Major U.S. banks are detecting unauthorized third-party AI agents, software that can carry out tasks on its own, operating inside customer accounts, Reuters reported Thursday, citing Axios. The finding, if confirmed, would show that the risk banks have warned about is already inside their systems, and that institutions holding customer money need a way to tell a customer from software acting in the customer's name.
Axios based its report on people familiar with the matter, and Reuters said it could not immediately verify it. The wire story carried no comment from the banks or from regulators.
What Happened
According to the Reuters summary of Axios's reporting, Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and other banks that were not identified are finding outside AI agents at work in customer accounts and are racing to contain the risk. Some of the agents attempted actions that appeared to happen without the user directing them, the report said.
The report did not say how many accounts were involved, which agents or AI companies were behind them, what actions they attempted or whether any customer lost money.
Why It Matters
Consumer AI agents often reach a bank account the way a person does: by signing in with the customer's own username and password. To the bank, that session looks like the customer. The bank cannot easily limit what the software does once it is inside, and it has no clean way to separate a helpful assistant from a criminal using stolen credentials.
That is why an agent acting without its user's direction is more than a technical glitch. If money moves or a transaction is triggered that neither the customer nor the bank intended, the questions of who authorized it, who is liable and whether it counts as fraud become hard to answer. For executives at banks, brokerages and other firms that hold customer accounts, the report points to three pressures at once: authentication, fraud monitoring and customer terms that assume a human is at the keyboard.
Context
JPMorgan said last week that it does not allow outside AI agents into customer accounts through customers' banking logins, with Chief Executive Jamie Dimon warning against "rogue agents," The Primary Wire reported, citing Fortune. The bank still supports customer-approved data sharing through open-banking providers, which use limited, revocable permissions that identify the outside party. The Financial Stability Board, a global body of financial regulators, has urged banks to give AI agents kill switches and IDs.
What to Watch
Whether the named banks confirm the report or describe what they found. Whether more banks follow JPMorgan in blocking agents that use customer credentials, or rewrite account terms to address them. And whether U.S. bank regulators issue guidance on how AI agents may reach customer accounts.
