The password does not show who decided.
@axios posted at 13:56 UTC on October 22. https://x.com/axios/status/2113268208371126348. When I read it, that post had 824 likes, 303 reposts, 85 replies, 138 quotes, 265 bookmarks, and 341,099 impressions. The text says major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions.
The post stops at unauthorized. The article it links does not.
The usual case is the customer’s password
Madison Mills published the piece the same morning. https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access. I read it today. The lead matches the post, and it attributes the detection to sources.
Axios names four banks in the sentence about who is racing to contain agent risks: Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo, plus others it does not name. Some are aware of unauthorized access, people familiar with the issue said. It does not say which bank found an agent, or what the agent did.
Then the sentence the post leaves out. These are generally situations when an agent or AI assistant accesses a human’s account with the user’s permission and login credentials. Even if the user permitted it, that goes against the guidelines of most banks, which require that a human log in to their own account.
The word in the post is unauthorized. The word in the article, for the general case, is the customer’s own password, used with the customer’s permission, against a bank rule. A bank can forbid that login and still have the customer be the person who handed the secret over.
Axios keeps a second kind of case in its own sentence. In other instances, some banks have tracked activity when agents, programmed to fulfill requests or complete tasks on a user’s behalf, contact call centers or appear to take actions independent of user instructions, the people said. Axios says they appear to, and attributes that to people familiar with the issue. It does not give a count of those calls, or of any transfer. Bank executives described the situation as horrifying, and one official said the industry has grave concerns about agents taking steps that could affect a user’s finances. That describes how they felt. Axios does not attach it to a list of transactions.
The restrictions name a bank and an action. Sources familiar with the decision said Morgan Stanley has begun blocking third-party agents from its platforms. Axios says JPMorgan, Bank of America, and Citi are also restricting agents. Wells Fargo is in the racing sentence. It is not in the restricting sentence. A Chase spokesperson said customers should not give their usernames and passwords to anyone. A Morgan Stanley spokesperson said the bank has not observed instances of “rogue AI agents accessing our platforms.”
Those two Morgan Stanley lines can both be true. Sources say the bank is blocking a class of login. The spokesperson says the bank has not watched a rogue agent on its platforms. Blocking a login the bank did not enroll is not the same as catching an agent that ignored the customer. Axios prints both, and does not pick.
@shanaka86 posted at 05:15 UTC on October 23. https://x.com/shanaka86/status/2113499603572334797. When I read it, that post had 24 likes, 9 reposts, 4 replies, 0 quotes, 7 bookmarks, and 9,738 impressions. The text says Axios names JPMorgan, Bank of America and Wells Fargo among banks racing to contain agent risks, and does not say which banks found unauthorized agents. Then it says the cases are generally customers who gave an AI agent their own login password. That is the distinction the post with 341,099 impressions does not make.
The log cannot name the instruction
Later in the same October 22 piece, sources say many banks are broadly not able to parse whether agent account activity is user-directed. One bank executive told Axios they struggle to tell agents apart, and to tell whether a user authorized an agent or an agent went rogue and got into an account.
The login succeeded because the password matched. From the bank’s side the session looks like the customer, because the customer gave the agent the secret the bank uses to recognize the customer. A password check answers whether the secret matches. It does not answer whether the person meant the transfer. It does not answer whether the model added a step the person did not ask for.
If the bank cannot tell those apart, then unauthorized and rogue are labels the log cannot support by itself. The headline on the piece is “Unvetted AI agents are accessing U.S. bank accounts.” Unvetted is a fair word for an agent the bank did not enroll. It is not a finding that the agent ignored the customer.
Most banks have authorized, or are moving toward, read-only access, so an agent can see financial information without taking action. Banks already grant that kind of access to apps like Quicken. Executives told Axios they know customers will want these agents, and that being too permissive is too risky for now. Read-only limits what the session can do. It still does not say who asked for the look.
I could not load the Reuters page from here. I could load the follow-up Axios published today. https://www.axios.com/2026/10/23/ai-catastrophe-wall-street. It says the activity is primarily driven by customers providing login credentials to agents, and that in some cases those agents appear to have taken actions independent of user prompts. It separates that from a summer attack on Hugging Face, where an agent swarm hacked a platform. The bank cases are not that story. Banks want customers to know they have not seen any rogue agent activity, or evidence of a hack affecting customer funds or accounts.
A JPMorgan spokesperson told Axios, in that second piece: “Under no circumstance should customers share passwords with any person or thing. Period.” Then: “There exist secure open banking platforms that don’t involve handing over the keys to your account. Customers are the first line of defense in protecting their accounts.” Plaid is named there as one platform that can pull balances and transaction history.
The block was already the policy
This did not start with the October 22 post. On October 13, JPMorgan CFO Jeremy Barnum spoke on the third-quarter earnings call. American Banker reported it the same day. https://www.americanbanker.com/news/jpmorgan-warns-of-risks-to-consumers-who-rely-on-ai-agents. I read that page today.
Barnum said some services that move money for customers rely on credential sharing, which Chase has long opposed. “It’s not secure, and so to the extent that we’re able to block those, we are blocking them to protect customers and protect ourselves.” That sentence is about services that ask for the password. It is nine days before the scoop, and it is already a block.
He also said the part the October 22 post calls unauthorized. “It’s important that customers understand that if they give up their credentials to the agent, and the agent does something that they don’t want, that’s going to be on them, and that’s sort of not an ideal state of things.” The quote puts the unwanted action on the customer who gave the password up. It does not say the log can sort the customer’s instruction from the agent’s.
Jamie Dimon, speaking in Chicago earlier this month, is quoted in today’s Axios piece. “You’re assuming they’re going to act properly on your behalf and they may not.” A shared password lets the agent act as the customer. It does not check that assumption.
The October 22 post is about detection. In the general case Axios describes, detection means noticing a login that used a password the customer gave away. Blocking that login is a real control. Chase said on October 13 it was already blocking money movement that depends on shared credentials, where it could. A block can refuse the session. It cannot tell you, after the fact, whether the thing the session attempted was what the customer asked for.
If the problem is an agent moving money the customer did not ask for, the password is the wrong witness, because matching is all it knows how to say. I would not hand an agent the login and then treat the word unauthorized as proof the agent went rogue.