Axios shared its reporting on X on October 22, 2026. This is the original reporting outlet’s post, not independent confirmation of every allegation.

Major U.S. banks are investigating unauthorized third-party AI agents accessing customer accounts, according to an October 22 Axios report. The institutions named include Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo. Reuters relayed the report but explicitly said it could not independently verify the allegations.

What Was Reported?

The reported activity involves software agents using customer credentials or permissions to interact with online banking systems. Some attempts appeared to go beyond the customer’s instructions, including contacts with support systems. Crucially, an agent acting without a bank’s authorization is not necessarily acting without its user’s permission. Nor does the reporting establish that four banks suffered confirmed intrusions, stolen funds or autonomous transfers.

The technical challenge is distinguishing an account holder’s direct actions, a properly authorized data connector and a third-party agent that uses credentials in a way the bank does not allow. That distinction matters because an agent can perform sequences of clicks and API calls much faster than a human, sometimes with incomplete understanding of what an action will do.

Why Banks Are Restricting Agent Access

Financial institutions have already been moving toward controlled, read-only data access rather than allowing outside AI agents to initiate payments. Earlier October reporting described bank policies designed to keep a human involved in money movement. These policy changes are documented separately from today’s still-unconfirmed allegations about independent agent behavior.

Secure approaches can include scoped permissions, transaction-specific consent, short-lived tokens, device verification, audit logs and explicit human approval for transfers. None of these measures by itself guarantees safety; the central engineering problem is ensuring that an agent’s authority never exceeds what the customer knowingly approved.

Key Takeaways

• Axios reports unauthorized third-party AI agent activity at major banks.
• Reuters says it could not independently verify the report.
• Customer-authorized access and bank-authorized access are not always the same.
• No confirmed theft or successful independent money transfer is established by the cited report.

Sources: Axios investigation; Reuters report.