Five banks restrict AI agents that log in with customers' own passwords
According to an Axios report, Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo and Citigroup have begun restricting third-party AI agents that access customer accounts — agents that users themselves have handed their login details to.
The story rests on anonymous sources, and Reuters has been unable to independently confirm the incidents. But statements from the banks themselves, including from JPMorgan's earnings call on 13 October 2026, point toward a new compromise: the agents get to look, but not act.
What is reported — and what is confirmed
The starting point for the story is an Axios report dated 22 October 2026, citing "people familiar with the matter." The report describes the five major banks working to limit the risk from AI agents, because the technology, according to the sources, is developing faster than the banks can adapt their security systems and policies (MSN/Axios).
Two caveats apply from the outset. First, Reuters could not independently verify the specific incidents described in the report (Yahoo Finance). Second, the report does not establish that the incidents led to financial losses. What does exist as named, confirmed company statements are, among other things, the statements from Morgan Stanley and Citigroup and JPMorgan's comments on the earnings call.
Several bank executives describe the situation in stronger terms. According to Decrypt's account of the Axios report, executives have described the situation as "terrible," and one said the industry has "serious concerns" about agents reaching into accounts and taking actions that could affect people's finances (Decrypt).
How the agents get in
The access route is simple: users themselves give the agents access via the browser. This happens with tools such as Computer Use or open-source agent software such as OpenClaw, where the agent in practice operates online banking the way a human user would. Because the agent logs in with the customer's own credentials and from a genuine browser session, it is, according to the reporting, difficult for the banks to block this on the provider side (The Decoder).
The core of the problem is that the banks' authentication systems do not distinguish between the customer and the agent acting on the customer's behalf. The same password, same session, same interface — but a different "hand" doing the clicking.
What the banks say they have observed
According to the Axios report, the banks have tracked incidents where AI agents contact customer service via call centers, or where the agents appear to act independently of the user's instructions (India Today).
Here a tension emerges that cannot be resolved with the available information: Morgan Stanley is reported to have begun blocking third-party AI agents, while a spokesperson for the bank said it has not observed "rogue AI agents accessing our platforms" (MSN/Axios). Both statements can be true at the same time — precautionary blocking and an absence of observed agent incidents are compatible — but the reporting leaves unclear what the bank may actually have seen.
The statements from JPMorgan and Citigroup
JPMorgan has been the most concrete. On the Q3 earnings call on 13 October 2026, CEO Jamie Dimon said: "You don't want rogue agents, and it could be thousands of them" (MSN). It is unclear whether Dimon meant this as a warning about future scale or as a description of the current situation — the sources interpret it differently. According to MSN's account, JPMorgan also confirms that external companies cannot collect customer credentials to gain access to accounts.
CFO Jeremy Barnum went further on the same call: customers who share login details with agents that take unwanted actions should understand that "that's going to be on them" — that is, the responsibility lies with the customer (BeInCrypto via Yahoo Finance).
Citigroup says that third-party AI agents are not permitted to log directly into customer accounts or carry out transactions via the bank's digital platforms, but that read access via approved open-banking intermediaries is allowed (MSN).
The compromise: read-only access
The pattern that emerges is an intermediate compromise. Several institutions have approved, or are on their way to allowing, read access — an arrangement where AI agents can view customers' financial information but cannot initiate transactions or otherwise act on the accounts (India Today). The arrangement is compared to the access services such as Quicken have long had.
In line with this, JPMorgan allows view-based retrieval via intermediaries such as Plaid (Yahoo Finance). OpenAI has launched a dedicated ChatGPT service for financial tasks in the US with read-only access to financial data — an indication that the provider side has itself adapted to the banks' limits (The Decoder).
The open question: who bears responsibility?
Barnum's statement that unwanted actions from shared credentials are "going to be on them" points to unsettled legal terrain. US regulation of unauthorized electronic transfers is not clearly settled for the scenario where a customer voluntarily shares credentials with an agent that then acts incorrectly. Whether customers will in fact lose this argument, or whether consumer protection rules pull in a different direction, is not settled in the reporting — this is the question that remains once the blocking and read-only access are in place.
What could change the picture
The details of the story rest on anonymous sources in one report, and the incidents have not been independently confirmed. Three things could change that: concrete confirmations from more of the banks, clarification of how US consumer rules treat agent-initiated transfers, or more extensive statements about what the banks have actually observed. Until then, the safest picture is this: the banks are preparing for a problem not all of them say they have seen, users have already begun sharing their passwords with software, and the industry's interim answer is that the agents get to look — but not touch.