Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some that appear to act independently of what the customer told them to do, Axios reports, citing unnamed bank and industry executives. For anyone who has handed an assistant or browser agent a banking login, it matters because those executives say banks are racing to restrict that kind of access, and the independent-action reports are so far unexplained.

Axios sources the report to multiple industry and bank executives who spoke without being named. Those executives say the findings have alarmed banking leaders, who feel AI is moving faster than financial institutions can respond. Several banks are reportedly preparing for worst-case and even "day after" scenarios, including how to quickly secure or restore customer accounts if things go wrong.

The hard part is telling agents from people

Several executives told Axios they are struggling to distinguish human users from AI agents. One said banks also cannot easily tell whether an agent was authorized by the customer or is operating without permission, which the executive likened to rogue-agent behavior. Bank security systems were built to separate people from bots; an agent acting on a customer's behalf sits in between.

Our read: the story is less about science-fiction rogue AI than about identity. If a bank cannot tell who or what is behind a session, it has little basis for deciding what that session should be allowed to do.

What to check if you use an agent with your accounts

The practical takeaway is to look at your bank's terms before you share credentials with any assistant or browser agent. Ask your bank how it treats agent access before relying on it, and who bears the loss if an agent-driven action goes wrong.

Source: @MadisonMills22 on X

Sources