AI agents in US bank accounts: what banks found and what to do now

AI agents accessing bank accounts have prompted major US banks to tighten security after Axios reported (opens in a new tab) on Thursday, 22 October 2026, that third-party assistants were operating inside customer accounts, sometimes beyond user instructions. In the cases Axios described, access generally came from login credentials customers had provided themselves. The immediate precaution is simple: do not give an AI agent your bank password.

An AI agent is software that carries out tasks, such as visiting websites or filling forms, instead of only answering questions. As of 22 October 2026, Axios's anonymous sources had not established how many agents entered accounts or identified a confirmed dollar loss. TFTC separately reported no confirmed widespread unauthorized transfers. A bank named in an industry report has not necessarily experienced the same conduct as another institution.

What happened between Muse's launch and the bank warnings?

The restrictions developed over several weeks, alongside the launch of Meta's Muse, a personal assistant with financial data connections.

According to Plaid's 8 September announcement (opens in a new tab), Muse users can connect financial accounts and share balances, transactions, investment holdings and mortgage details. That connection differs from giving an agent the password and control of a banking website.

What have banks found, and what access do they allow?

Axios named Morgan Stanley, JPMorgan, Bank of America, Citi and Wells Fargo among the institutions responding. Its sources described agents contacting bank call centers or attempting tasks outside apparent customer instructions. One executive said permitted and unpermitted agents appear identical from the institution's side. Several banks were planning how to secure or restore accounts after damaging activity.

The reported policies differ.

Morgan Stanley needs a qualification. Axios described blocking third-party agents, while other coverage described wider bank responses as restrictions. A Morgan Stanley spokesperson told Axios that the firm had not observed such unauthorized agents on its own platforms.

A JPMorgan spokesperson told Fortune on 15 October (opens in a new tab) that the bank rejects agents entering accounts with customers' credentials. It supports approved open banking connections instead.

For Schwab, The Next Web's account of Wurster's Bloomberg interview (opens in a new tab) described plans for external tools to check balances and research investments without moving money. Schwab also promotes its own assistant, Charley. According to Wurster, Schwab stops major outside agents in the tens and twenties per week. That was his description of blocked attempts, not the number of agents operating across the banking industry.

How do AI agents get into bank accounts?

The distinction is between an agent borrowing your login and an application receiving limited permission from the bank.

Credential sharing gives an agent your normal login

Credential sharing means handing an application the username and password normally used to access an account. The software may store them or use them to sign in. From the bank's perspective, the session can look like ordinary customer activity.

Axios says most banks' policies expect account holders to log in themselves. Sharing credentials can conflict with bank terms even when a customer agrees. An agent with the customer's full access may also reach payment or account-management controls.

Screen scraping and browser automation copy human actions

Screen scraping means software retrieves information from website pages rather than a bank-provided data interface. Browser automation can also click buttons, complete forms and interact with logged-in sessions.

JPMorgan CFO Jeremy Barnum criticized credential sharing and screen scraping as insecure during the 13 October earnings call. International Business Times' coverage (opens in a new tab) described those methods in the banks' concerns.

Valid credentials show that someone or something can log in. They do not prove the customer approved every subsequent action. That is the authorization problem Axios's sources described.

Approved connections can restrict what an agent does

Open banking lets approved third-party applications access financial information through controlled data-sharing arrangements. Read-only access permits information retrieval without permission to move money.

Citi explicitly permits limited read-only sharing through approved providers. JPMorgan supports approved data access while blocking agent payments and transfers through its described arrangements. Plaid is one connector; its Muse announcement describes approved information sharing, not permission for Muse to move money.

Schwab has discussed Model Context Protocol (MCP), a standard for exposing tools to AI applications. A bank-run MCP service can present a fixed list of operations, such as balance lookups, while withholding transfer tools. The bank still decides what actions its systems accept.

For a customer, the useful distinction is whether the bank can identify the connected service, show its permissions and withdraw access without changing the main account password.

Who is liable if an AI agent moves money without permission?

No agent-specific liability rule had settled the issue as of 22 October 2026.

During JPMorgan's 13 October earnings call, Dimon warned that "you don't want rogue agents and there could be thousands of them." Thousands was a hypothetical scale, not an agent count. He also raised transferring liability to customers who authorize outside agents.

Barnum said customers sharing their credentials may bear responsibility for unwanted actions. He called the current arrangement undesirable and discussed alternatives. Schwab's Wurster likewise questioned who would be responsible when an agent acts beyond anyone's control.

Bank of America CEO Brian Moynihan told CNBC that a human should authorize money leaving an account. Retail Banker International, citing the Financial Times, reported that the bank was developing liability protocols for AI-authorized payments.

Bank terms may restrict password sharing or automated access. Check the relevant agreement. Regulation E implements the Electronic Fund Transfer Act for covered electronic transfers. TFTC argues those protections were developed around human-initiated payments and do not clearly resolve ambiguous agent instructions. TFTC also reported no published agent-specific authorization or liability rule from the OCC, Federal Reserve or FDIC.

Retail Banker International reported, citing the Financial Times, that Wall Street executives contacted Federal Reserve regulators. The report said officials privately supported bank restrictions and saw a possible need for clearer rules. No reported executive statement establishes that a particular transfer would automatically fall outside a customer's legal protections.

A disputed transfer still depends on the facts, account agreement and applicable law. Check your bank's terms and CFPB guidance. This article is not legal or financial advice.

Why are banks and AI companies taking different positions?

Banks cite account security, permissions and liability. They also worry about deposit flight: an assistant comparing interest rates might help customers move idle cash into higher-yield accounts. Barnum said personal agents could increase competition for deposits, while the Financial Times reporting identified the same concern.

Agent builders argue that blocking websites reduces what customers can ask their software to do. The Verge reported on 17 October (opens in a new tab) that Yelp admits only agents enrolled in its paid data-licensing program. It reported Delta Air Lines preventing third-party agents from booking tickets; Delta said it has no deals with third-party agents, according to AI Weekly's relay. Amazon had begun blocking Muse on 20 September, saying the agent failed to identify itself as AI.

Meta said Muse cannot view passwords or payment information. Its position is that turning away a personal agent also turns away its customer. Meta has pursued partnerships with retailers that let Muse shop. Fortune reported that Meta declined to say whether Muse's finance features would survive more bank blocks.

EquiStamp CEO Chris Canal told The Verge that restrictions leave fewer useful tasks for agents. A Bluesky commenter, relayed by AI Weekly, predicted customer-service problems and chargebacks. These are the speakers' views, not confirmed bank losses.

What should you do today if an AI agent already has bank access?

Start with every account used for personal or business payments, including payroll and store operations. The Consumer Financial Protection Bureau's financial data-sharing guidance (opens in a new tab) advises checking what an app can see, whether it can initiate payments and how to stop its access. It also recommends checking how often information is collected, whether it is shared with others and how long it remains stored.

• Change exposed passwords. If you gave an agent banking credentials, stop that login method and change the password through the bank's official site or app. Ask whether further session changes are needed.
• Review and revoke connected applications. Find third-party access or data-sharing permissions and remove unused connections. The CFPB warns that deleting an app or changing a password may not end data access.
• Turn on account alerts. Look for available transfer, transaction and account-change notifications. Alerts help you spot activity; they do not prevent it.
• Check transactions and account activity. Compare transfers, beneficiaries and account changes with your instructions. Because Axios reported agent contact with call centers, ask the bank about unfamiliar service requests. The CFPB says to report unrecognized transactions promptly.
• Check approved connectors. Ask the bank which data providers it supports and whether each can read information, initiate payments or both.
• Record revoked access. Keep the tool's name, affected account, access method and revocation date. Follow CFPB guidance on requesting deletion of retained information where applicable.

For business accounts, include accountants, contractors and employees who may have authorized integrations. If you find an unfamiliar transaction, contact the bank through its official channels and follow the dispute process.

How should businesses build AI agents that access sensitive accounts?

Banks' restrictions point toward limited permissions, enforced actions and human approval. The same design works for a WooCommerce agent that reviews orders without issuing refunds.

Give the agent only the access needed

List the exact data and operations required. A cash report needs balances and transaction details, not payment privileges. Prefer approved read-only connections over shared passwords or automated website logins.

OAuth is a method for authorizing an application without handing it the user's primary password. Where a provider supports OAuth or another revocable API token, grant only the required permissions. A token is an application credential that can be withdrawn.

Make the permission list visible to the person approving the connection, and confirm that revocation stops new requests. If a provider does not support limited access, reconsider whether that integration needs to run.

Enforce permissions in code

An AI model may suggest a payment, but the application must validate the recipient, amount, account and allowed operation. Keep payment capabilities in a separately controlled component. Require an authorized person to review and approve the exact transaction, and record that approval. A prompt asking the agent to avoid transfers cannot replace an enforced permission boundary.

Keep records and a working off switch

Log what the agent requested, what code allowed or rejected, who approved the action and what the external service returned. Include useful timestamps and identifiers, but never secrets.

A log should link the model's suggestion to the code decision, approval and resulting external action. That makes it possible to investigate a payment dispute without trusting the agent's own explanation.

Give operators a way to halt new jobs, revoke credentials and inspect pending actions before restarting them.

Copy this AI agent account access checklist

Use one copy per connected tool. If you do not know an answer, check with the service or financial institution before granting further access.

AI AGENT ACCOUNT ACCESS CHECKLIST

Tool or agent name:
Account or business system:
Person responsible:

1. WHAT CAN IT SEE?
   Allowed data:
   Connected accounts:
   Read-only access confirmed? Yes / No / Unknown

2. CAN IT MOVE MONEY?
   Can initiate payments? Yes / No / Unknown
   Can transfer funds? Yes / No / Unknown
   Can change payment details? Yes / No / Unknown

3. HOW DOES IT LOG IN?
   Bank-approved connector / OAuth / API token /
   Shared password / Browser session / Unknown
   Provider authorizes this method? Yes / No / Unknown

4. HOW CAN ACCESS BE REVOKED?
   Revocation location or procedure:
   Person authorized to revoke:
   Revocation tested? Yes / No

5. WHO APPROVES PAYMENTS?
   Authorized approver:
   Exact payment details reviewed before approval:
   Approval recorded where:
   Agent activity log location:

Last reviewed:
Action required:

Verify any unknown payment permissions before continuing use. Record a separate reviewer for business payment authority when possible. Read-only access still exposes sensitive account and transaction records.

What should you change before connecting your next AI tool?

Start by reviewing permissions. WordPress application passwords show the value of revocable per-application credentials instead of sharing a primary login, although they do not replace a bank-approved connection.

Use rule-based automation versus AI decision-making to decide what code must control. For order management, finance reports and other systems, AI integration for business workflows describes limits enforced in code, human approval and a way to stop the agent.