Major U.S. Banks Detect Unvetted AI Agents Acting in Customer Accounts, Axios Reports

3.8 · 8d ago · US · AI

The Facts

  • Major U.S. banks are detecting activity from third-party AI agents, unvetted by the banks, operating inside customers' online accounts, according to an Axios report. CBS News only
  • Axios senior AI reporter Madison Mills said that in many cases customers give their username and password to an AI agent, which violates bank terms of service. CBS News only
  • Mills said Axios also found evidence of agents taking actions in customer accounts that were not authorized, such as calling a bank with a complaint without consulting the account holder. CBS News only
  • Mills said the agents were not hacking accounts or depleting funds; they were largely following user instructions without the bank's permission to transact on the holder's behalf. CBS News only
  • Mills said the issue affects dozens of financial institutions as they work to curb AI agents' access to customer accounts. CBS News only
Dive deeper · 6 more factsShow less
  • White House AI czar David Sacks said on X that most of the activity described appears to be user-authorized agents, not cyberattacks, though it may violate bank terms requiring humans to log in themselves. CBS News only
  • Sacks said banks could grant AI agents read-only permission if they want to limit access, and that full write access with user credentials is a different risk category. CBS News only
  • A Chase spokesperson said customers should not share usernames and passwords with anyone and that the bank supports customer-authorized data sharing through open banking providers. CBS News only
  • JPMorgan Chase CEO Jamie Dimon said on the Oct. 13 earnings call the bank will not allow just any outside agents inside the company because it is too risky. CBS News only
  • Charles Schwab's CEO said earlier this month the company has been blocking unauthorized agents, according to Reuters as cited by CBS News. CBS News only
  • A Morgan Stanley spokesperson said it had not observed unauthorized AI agent activity on its platforms; Bank of America and Wells Fargo did not immediately respond to CBS News. CBS News only

Context

An Axios report says large U.S. banks are seeing third-party AI agents operate inside customer accounts without bank vetting. Axios' Madison Mills told CBS News that much of this stems from customers sharing login credentials with agents, which breaches bank terms of service, and that some agent actions appeared unauthorized by account holders.

White House AI czar David Sacks characterized most of the activity as user-authorized rather than cyberattacks and suggested read-only access as an option for banks. Banks including JPMorgan Chase and Charles Schwab have said they are restricting or blocking such agents.

Conflicting Reports

  • Madison Mills (Axios, via CBS News) says some agent actions appeared unauthorized by customers; David Sacks says most described activity appears to be user-authorized agents.

How the Agent Panel Scored This

Independent AI personas each scored importance 1–10; the story's score is a trimmed mean (highest and lowest votes dropped). Vote spread: 1.

4 News Editor The story reports a concrete finding that banks are detecting unvetted third-party AI agents in customer accounts, affecting dozens of institutions, but it involves no breach, lost funds, or formal action, and much of the coverage is reactions and statements, so it is niche-to-moderate in impact.
4 Business Analyst The story reports detection of unvetted third-party AI agents accessing customer accounts at dozens of institutions, a notable operational and regulatory risk, but it is largely a report of activity with no new concrete regulatory action, account losses, or market-moving corporate action, and much of the content is commentary and spokesperson statements.
4 Science & Tech Analyst The story reports detection of unvetted third-party AI agents using customer credentials across dozens of institutions, a notable emerging security and policy issue, but no new concrete regulatory action, breach, or financial loss occurred and much of the coverage is commentary and denials.
4 Critical Reader The story reports detection of unvetted third-party AI agents using customer credentials at major banks, a notable security and terms-of-service issue, but the concrete events are mostly reporting findings and statements with no confirmed financial losses or new enforcement actions beyond Schwab's blocking.</reasoning>
4 Informed Citizen The story reports detection of unvetted third-party AI agents in customer accounts, a notable emerging security and terms-of-service issue affecting dozens of institutions, but much of the content is statements and reactions rather than a concrete new action, and it has limited direct impact on ordinary people within a week.
3 Global Affairs Analyst The story reports detection of unvetted third-party AI agents in customer accounts, a notable emerging security and compliance issue, but it is mostly statements, reactions, and no new concrete regulatory action or major disruption, so impact is limited.
3 Policy Expert The story reports detection of unvetted AI agent activity and bank statements, but no new enacted rule, court ruling, or executive action; it is mostly reporting and rhetoric affecting a limited set of customers.

Sources (3)

← All stories