US Banks Are Blocking AI Agents Inside Customer Accounts: The Problem Is the Password
Major US banks have started blocking AI agents operating inside customer accounts. No attacker put them there: the account holder handed over the password.
What the Banks Found
On October 22, 2026, Axios reported that several major US banks are detecting third-party, unvetted AI agents operating inside real customer accounts. Reuters confirmed that same day, with two sources, that the institutions are blocking those agents and slowing transactions. There was no attack: there was a program someone gave their username and password to.
Third-Party Agents Logging In With Customer Credentials
The customer installed or subscribed to an assistant that promises to run errands for them, handed over their banking credentials and let it log into the bank's app. From the system's point of view, that is a normal login: right username, right password, sometimes even the customer's own browser. Nobody behind it is a person.
Actions That Did Not Follow the User's Instructions
Per the report's sources, some agents took actions that looked independent of the user's instructions, and some institutions logged agents contacting their support desks. That is the touchiest part of the story: nobody knows whether the agent did what it was told or what it decided on its own.
Read also
What Each Bank Is Doing
Morgan Stanley Blocks; JPMorgan, Bank of America, Citi and Wells Fargo Restrict
Morgan Stanley blocks third-party agents. JPMorgan Chase, Bank of America, Citigroup and Wells Fargo have taken steps to limit their access, and other banks are following. Charles Schwab shows up in some press tallies. The distinction matters: blocking and restricting are not the same thing, and it would be wrong to say every major bank blocked.
Read-Only Access as the First Compromise
Several banks have already limited agents to read-only mode: they can look up balances and transactions but cannot move funds or buy stock. That is the formula gaining ground as a stopgap while rules get written. Banks are also updating their terms of service to stop agents such as Meta's Muse from taking autonomous actions inside accounts; Gizmodo reported that link, and it does not appear in the Axios report.
Why the Password Is the Problem
The Rule Nobody Reads: The Account Holder Must Log In
Bank account rules require that the account holder be the one logging in. When a program opens that session with the holder's credentials, the bank classifies it as unauthorised third-party access, even if the owner gave permission. This is not a creative reading: it is the same clause that has sat in the contracts for twenty years.
Why a Bank Cannot Tell Your Agent From an Attacker
To the system, both arrive identically: your username, your password, your device. If the bank accepted that session as legitimate, it would also have to accept anyone else who obtained the same credentials. That is the dead end: you cannot bless automated access without giving up the controls that catch fraud.
Sharing the Password Also Costs You Fraud Protection
There is a practical consequence almost nobody considers. If you shared your credentials, the bank can argue that you authorised the transaction and decline the cover that would apply to an unrecognised charge. Today's shortcut becomes tomorrow's legal problem.
The Path That Does Work: Consent, Scope and Per-Transaction Credentials
Open Banking: the Bank Authorizes Access, Not the Password
The path that works is the one authorised financial aggregation already uses: the bank grants an API permission with defined scope and an expiry date, and the customer can revoke it. JPMorgan said so in its own words: it blocks agents that access accounts with the customer's banking credentials and supports secure data sharing with consent through open banking providers. That is not charity; it is the only way the bank knows who is asking for what.
Agent Payments: Cryptographic Identity and Capped Tokens
For the payment moment, several standards coexist: Visa's Trusted Agent Protocol, with cryptographic agent identity and per-request signatures; Mastercard's Agent Pay, with agent tokens and spending rules; Google's AP2; and OpenAI and Stripe's Agentic Commerce Protocol. You do not need to pick one today, but they all share the same idea: the agent identifies itself and the permission carries a limit.
What to Check If You Build Agents That Touch Third-Party Services
A Six-Point Checklist
If your product automates logging into someone else's service with the user's credentials, that is exactly the door being closed. Check six things: use OAuth or a scoped API instead of credentials; request the minimum permission needed; set expiry and revocation; log every action so it can be audited; require human confirmation before moving money; and warn users when two-factor authentication or passkeys break the automation. Passkeys protect the user and, at the same time, make impersonating a person unworkable, which is why this model does not scale.
What We Do Not Know
No Losses Reported, No Products Named, No Figures
It is worth being explicit about what is missing. No account takeovers or fraud losses were reported, no specific agent product was identified, and there are no figures for affected customers or money moved. The incident log tracking the case rates it low severity. This is an access-control problem, not a theft, and telling it any other way would be misinformation.
Conclusion
The agent was never the problem; the access model was. Any automation that impersonates a person with their credentials carries the same risk, whether at a bank, an airline or an admin panel. If you build agents, the question is no longer whether they work but with what permission. Two reads on this blog help frame it: the case of Gemini acting off-script in a security test, from the attacker's side, and the UN scientific panel's warning about keeping control of AI agents. And if you are building one, the MCP standard explains why an agent ends up holding permissions over third-party systems. We keep following this on the blog.
