Axios reported this morning that unvetted AI agents are accessing U.S. bank accounts: major banks are detecting third-party agents inside customer accounts, some of them taking actions that appear to be independent of what the customer asked for. One bank executive told Axios the banks struggle to tell whether an agent was authorised by a user or has gone rogue. That sentence is the whole story. The agent logged in with valid credentials. Nothing in the login says what it was allowed to do, who allowed it, or what it did next.
What Axios Reported
The scoop, by Madison Mills, says that banks including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are racing to contain agent risk. Morgan Stanley has begun blocking third-party agents. JPMorgan, Bank of America and Citi are restricting them. In some cases the tools contacted bank call centres. In others, banks tracked activity in which agents appeared to act independently of user instructions [1].
The access method matters. Axios describes agents operating inside a customer's account with the user's permission and login credentials, which goes against most banks' rules requiring humans to log in to their own accounts. Most banks, it says, have authorised or are moving toward allowing read-only access, the model already used by apps such as Quicken, while rewriting terms of service and drawing up plans to restore customer access if they have to cut agents off [1].
What is confirmed, and what is not
This is a single-outlet scoop built on anonymous sources. Axios reports no confirmed unauthorised transactions, no count of incidents or customers, and no named agent products. Morgan Stanley's spokesperson told Axios the bank has not observed instances of rogue AI agents accessing its platforms. A Chase spokesperson said customers should not give their usernames and passwords to anyone [1]. TFTC likewise notes that no widespread unauthorised fund transfers have been confirmed [3]. The risk is a documented control gap, not a documented loss.
The Credential Is Not an Identity
For twenty years, a bank could treat a valid login as a proxy for a person. (We have argued before that identity alone cannot govern AI agents.) A password, a device and a second factor said: this is the customer. An agent that holds the customer's password, or drives a browser logged in as the customer, inherits all of that trust. To the bank's systems it is the customer. The customer may have meant it to book a transfer. It may also have been steered by a hostile web page, misread an instruction, or been run by a vendor the customer has never heard of.
JPMorgan's Jeremy Barnum, in IBTimes' account of the bank's latest earnings call, said some outside services reach accounts through credential sharing or screen scraping, which the bank considers insecure and blocks where possible, and that it is developing more secure ways to support them [2]. Jamie Dimon was blunter. IBTimes quotes him: "We're not going to allow just any outside agents to come in inside the company" [2]. TFTC, citing the same call, reports Dimon warning that "you don't want rogue agents, and there could be thousands of them" [3].
Both are right about the problem. But blocking by credential pattern is a blunt tool. It stops the agents that look like agents and misses the ones that behave like a person with a browser. And it solves nothing for the agents the bank wants to allow.
Who Pays When an Agent Gets It Wrong
IBTimes reports that Barnum cautioned customers could face consequences if they hand credentials to an agent that carries out a transaction they did not want [2]. The legal position is less settled than the rhetoric. Regulation E defines an unauthorised electronic fund transfer by reference to whether the person who initiated it had the consumer's authority, and its definition carves out transfers by a person the consumer furnished with access, until the consumer notifies the bank [4]. TFTC's reading is that no published OCC, Federal Reserve or FDIC rule addresses agent authorisation or liability, and that who bears agent-initiated losses is genuinely open [3]. That is analysis, not a legal conclusion. The CFPB's Section 1033 rulemaking on personal financial data rights deals with data access, not payment initiation [5].
Whatever the courts and regulators eventually decide, every answer depends on the same evidence: was this agent authorised, by whom, for what, and what exactly did it do? A bank that cannot produce that record cannot defend a refusal, and cannot prove a claim either. Liability will be argued from logs. Today the logs do not exist in a useful form.
Read-Only Is the Right First Step, Not the Last
Moving toward read-only access, as Axios describes, is a sound instinct. An agent that can see balances and categorise spending cannot move money. It also shrinks the blast radius of a wrong guess. But it leaves three questions open. How does the bank know an agent really is read-only if the credential behind it is a password? What happens when customers want an agent that pays bills or moves deposits, which is exactly what Barnum said personal agents will want to do [2]? And what about the agents the bank runs itself?
That last question is the one that gets overlooked. Banks are deploying their own agents across operations, fraud, service and engineering, many built on third-party models and tools. The population inside the perimeter is growing as fast as the population knocking on the door. A control that only watches the door is half a control.
The Control That Is Missing: An Agent Ledger
The right frame is not blocking agents. It is accountability for agents. Every agent that touches a regulated system, whether the bank built it or a customer brought it, needs a standing entry in a ledger, and every action needs a record that is hard to alter after the fact. That is the layer Helixar works on.
A bank-grade agent ledger records six things.
| Ledger field | Why an auditor will ask |
|---|---|
| Agent identity | Which agent, which vendor or build, which version. "Unknown" is a valid and visible state. |
| Principal and delegation chain | The human or system that authorised it, and each hop of authority between them and the action. |
| Credential path | Shared password, screen scraping or scoped token. This is the line the banks are drawing. |
| Scope and limits | Read-only or transact, which accounts, which amounts, which hours. |
| Action and policy decision | What it tried, and whether it was observed, alerted, held for approval or blocked. |
| Tamper-evident evidence | A record that an auditor or regulator can verify without trusting the bank’s own say-so. |
Internal agents: govern before the action runs
For agents the bank operates, Helixar acts as an AI control plane. Policy is evaluated on each agent action before it runs, with a graduated response of observe, alert, require human approval, or block. It is fail-closed by default, so an action that cannot be evaluated does not proceed. Each decision is written to a tamper-evident evidence trail that can be verified independently and offline. The agent inventory, owners and scopes live in the same place as the decisions. See what an AI control plane is and AI governance for banks.
External agents: make authority explicit, and observe the rest
For agents acting for customers, the bank does not control the agent, so the ledger has to do two different jobs. First, where an agent can present a delegation, the record should say who delegated what. Helixar Labs publishes HDP, the Human Delegation Provenance protocol, as an open specification: a signed record of the human authority behind an agent's action, verifiable offline, that is a record and never an input to an access decision [8]. It gives a bank a standard shape for an answer to "on whose authority?" that today lives only in a customer's intentions.
Second, where an agent presents nothing, the bank still needs to see it. Behavioural classification of sessions, the same sequence-aware detection described in today's companion piece on AI-found vulnerabilities, can label a session as a likely automated agent, route it to a read-only posture or step-up verification, and record that it did. An unidentified agent becomes a visible, recorded exception rather than an invisible customer.
Neither half is magic. A ledger does not make an anonymous agent trustworthy. It makes every agent either attributable or visibly not, and it keeps the bank's response on the record. That is the difference between a policy and an audit position.
Mapped to the Frameworks Auditors Use
Regulated institutions do not adopt controls because they are elegant. They adopt them because they map onto the frameworks that examiners and external auditors already test against. The ledger is designed to produce evidence for those frameworks. It does not replace the institution's own control framework, and the compliance obligations remain the bank's.
| Framework | What it asks for | Ledger evidence | Status |
|---|---|---|---|
| SOC 2 (Trust Services Criteria) | Logical access, change and monitoring controls that operate over the audit period | Per-agent access decisions and continuous operating evidence, not a point-in-time sample | Evidence pack available today |
| ISO/IEC 27001 | Access control, logging and monitoring for information assets | Agent identity, scope and action records tied to access-control and logging controls | Evidence pack available today |
| NIST AI RMF | Govern, map, measure and manage AI risk, including accountability | An inventory of agents with owners, scope and measured behaviour | Mapped and delivered at implementation |
| ISO/IEC 42001 | An AI management system with accountability and records | Documented agent lifecycle, authorisation and decision records | Mapped and delivered at implementation |
| Interagency third-party risk guidance (OCC 2023-17) | Due diligence and ongoing monitoring of third-party relationships | A register of external agents and the delegations behind them, with monitored behaviour | Mapped and delivered at implementation |
| APRA CPS 234 and CPS 230 (ANZ banks) | Information security and operational resilience, including service providers | Controls that operate on every agent action, with incident reconstruction evidence | Mapped and delivered at implementation |
The status column is deliberate. SOC 2 and ISO 27001 evidence packs are available today. Mappings to the other frameworks are produced at implementation, tailored to each institution's control framework. The third-party row reflects the interagency guidance on third-party relationships [6]; the NIST row reflects the AI Risk Management Framework [7]. Helixar does not claim certification against any of them, and nothing here guarantees audit acceptance.
The Bottom Line
The banks' instinct to restrict is understandable and, for now, necessary. But a restriction that depends on guessing which sessions are agents is a defence that degrades as agents get better at looking human. Customers will not stop delegating to agents. Banks will not stop deploying their own. The institutions that come through this well will be the ones that can answer, for any agent, on any day: whose authority did it carry, what was it allowed to do, what did it do, and can you prove it.
The login told the bank who was there. It never told the bank who sent them. The ledger is how that changes.
Takeaways
- Axios reports unvetted agents in customer accounts; no confirmed losses, and at least one bank disputes the framing.
- A valid credential proves a login, not authority. That is the gap.
- Liability for agent actions is unsettled. Evidence of authorisation and action will decide cases.
- Read-only is a good start. Internal agents and transacting agents still need governance.
- An agent ledger, mapped to audit frameworks, turns an unmanaged risk into an auditable one.
Unvetted AI Agents and Bank Accounts: Frequently Asked Questions
Are AI agents accessing U.S. bank accounts?
Axios reported on October 22, 2026, citing anonymous sources, that major U.S. banks are detecting unvetted third-party AI agents inside customer accounts, some taking actions that appear independent of the customer’s instructions. It reported no confirmed unauthorised transactions. Morgan Stanley told Axios it has not observed rogue AI agents accessing its platforms.
Which banks are blocking or restricting AI agents?
Per Axios, Morgan Stanley has begun blocking third-party agents, and JPMorgan, Bank of America and Citi are restricting them. Wells Fargo is named among banks responding, but Axios gives no specific action for it. Most banks have authorised or are moving toward read-only access.
How are AI agents getting into bank accounts?
Axios describes agents using the customer’s own permission and login credentials, which most banks’ rules do not allow. IBTimes reports JPMorgan’s CFO saying some outside services use credential sharing or screen scraping, which the bank considers insecure. Sources give no detail on tokens or APIs.
Who is liable if an AI agent makes an unauthorised transaction?
It is unsettled. JPMorgan executives have warned customers may bear consequences when they give credentials to an agent. Regulation E defines unauthorised electronic fund transfers by reference to the consumer’s authority, with an exception for people the consumer furnished with access until the bank is notified. One analysis says no published OCC, Federal Reserve or FDIC rule yet addresses agent liability. This is not legal advice.
What is an AI agent ledger?
A ledger is a record, kept for every AI agent that touches a regulated system, of its identity, the person or system that authorised it, the delegation chain, the credential path, its scope and limits, each action and policy decision, and tamper-evident evidence. It lets a bank answer who authorised an agent, what it was allowed to do and what it did.
Which audit frameworks does agent evidence map to?
SOC 2 and ISO 27001 evidence packs are available today from Helixar. Mappings to NIST AI RMF, ISO/IEC 42001, the interagency third-party risk guidance and APRA CPS 234 and CPS 230 are produced at implementation. Helixar does not claim certification against any framework, and compliance obligations remain the institution’s.
References
- Axios (Madison Mills). Scoop: Unvetted AI agents are accessing U.S. bank accounts (22 Oct 2026), as syndicated by Yahoo Finance. finance.yahoo.com/technology/ai/articles/scoop-unvetted-ai-agents-accessing-090006442.html
- IBTimes. AI Agents Are Accessing U.S. Bank Accounts Without Their Approval. Lenders Are Pushing Back (22 Oct 2026). www.ibtimes.com/ai-agents-are-accessing-us-bank-accounts-without-their-approval-lenders-are-pushing-back-3808868
- TFTC. Major Banks Can’t Tell You From Your AI Agent, and That’s the Problem (22 Oct 2026). Analysis and commentary. www.tftc.io/rogue-ai-agents-bank-accounts-liability-credential-problem
- Consumer Financial Protection Bureau. Regulation E, 12 CFR 1005.2 Definitions, including "unauthorized electronic fund transfer". www.consumerfinance.gov/rules-policy/regulations/1005/2/
- Consumer Financial Protection Bureau. Required rulemaking on personal financial data rights (Section 1033). www.consumerfinance.gov/rules-policy/final-rules/required-rulemaking-on-personal-financial-data-rights/
- OCC Bulletin 2023-17. Interagency Guidance on Third-Party Relationships: Risk Management. www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html
- NIST. AI Risk Management Framework. www.nist.gov/itl/ai-risk-management-framework
- Helixar Labs. HDP: Human Delegation Provenance protocol specification. helixar.ai/about/labs/hdp/