Banks Are Finding AI Agents in Customer Accounts. Here's What's Real — and Why You Need a Third Party Watching
On October 22, 2026, a banking story moved faster than the facts inside it. Axios reporter Madison Mills published a scoop: major U.S. banks were finding third-party AI agents inside customer accounts, and some of that activity looked as if it had run past what the customer asked for. Within hours, a senator was calling to pause AI, a governor was picturing liquidated portfolios, and the bank names were moving across trading timelines.
The concern is real. Handing a bank password to a piece of software is a bad idea, and a few of the cases banks described are genuinely unsettling. The picture that traveled on social media was larger than the reporting. Most of what the banks are seeing is a customer sharing their own login. That breaks the bank's rules. It is not the same event as a rogue agent breaking in.
This is the day as it happened, what holds up, and the boring arrangement that lets an assistant look at your money without ever holding your bank password. Eyes, not hands.
What Axios actually reported
The article behind Mills's post named the institutions in the middle of this: Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo among the banks racing to contain agent risk. Morgan Stanley, the story said, had begun blocking third-party agents from its platforms. JPMorgan, Bank of America, and Citi were restricting them. Executives described the situation as "horrifying." Banks were rewriting terms of service and running "day after" plans for how they would lock or restore customer access if a bad case landed.
Read one paragraph further and the shape of the incidents changes. Axios reported that these are generally situations in which an agent or assistant gets into an account with the user's permission and the user's login. Even with that permission, the practice cuts against bank rules that require a human to log in to their own account. A Chase spokesperson told Axios that customers should not give their usernames and passwords to anyone. A Morgan Stanley spokesperson said the bank had not observed "rogue AI agents accessing our platforms."
There is a second, smaller set of cases, and it is the one that justifies the alarm. Axios reported that some banks had tracked agents contacting call centers, or appearing to take actions independent of the instructions a user had given. Banking executives are afraid of what an agent can do once it has a login, especially if someone has also granted it the ability to buy things or move funds.
The industry's near-term answer, again per Axios, is read-only access: let an agent see account information and withhold the ability to act. Banks already do a version of this for budgeting tools such as Quicken. Executives told Axios they know customers will want agents. They also said the risk of being too open, right now, is too high.
How the day sounded on X
The reporting and the reaction split within a few hours. These are the posts worth reading, in the order the argument actually moved. Short quotes, then the links.
David Sacks drew the line the headline had blurred. "There's a world of difference between user-authorized agents (Muse, Instinct, Grokbot, etc.) and true unauthorized/rogue agents that could constitute cyberattacks." Most of the Axios activity, he wrote, appears to be customers sharing credentials so an agent could act for them. That may violate terms that require a human to log in, "but these are in no way cyberattacks." He argued banks should support user-directed agents, pointed at American Express as an authorized connection inside Muse, and called read-only permissions "a sensible interim step." Full write access with the user's own credentials, he said, is a different risk. Blurring authorized agents and cyberattacks, in his words, is "irresponsible."
Sen. Bernie Sanders answered the same Mills post at the emotional peak of the day: "This is insane. We cannot allow AI agents to go into your bank account and act independently without your authorization. But that is what's happening right now." He closed with "Pause AI NOW!" The fear in that post is easy to share. The sentence "that is what's happening right now" treats the credential-sharing cases and the independent-looking cases as one event. They are not.
Chamath Palihapitiya skipped the panic and described the sequence banks are already in. "The first thing to change will be terms of service and blocking these agents. Not because the value is low but because the risk is high." Self-preservation first, he wrote, and after that a security and governance architecture that external auditors can accept. Model capability does not settle that. Human risk tolerance does.
Gov. Ron DeSantis asked readers to imagine "a rogue AI agent liquidating your bank account and investment portfolio," and then a failure of recourse if that happened at scale. Gary Marcus took the same precautionary side. Agreeing that banks should keep unproven agents out, he wrote that "agents should be taken off the market until they can be made safe."
Puneet Mehta published the most useful technical frame of the afternoon, under the title "Banks Built Controls for People. AI Agents Are Walking Right Through Them." "Banks are finding AI agents inside customer accounts they never approved," he wrote, and then: "Banks built controls for people. Agents are walking right through them." A follow-up added the part worth keeping: "Banks aren't wrong to block agents. But blocking can't be the last move." Controls written for a person at a keyboard assume human speed. They do not describe software that can repeat a task for as long as it is allowed to run. Blocking and read-only are the first response. The lasting one is an agent with its own credentials, and permission a person can see and take back.
Walter Bloomberg, posting as @DeItaone, carried the story onto market timelines in wire style: "MAJOR U.S. BANKS DETECT UNAUTHORIZED AI AGENTS ACCESSING CUSTOMER ACCOUNTS — AXIOS," naming JPMorgan, Bank of America, Morgan Stanley, and Wells Fargo. That is how a sourced report becomes a ticker. The headline did the traveling. The credential paragraph did not.
Old Glory Bank gave the practical warning customers actually needed: "Your financial security should never be outsourced. Not to a stranger. Not to an app. Not to an AI agent. The second you give your bank credentials to someone — or something — else, you've given up the security of your money."
What is real, and what the panic added
Start with the terms of service, because that is the rule the customer is breaking. Bank agreements require the human who owns the account to be the one who logs in. Pasting a username and password into ChatGPT, a browser agent, or a "just log in for me" tool violates that rule even when you meant to allow it. Chase's public line is the plain version: do not give those credentials to anyone.
A password login is the customer's login. The session belongs to the person who owns the secret. After the fact, the bank is looking at activity under that customer's identity, and a shared password does not carry a second name for the software. That is the confusion Axios's sources described: trouble separating a human from an agent, and trouble separating an agent the customer pointed at the account from one that wandered off the instruction. It is a permissions problem created by using the customer's secret as if it were an agent identity.
It is not a claim that banks are blind. Traffic from cloud and datacenter IP addresses is a long-standing sign of automation. Banks see that, and a lot of the blocking this month is a blunt cut against exactly that kind of access. A program running in someone else's data center often looks like a program. A person on a home network, typing their own password, looks like that person. When the agent uses the customer's password, those two facts collapse into one session, and the bank is left deciding whether to block the pattern outright.
Reuters, in a wire story carried by Investing.com that followed the Axios story the same day, added the consequence that matters if money actually moves. Where the customer shared the login, a person in the banking industry told Reuters, banks typically flag and block the transactions. Those transactions still often cannot be deemed unauthorized, because the credentials came from the customer. "Unauthorized" is a legal word. "I didn't like what the agent did with the password I gave it" is a different dispute, and a harder one to win back from the bank. Reuters also noted that Jamie Dimon and Charles Schwab's Rick Wurster had already, earlier in the month, described blocking outside agents and keeping control of authentication. Morgan Stanley's spokesperson told Axios the same day that the bank had not seen rogue agents on its platforms.
So the honest inventory is three piles, not one nightmare:
- Most of the reported cases. A customer gave an agent the bank login. That violates the bank's terms. The agent may be doing what the customer asked. The bank still does not have a clean way to treat that session as a delegated, limited actor.
- A smaller set. Agents contacting call centers, or appearing to act past the instruction. Those are the cases worth the word "horrifying." They are not evidence that every connected assistant is roaming accounts on its own.
- The response. Rewrite the terms, block third-party agents that show up with a customer's password, and move serious access toward read-only connections the bank has actually authorized. Quicken-style access is the middle ground Axios described. It is also the only middle ground that does not require you to trust a model with a transfer button.
Why the agent should talk to a third party
An agent that is interested in your accounts needs a door that was built for software. Your bank login is not that door. The password is you. Anything that types it is you, as far as the bank's controls are concerned, until the bank decides the whole pattern looks like a bot and shuts it off.
FYN sits in between. On FYN Pro you link a bank once, through Plaid. The sign-in happens in Plaid's connection, and FYN never sees or stores the bank password. From then on, an assistant that wants your balances, spending, budgets, or receipts connects to FYN, over MCP, with OAuth, as a read-only client you approved. It does not connect to the bank. It does not receive the bank password. It cannot initiate a transfer, pay a bill, or move money. There is no write path on that connection.
You can revoke the connection from FYN. When you do, later calls fail. You can also see who has been looking. Agent activity is the record of connected apps and what they asked for: balances, transactions, budgets, subscriptions, receipts. The point of that screen is ordinary and specific. If something is interested in your money, you should be able to name it, and you should be able to turn it off without calling a bank and hoping the password reset is enough.
The setup for the assistants people already use is the same one in Connect your money to ChatGPT, Claude, or any AI agent. The protocol details, including the read-only scope and how revocation works, are in the MCP reference.
What to hand an agent instead
If an assistant needs a picture of your accounts, give it one of two things.
- A file you exported yourself. A statement you downloaded from the bank, or a CSV of your own transactions. On FYN Pro, that export is your categorized history, not a live session. A file can be stale. It also cannot log in as you tomorrow.
- A read-only connection you can see and revoke. Scoped access, in your name, to a service that already holds the bank link. For FYN, that is the MCP connection above. The agent asks questions. FYN answers from your data. The bank password stays with the bank login, which you used once, with Plaid.
The thing you do not hand over is the bank username and password. Not to a stranger, not to an app that asks you to paste it into a prompt, not to an agent that offers to "just sign in." Old Glory Bank is right about that sentence. Sacks is right that read-only is the sensible interim. Chamath is right that blocking is what institutions do first, and that someone still has to build the governed door. Mehta is right that the door has to assume software, not a person clicking slowly.
Banks will keep tightening this. Some of that tightening is overdue. Customers are still going to ask their assistants about rent, groceries, and whether a purchase fits. The safe version of that question is an agent with eyes on a copy of your finances, and no hands on the account. That is the product we are building.