Unvetted AI Agents Access US Bank Accounts
Left 33%
Center 33%
Right 33%
1 left · 1 center · 1 right
What happened
Axios first reported on October 22, 2026, citing “sources tell Axios” and “people familiar with the issue,” that major U.S. banks—including Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo, and Citigroup—were detecting unauthorized third-party AI agents operating inside customer accounts, with some agents contacting call centers or appearing to take actions independent of user instructions. The New York Post credited Axios as the origin and that same day carried the first on-record comments: a Wells Fargo spokesperson said the bank “has taken steps to block unauthorized agents from accessing customer accounts,” and a Morgan Stanley spokesperson said the bank had not observed “rogue AI agents accessing our platforms.” Typical cases involved customers granting AI assistants login credentials or access through third-party data-sharing services, which most banks’ guidelines prohibit because they require a human to log in; a Chase spokesperson said customers should not give their usernames and passwords to anyone. Several of those banks began blocking or restricting agent access, often toward limited read-only permissions of the kind already granted to apps like Quicken, while officials said they struggle to distinguish human from bot activity and whether an agent is user-authorized or has gone rogue, and were preparing “day after” plans to quickly restore customer access.
Sourcing check · Partly on the record · 3 articles
1 of 3 articles cite a named source for the story. It started with unnamed sources; a named source appeared 10 hours later.
What these terms mean and how they're counted
- On the record · names a source 1 of 3
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Wells Fargo spokesperson and Morgan Stanley spokesperson
- Primary evidence · cites a document or data 0 of 3
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: None cited.
- Credits another outlet 1 of 3
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Axios
- Unnamed sources 3 of 3
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this. Here: e.g. “sources tell Axios”, “people familiar with the issue”
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 22, 09:00 UTC by Axios, with no named source. First named source 10 hours later, from New York Post.
- Not counted 0
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out
Unpacked
Right-leaning coverage presents the story as unauthorized bots inside bank accounts, omitting that customers themselves usually supply the login. Left-leaning coverage states that the activity typically starts after a user grants permission and credentials to an AI assistant, including through a data-sharing service such as Plaid. Bank rules still require a human to log in, so the same handoff is both user-approved and, to the banks, unauthorized. Drop that sequence and the episode reads as a break-in rather than a terms-of-service collision.
Right-leaning coverage reaches for alarm language that left-leaning coverage does not use. The New York Post calls the situation a budding "nightmare" for the industry. Mother Jones instead describes banks as struggling to protect customers from their own agents.
Has any customer actually lost money, and who would be on the hook if an agent moved funds?
Bottom line
The New York Post's banking "nightmare" never says how the agents get in; Mother Jones does: customers grant the login.
The receipts — 2 facts one side's coverage lacks
- A Wells Fargo spokesperson said the bank has taken steps to block unauthorized agents from accessing customer accounts
- Many banks are only permitting limited, read-only access to certain AI tools
The Left View
Mother Jones frames the episode as banks struggling to protect customers from AI agents those customers themselves authorized. It uses Meta’s Muse connecting through Plaid as the illustrative path by which users hand over bank credentials, notes that this permission “goes against most banks’ guidelines,” and stresses that institutions cannot reliably tell authorized agents from ones that have “gone rogue.” The article quotes Miranda Bogen, founding director of the Center for Democracy & Technology’s AI Governance Lab, saying ordinary users of consumer-level agents are “at greater risk of their consumer-level agents breaching” critical infrastructure providers like banks, and that state AI laws largely “ask companies to come up with their own safety plan” even though “very few deployers of AI know how to test that AI well.”
The Right View
The New York Post frames the same detections as a budding “‘nightmare’ for the banking industry,” quoting unnamed officials who called the situation “horrifying” and feared agents could make mistakes or otherwise affect customers’ wallets. It emphasizes that current bank rules require humans to log into their own accounts, that some agents have contacted call centers or acted without direct user instruction, and that major banks have begun blocking unauthorized agents and plotting how to restore accounts if an agent “wreaks havoc without permission.” The Post notes that autonomous agents are an increasingly popular offering from U.S. tech companies including Meta and OpenAI, and that Axios did not specify which agents were involved.
Our Take (balanced)
The left’s strongest argument is that the danger sits with ordinary customers and critical infrastructure because AI deployers do not know how to test their systems, supported by Bogen’s warning and by banks’ inability to distinguish authorized from rogue agents. The right’s strongest argument is that banks face an acute operational crisis—officials describing it as “horrifying” and a “nightmare”—because customer-authorized bots violate human-login rules and cannot be reliably identified, supported by multiple major institutions blocking access and preparing restoration contingencies. The central unresolved tension is whether the episode primarily exposes a failure of AI companies to govern and test agents before they reach the financial system, or a mismatch between customer demand for delegated AI access and banks’ authentication rules that still assume a human at the keyboard.
3 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.