US banks detect unauthorized AI agents in customer accounts

Major US banks have detected activity from third-party AI agents operating inside customer online accounts, agents the banks have not vetted, according to CBS News on October 23, 2026. The report followed an Axios investigation published the previous day.

Madison Mills, a senior AI reporter at Axios, told CBS that customers often provide their bank usernames and passwords to personal AI agents, violating bank terms of service. Axios found instances where agents acted without customer authorization, such as contacting banks to file complaints without consulting the account holder. Mills said the agents were not hacking accounts or stealing funds and generally followed user instructions. She described the issue as industrywide, affecting dozens of financial institutions.

A Chase spokesperson said customers should not share login credentials with anyone and highlighted secure, customer-authorized data sharing through open banking providers. JPMorgan CEO Jamie Dimon stated during the bank’s October 13, 2026, earnings call that JPMorgan would not permit unvetted outside agents into its systems. Charles Schwab’s CEO said earlier in October 2026 that Schwab had been blocking unauthorized agents, Reuters reported. Morgan Stanley said it had not observed unauthorized agent activity on its platforms. Bank of America and Wells Fargo did not respond to CBS News.

David Sacks, the White House AI and crypto czar, posted on X that user-authorized agents differ from rogue agents, which could constitute cyberattacks. He said most cases Axios described involved customers sharing credentials, which may violate bank terms but do not qualify as cyberattacks. Sacks suggested banks could offer agents read-only access and advised caution with full write access using user credentials.