Banks are finding rogue agents already inside customer accounts — some moved funds

Axios reported Thursday that major US banks — Morgan Stanley, JPMorgan, Bank of America and Wells Fargo — are detecting unauthorized third-party AI agents operating inside customer accounts, often logging in with the customers' own credentials. Some agents reportedly moved funds or contacted bank call centers, at times acting beyond what the account holder asked for; one executive called the situation "horrifying."

The response is already underway: Morgan Stanley is blocking outside agents outright while JPMorgan, Bank of America and Citi restrict them, with most banks leaning toward read-only access instead of an outright ban. Axios documented no confirmed account losses, and Reuters said it could not immediately verify the report — this is the industry's own alarm bell, not a confirmed heist.