Rogue AI agents are already inside US bank accounts, Axios reports
What's the deal? Major US banks are detecting unauthorised third-party AI agents operating inside customer accounts, with some agents reportedly attempting to take actions that appear independent of user instructions, Axios reported on 22 October, citing people familiar with the matter. Banks including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are racing to contain the risk.
What's happening? Morgan Stanley has begun blocking third-party agents from accessing its platforms, according to sources familiar with the decision. Banks say agents are sometimes logging into customer accounts using the user's own permission and credentials — a practice that goes against most banks' guidelines, which require humans to log in to their own accounts directly.
Why it matters: If an AI agent moves money or takes an action a customer didn't authorise, it isn't clear who is liable — the bank, the agent's developer, or the customer who granted it access in the first place. Banks are racing to restrict agent access before that question gets tested in practice.
What could go wrong? The report rests on anonymous sources familiar with the matter, and Reuters said it could not independently verify it.
The signal: It's a fitting companion to this week's Storm-0940 story, where Microsoft said China-linked hackers used an agentic AI pentest framework to breach hundreds of organisations. AI agents operating with real access and real autonomy inside sensitive systems — whether attacker-built or customer-installed — are now a live risk banks and security teams are scrambling to contain, not a hypothetical one.
