US Banks Reportedly Block Unvetted AI Agents in Customer Accounts

What happened

On 22 October 2026, Axios published a report saying that major US banks are detecting unauthorised third-party AI agents working inside customer accounts. The report cited people familiar with the matter, not named officials or documents. According to Axios, some of these agents appeared to take actions that the account holder had not asked for, and a few reportedly contacted bank call centres. Reuters, citing two people familiar with the situation, reported the same day that major banks have been blocking third-party agents from operating in customer accounts and making transactions.

The banks named in the Axios reporting include Morgan Stanley, JPMorgan Chase, Bank of America and Wells Fargo. Citi appears in several accounts of the story as well, and Charles Schwab's chief executive has reportedly said his firm blocks unauthorised agents many times a week. Each bank has responded in a different way. Morgan Stanley has reportedly begun blocking third-party agents, although a spokesperson told Axios that the bank had not seen what it called rogue AI agents on its platforms. A Chase spokesperson told customers not to share usernames and passwords with anyone, including AI agents.

Why the story matters for businesses that automate work

The core problem is not the AI itself. It is the login. Many agents sign in with the account holder's own username and password and then click through the website or app the way a person would. Banks say that makes agent activity hard to tell apart from the customer's own session. Reuters reported that a bank industry source said customers sometimes hand over their login details, and banks typically flag and block those transactions. Reuters also noted that a transaction made with credentials the customer shared cannot automatically be classed as unauthorised. That is the point that matters most for a business owner. If a staff member gives a tool a password, the bank may treat what the tool does as that staff member's action.

Many businesses already run automation that touches bank data. Bookkeeping software, cash-flow dashboards, bill-payment tools and reconciliation scripts can all pull balances or transactions. Some of them may log in with a stored password, and some may use a bank-approved connection. The difference is not always visible from the screen. A finance lead who does not know which method a tool uses has a gap in control.

The banks' own statements show where the line is being drawn. JPMorgan's spokesperson told CNBC that the bank does not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf. The same spokesperson said the bank supports customer-authorised data sharing through open banking providers. CNBC reported that, under this arrangement, some agents can read balances through a connector such as Plaid, but they cannot send money or pay bills. The spokesperson did not give a timetable for the safeguards needed before agents can interact directly with accounts.

What changes in practice, at any size

The same steps apply to a five-person firm and to a group with thousands of staff. The difference is how many people and tools are involved.

• List every tool that touches a bank account, including tools that a staff member set up privately.
• For each one, find out whether it signs in with a stored username and password or uses a bank-approved data connection.
• Move reading tasks, such as balance checks and statement downloads, to read-only connections where the bank offers them.
• Keep payments, transfers and bill payments behind a named person who approves each action in the bank's own system.
• Remove stored banking passwords from tools and browser sessions that no longer need them.
• Ask the bank's relationship manager or the bank's published terms which connection methods it accepts.

Citi has stated publicly that it does not allow third-party AI agents or assistants to log into customer accounts or transact on its digital platforms, though it allows certain read-only access through approved open-banking providers. Bank of America's chief executive reportedly said a human should stay in the loop to approve money leaving an account. Read together, these positions point the same way: read freely through approved channels, and keep the decision to move money with a person.

There is also a contract question. Several reports point out that a bank's digital services terms can treat activity through a customer's credentials as the customer's own. JPMorgan's chief executive, Jamie Dimon, has reportedly said customers who give agents access take on the risk. A business should read its own account agreement before it assumes a tool's mistake would be covered.

What automation cannot do here

Automation can read, sort, match and prepare. It cannot make a bank accept a login that the bank has chosen to block, and it cannot decide whether a payment is correct. A workflow that depends on logging in with a password may stop working when a bank closes that route, and the business will need another way to get the data. Results will depend on which banks you use and which connections they offer you, and no tool can change that.

What to watch next

Three things will show how this plays out over the coming months. The first is whether the banks publish formal rules for agents, rather than the current mix of statements and terms updates. The second is whether any of the reported incidents are confirmed in detail. Axios relied on unnamed sources, and Morgan Stanley disputed that it had seen rogue agents. The third is whether the banks set up a standard way for agents to request approval, which JPMorgan has said it is developing. Business owners should also watch for changes to their own bank's data-sharing terms, because those will decide which tools keep working.

This explains the reporting and the banks' stated positions in general terms. It is not legal or tax advice for your case.