The warning signs emerged as major U.S. banks began detecting third-party AI agents inside customer accounts, sometimes using credentials supplied by customers and, in some cases, appearing to contact call centers or act beyond explicit instructions. Executives told Axios the prospect was “horrifying,” particularly where an agent could make purchases or move money.¹

The immediate response has been defensive. Morgan Stanley has begun blocking third-party agents, while JPMorgan, Bank of America and Citi are restricting them; Wells Fargo is among institutions working to contain the risk. The central problem is not simply unauthorized access, but uncertainty: banks often cannot determine whether activity is human-directed, authorized by a customer or the work of a bot that has gone rogue.¹

That uncertainty has pushed lenders to rewrite rules designed for human logins and to prepare for worst-case recovery scenarios. Yet the banks are not rejecting automation outright. Many are considering or moving toward read-only access, a model that could let agents view financial information without giving them power to transfer funds or take other consequential actions.¹

David Sacks challenged the framing of the episode, arguing that the account of events may mix together two very different categories. “There’s a world of difference between user-authorized agents … and true unauthorized/rogue agents that could constitute cyberattacks,” he wrote, adding that most activity described by Axios appeared to fall into the former camp.David Sacks (DavidSacks)²

A separate account of the reports underscored the banks’ dilemma: the concern is not only that agents can act, but that institutions “just don’t know what AI agents are doing or why.”³ For banks, that ambiguity is enough to justify a clampdown; for advocates of authorized agents, it is a reason to build clearer permissions rather than treat every bot as a breach.