GoKawiilMajor US banks detect AI agents logging into customer accounts with shared credentials
Axios reports that Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo and Citi have observed third-party AI agents accessing online banking accounts, typically using customers' own login credentials. Some agents have also contacted call centers or taken actions that appeared to operate independently of direct user instructions. No fraud losses, account takeovers, or named AI products have been reported so far.
GoKawiil's interpretation of the reporting above, not reported fact.
Bank executives say they often cannot distinguish a human user from an AI agent, or a legitimate agent from a rogue one, which undermines authentication systems built around the assumption that a login means a verified human. Morgan Stanley is blocking third-party agents outright, while JPMorgan, Bank of America and Citi are imposing restrictions, suggesting the industry sees this as an emerging risk rather than an isolated incident. The situation implies banks may need new verification methods as AI agents become more capable of acting on users' behalf.
- Five major US banks have detected AI agents logging into customer accounts using shared credentials, violating bank policy.
- Banks cannot reliably distinguish human users from AI agents, or authorized agents from unauthorized ones.
- Morgan Stanley is blocking third-party AI agents entirely, while JPMorgan, Bank of America and Citi are restricting them; no fraud losses have been confirmed.
Source: pwn.watch, 2026-10-22
Published there as: “What's Getting Pwned”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.