsequently reported that banks were blocking third-party agents from accessing accounts and conducting transactions, citing two people familiar with the situation. Reuters attributed the claim that agents acted independently of user instructions to Axios, and a banking-industry source told Reuters that such transactions cannot be deemed unauthorized when customers have shared their credentials. Morgan Stanley, which Axios and Reuters said had begun blocking third-party agents, said it had not observed rogue AI agents on its platforms.

The reporting was significant, but the public record also reveals something important: banks had been discussing and restricting this type of access before the Axios investigation appeared.

JPMorgan and Schwab described restrictions before the Axios report

On October 13, JPMorgan Chase executives addressed the issue during the bank’s third-quarter earnings call. CEO Jamie Dimon discussed the risks of permitting unrestricted external AI agents into the bank’s systems. CFO Jeremy Barnum raised concerns about customers sharing login credentials with third-party software and about services that collect account information by navigating banking websites, a practice known as screen scraping.

According to the bank’s official earnings-call transcript, JPMorgan was blocking those access methods where possible. Barnum also said that if customers give their credentials to an agent and it does something they did not want, “that’s going to be on them”, and Dimon spoke of a “liability transfer” for customers who use such agents. These are statements of the bank’s position, not legal determinations. The discussion concerned the risks and responsibilities associated with agent access, and it did not disclose a specific completed incident involving an unauthorized financial transaction.

Charles Schwab offered a more direct account of observed activity. During its October 15 earnings and business update, CEO Rick Wurster said the firm was already blocking external agents attempting to log into its website on behalf of clients. He described receiving a daily report of blocked attempts, said the number was “not many”, and explained that Schwab wanted to retain control over authentication and the customer experience.

Wurster also distinguished these unapproved website logins from controlled AI integrations. Schwab was permitting certain LLM-based connections through approved interfaces while restricting those connections from moving customer money. In an October 16 Bloomberg interview, Wurster discussed the firm’s approach further, and Bloomberg’s summary of the interview says he discussed why the firm is blocking unauthorized AI agents.

These statements establish that at least some financial institutions were not merely anticipating a future problem. They were already responding to external AI-agent activity. But an attempt to access an account or initiate an action is not the same as a completed transaction, and a bank describing access as unauthorized does not necessarily establish that the customer did not request it. That distinction is central to understanding the story.

Customer-granted access differs from agent-action authorization

Customers have legitimate reasons to use software that helps manage their finances. An AI assistant might review transactions, categorize spending, compare financial products or prepare a budget. The difficulty begins when the method used to access the account gives the software more capability than the task requires.

Consider someone asking an AI assistant to analyze monthly spending. The customer may be comfortable allowing the assistant to read transaction records, but giving it the username and password used for normal online banking could expose account functions beyond reading information. From the bank’s perspective, a valid login may look like the customer accessing the service, and the institution may have limited visibility into whether an external AI agent is operating through the session or precisely what the customer instructed it to do.

There are therefore two separate questions.

Did the customer authorize the agent to access the account? And did the customer authorize the particular action the agent attempted?

An agent might have the customer’s permission to collect financial information but use an access method the bank does not approve. Alternatively, it might use valid credentials to attempt something beyond the customer’s instructions. These situations carry different security implications, and neither should automatically be described as a successful account compromise.

This is also not an entirely new problem, because banks have dealt with third-party credential sharing and screen scraping for years. What AI agents add is the possibility of software interpreting a broad instruction and independently deciding which steps to take. An agent asked to identify unnecessary expenses might decide to investigate a subscription, visit another service or attempt an action beyond simply preparing a report, and whether such behaviour is appropriate depends on what the customer authorized and what the connected systems permit.

That explains why banks are looking beyond the question of whether an account login is technically valid.

Banks are restricting access while exploring controlled integrations

The responses described by JPMorgan and Schwab suggest that banks want greater control over how external AI systems interact with customer accounts. Blocking unapproved automated access is one approach, particularly when software uses ordinary customer credentials rather than an approved connection. But restrictions alone do not resolve the broader question of how customers should be able to use AI assistants with their financial information.

Schwab’s Wurster described controlled integrations, through Schwab’s own MCP servers, that let clients connect their AI models for permitted activity, including a trading pilot with Anthropic’s Claude, while not allowing those connections to move money. Such an arrangement separates the activities a customer’s AI model may perform from permission to move money. This is an important distinction because an AI agent’s instruction to remain within a task is not the same as a financial system enforcing that limitation.

A bank can technically restrict an approved integration to specific operations. By contrast, when an agent operates through a customer’s ordinary authenticated session, the available functions may be broader. These mechanisms do not eliminate every risk, including misuse of sensitive account information, but they help explain why financial institutions are questioning unrestricted agent access while also exploring more controlled ways to support it.

The issue is not necessarily whether AI assistants should interact with banking systems at all. It is how the customer’s permission can be communicated, limited and enforced.

Public evidence does not show a completed unauthorized transaction

After reviewing the October reporting, the banking executives’ statements and the available supporting material, TechiesJournal can establish that US financial institutions have detected or restricted certain external AI-agent activities. There is also credible attributed reporting that some agents appeared to act beyond their users’ instructions.

However, as of October 25, 2026, the public evidence reviewed for this article does not establish a specific, independently verified case in which an AI agent successfully completed an unauthorized financial transaction against a customer’s instructions. The available reporting does not provide a complete individual incident record showing what a customer requested, what the agent attempted, what permissions it held and what the bank ultimately allowed or prevented. Nor does it establish a confirmed financial loss caused by the alleged activity.

These gaps matter, because they prevent us from describing the reports as evidence of a widespread autonomous-agent banking breach. They do not invalidate the operational activity that financial institutions have publicly described.

These reports describe an operational question, not a proven breach

The significance of the October reports is not that AI agents have been proven to compromise bank accounts independently. It is that financial institutions are already confronting the practical consequences of software acting on behalf of customers through systems originally designed around human account holders.

Banks need to determine whether an external agent is permitted to access an account, what actions it can perform and how that activity should be controlled. Agent providers need mechanisms that respect those boundaries, and customers need to understand the difference between allowing an assistant to review information and giving it broader access to their finances. These questions are becoming operational concerns rather than remaining abstract security discussions.

The strongest allegations about agents acting beyond customer instructions still require additional evidence. Future institutional disclosures, incident investigations or regulatory findings may clarify what actually occurred. Until then, the appropriate conclusion is narrower.

US banks have reported detecting and blocking external AI-agent activity. Whether specific agents crossed their customers’ authorization boundaries remains an important, unresolved question.

Go deeper

Research reviewed October 25, 2026. This article distinguishes publicly documented banking responses from attributed allegations and unresolved incident details. Future disclosures may change the assessment, so check the primary sources before acting.

Reporting and company statements

• Scoop: Unvetted AI agents are accessing U.S. bank accounts, Madison Mills, Axios, October 22, 2026, the original reporting about third-party agent access, institutional restrictions and allegations of actions beyond user instructions.
• US banks are blocking third-party AI agents access to customer accounts, sources say, Devika Nair, Arasu Kannagi Basil, Tatiana Bautzer and Nupur Anand, Reuters, October 22, 2026 (updated October 23), additional reporting on the financial institutions’ responses, customer-provided credentials and the limits of available corroboration.
• JPMorgan Chase Third-Quarter 2026 Earnings-Call Transcript, JPMorgan Chase, October 13, 2026, the primary corporate source. The executive discussion on PDF pages 3 to 4 and 10 (printed pages 2 to 3 and 9) covers external agents, credential sharing, screen scraping, restrictions and liability.
• Charles Schwab Third-Quarter 2026 Earnings-Call Transcript, October 15, 2026, Rick Wurster’s discussion of blocked external-agent logins, authentication controls and permitted AI integrations, on a transcript of the company’s earnings call hosted by The Motley Fool.
• Schwab CEO on AI Strategy, Investing Trends, and ‘Charley’, Bloomberg Television, October 16, 2026, a video interview whose page summary says it covers why Schwab is blocking unauthorized AI agents. The video itself was not reviewed.

Technical background

• Back to the Future: Why Agentic AI Needs a Strong Identity Foundation, Bill Fisher and Ryan Galluzzo, NIST, August 27, 2026, technical background about identity, delegation, credentials and authorization for AI agents.

This article separates attributed reports, company statements and the author’s analysis. Later disclosures should be rechecked before acting.

Related reading on TechiesJournal

• AI Agents Need Identities, Not API Keys, TechiesJournal, September 12, 2026, related background explaining how agent identity and delegated permissions differ from simply possessing valid credentials.