On Oct. 22 Axios reported that major US banks were detecting unvetted third-party AI agents inside customer accounts, some appearing to act beyond user instructions. White House AI adviser David Sacks replied on X that this was mostly customers giving agents their credentials, possibly breaking bank terms but in no way a cyberattack, and suggested read-only access as the middle ground.
For builders of consumer agents the dispute decides whether credential-based banking automation is a tolerated grey zone or a blocked channel, and what a sanctioned integration looks like. The open question was whether any bank has documented concrete agent actions or defeated controls.
What we checked
- Which banks have documented agent activity, what actions were performed, and what permission or loss controls were actually bypassed? partly confirmed. Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and Citi are named as restricting agents and Schwab reports 30-50 blocked logins a week per agent, but no incident is tied to a named bank. Described actions are call-center contacts and unexplained actions; the only control shown to be bypassed is the terms-of-service rule that humans log in themselves, with no losses reported. [1][2][4]
- Is the activity mostly user-authorized credential sharing rather than intrusion? (own) partly confirmed. The Axios reporter, Sacks and Morgan Stanley all point to credential sharing without losses, but Axios also says banks cannot tell user-directed from rogue activity, so the split is asserted rather than measured. [1][2][3]
What we found
- Axios's Oct. 22 scoop, the root source, names Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and Citi as restricting or containing third-party agents, but ties no specific incident to a named bank. The only concrete actions it describes are agents contacting call centers and actions that appear independent of user instructions, attributed to unnamed people. It also says many banks cannot tell whether agent activity is user-directed at all. [1]
- Neither the reporter nor the banks describe losses or account takeovers. Axios's reporter told CBS the agents were not hacking accounts or draining funds, and Morgan Stanley said it had seen no unauthorized agent activity. David Sacks's X post reads the activity as customers sharing credentials, which may breach bank terms but is not a cyberattack. [2][3]
- Schwab is the only firm that has put numbers on the record: its CEO said a particular agent tries to log in 30 to 50 times a week and is blocked by technology, and that Schwab lets LLMs connect but not move money. That describes blocked credential logins, not a bypassed permission or loss control. [4]
- The sanctioned alternative already exists at scale. Robinhood's Trading MCP confines agent orders to a dedicated account, reports over 150,000 agentic accounts, and ships trade approvals off by default for external agents while disclaiming oversight of agents. Schwab is building its own MCP pathway with read-only scope for outside tools. [5][6][4]
What it means
Treat credential-stuffing into bank web sessions as a dead end: banks are actively blocking it, it breaches terms, and liability for any agent mistake lands on the user and you. Nothing on record shows a security breach, so the pressure is contractual and commercial rather than regulatory, but that is enough to break your product.
Build for scoped, revocable access instead: read-only open-banking aggregators for spending insight, and broker or bank MCP servers where they exist, with dedicated accounts, per-action approvals and audit logs on your side even when the platform defaults them off.
Competing readings
- Mostly user-authorized credential sharing: a terms-of-service and liability fight, not a security incident (likely, about 60%). What would tell it apart: Reporter, Sacks and Morgan Stanley describe credential sharing with no hacking or lost funds [2]; Schwab's on-record numbers are blocked login attempts, not breaches [4].
- Agents are taking genuinely unauthorized actions that banks have not yet disclosed (unlikely, about 25%). What would tell it apart: Axios's sources describe actions independent of user instructions [1]; Banks admit they cannot tell user-directed from rogue activity [1].
- Blocking is mainly about channel control, pushing customers to bank-run assistants and scoped MCP servers (very unlikely, about 15%). What would tell it apart: Schwab bars money movement while building its own MCP pathway [4]; A broker that embraced agents runs them at scale in confined accounts [5][6].
Base rate
The New Runtime archive holds only 0 earlier access-change stories about companies, people or products from the last 12 months that are at least 3 months old: too few (minimum 5) for a base rate. The archive has 0 cases and 0 matches for this pattern, too few to say anything, so this analysis does not lean on a base rate.
What would change this view
- A bank, regulator or court filing documents customer losses caused by an agent using shared credentials (signal): The security framing is real, not only a terms-of-service dispute.
- A major bank launches a write-capable agent API or MCP server that can move money (signal): Banks are blocking an unsanctioned channel, not agent actions as such, supporting the channel-control reading.
- Banks formally deprecate or prohibit screen-scraping access for agents in published terms (deprecation signal): Credential-based agents face a hard shutdown rather than case-by-case blocking.
Still open
- Which specific bank observed agents calling its call center, and what did those calls request?
- Has any customer lost money through an agent acting on shared credentials?
- Will banks publish write-capable agent APIs, and with what liability terms?
- How do banks detect agent logins, and how often do they misclassify humans?