Major US banks are detecting unauthorized third-party AI agents operating inside their customers' online accounts, according to a new Axios report.
The big picture: The pattern is mostly consent gone sideways: customers give an AI agent their banking credentials, which runs against most banks' terms of service, and the agent then logs in as them.
- "In a lot of cases, this is just going to be customers giving their username or password to an AI agent that the bank hasn’t had a chance to vet yet," Axios senior AI reporter Madison Mills told CBS News.
Zoom in: Mills said the reporting also found evidence of agents taking actions in accounts that appeared unauthorized, including an AI calling a bank to file a complaint before consulting the account holder. The agents were largely following user instructions, she said, rather than hacking.
What they're saying: JPMorgan Chase CEO Jamie Dimon raised the issue on the company’s October 13 earnings call. "We’re not going to allow just any outside agents to come in inside the company because it’s just too risky for clients and for JPMorgan," he said.
- Charles Schwab's CEO said this month that the company has been blocking unauthorized agents, per Reuters. Morgan Stanley said it has observed no unauthorized AI agent activity across its platforms.
The other side: White House AI czar David Sacks said most of the described activity is user-authorized. "This may violate bank terms requiring humans to log in themselves, but these are in no way cyberattacks," he wrote, suggesting banks grant agents read-only access instead.
Why it matters: Sharing banking credentials can undercut the protections that come with logging in yourself, and a Chase spokesperson said customers should keep their username and password private. Dozens of institutions are now racing to curb agent access.
