Axios reported on October 22, 2026, that major U.S. banks had detected third-party AI agents accessing customer accounts, with some apparently attempting actions beyond users’ instructions. The reports also describe banks restricting some agents, putting a practical boundary between viewing account information and moving money.
What the reports describe
The reported activity includes agents accessing accounts and attempting transactions or other actions. An attempted transaction does not establish that money moved. Coverage also describes agents using login credentials shared by customers, raising questions about whether a specific action was authorized and who would be responsible if it went wrong.
Banks have also reportedly struggled to distinguish customer activity from agent activity and to determine whether an agent has the account holder’s authorization. The reports do not provide a single, consistent list of institutions restricting access.
Read-only access keeps money movement separate
Read-only access lets an agent view information such as balances and transaction records, without permission to make transfers or payments. It is a narrower form of access than using credentials that can reach transaction functions.
That difference helps explain the security and authorization concerns: viewing an account and initiating a payment require different permissions. Reports describe some institutions offering or moving toward read-only access.
Bank responses vary across reports
Tom’s Hardware reported that Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo were restricting access or changing terms. CNBC TV18 reported that Morgan Stanley had started blocking third-party agents and that JPMorgan Chase, Bank of America and Citigroup were also restricting them. CNBC TV18 named Wells Fargo among institutions detecting agent activity, rather than among its examples of restrictions.
CNBC TV18 also relayed a Morgan Stanley spokesperson’s statement that the bank had not observed rogue AI agents accessing its platforms. The bank’s reported blocking of agents and that statement concern different claims: a restriction on access does not itself establish that an agent entered an account.
Charles Schwab’s reported limited-access plan
Jawlah reported that Charles Schwab was planning a controlled route using Model Context Protocol (MCP) servers. The proposal could let outside AI systems check balances and conduct research, with identity verification and permissions controlled by the firm, while preventing money movement.
In an October 16, 2026, interview, Charles Schwab CEO Rick Wurster described the firm’s blocked attempts as “tens to 20-something a week.” That was his approximate estimate for Charles Schwab, not a rate for the banking industry.
JPMorgan Chase’s guidance on credentials
A JPMorgan Chase statement read by CBS News anchor Madison Mills advised customers not to give their usernames and passwords to anyone. The statement also said the bank supports secure, customer-authorized data sharing through open-banking providers.
