The Agent Is Not the Intruder. The Password Is.

23 October 2026 · Thomas Christian Melskens · yellow3 Lab

What happened

On 22 October, Axios reported that major US banks are finding third-party AI agents inside customer accounts, some of them apparently attempting actions their users never asked for. Within a day the story was circulating on TikTok as a tale of rogue AI breaking into bank accounts.

That is not what the reporting describes. In the cases Axios outlines, the agent did not break in. The customer gave it the username and password.

The more useful question is why a bank cannot tell its own customer from that customer's software. The answer is a design choice, not an AI problem, and Europe made a different choice seven years ago.

What the record supports

The restrictions are real and well documented. The alarming detail is thinner than the headlines suggest.

US banks are restricting outside agents: Confirmed. JPMorgan said so on its earnings call on 13 October. Schwab has also confirmed restrictions, and Citi and Bank of America were reported on 16 October. Axios sources say Morgan Stanley has begun blocking. (Banking Dive, Retail Banker International)
Agents are operating inside accounts: Confirmed in general terms. Access typically starts with customers sharing their own login details. (Cybersecurity News)
Agents acted independently of user instructions: Reported by unnamed sources. No case detail has been published.
Customers have lost money: No losses or totals have been disclosed.
Every named bank has seen rogue agents: No. A Morgan Stanley spokesperson told Axios the bank has not observed them.
Agents are banned outright: Mostly not. Read-only access, the kind long granted to budgeting apps, is broadly allowed or heading that way.

One password, three possible actors

When a login arrives with the right username and password, the bank sees one thing. Behind it may be the customer, an agent the customer authorised, or someone who stole the credentials. All three present the same key.

That is the problem Axios describes. One bank executive told the outlet they struggle to tell whether an agent was authorised by a user or has gone rogue. Most bank terms also require customers to log in themselves, so even a fully consented agent breaches the contract.

Seen this way, blocking is not an overreaction. It is the only lever available when the only credential in the system belongs to a human. Jamie Dimon framed the consequence plainly on JPMorgan's call: customers who let agents in take on a "liability transfer". The risk does not disappear. It moves to the person least able to carry it.

The other reason banks care

Security is not the only motive, and readers should weigh both. Meta's Muse, launched in September, reads accounts through Plaid on a read-only basis and can pay through Stripe's Link. Within about ten days it was the most downloaded free iPhone app.

An agent that sees every account can also see which one pays the least interest. The Financial Times reported that banks fear agents will shift idle cash to higher returns, according to Retail Banker International.

Meanwhile JPMorgan is piloting Smart Cash, its own tool that forecasts cash flow and moves funds to maximise yield. That is close to the job outside agents are being kept from doing. It need not be cynical, but the security case and the deposit case point in the same direction, which makes each harder to judge on its own.

Europe closed this door in 2019

The EU faced a version of this problem a decade ago, with budgeting apps rather than AI agents. Its answer under PSD2 was to end unidentified screen scraping of payment accounts. Since September 2019, regulated third parties must identify themselves to the bank and access payment accounts with the customer's consent through a compliant interface. Banks can offer a dedicated interface or an adapted customer interface, with fallback arrangements where required. This creates an identified access route rather than treating a third party as the customer. It is not a universal prohibition on third parties handling credentials.

The US never built the equivalent. Its open banking rule under Section 1033 was finalised in October 2024, then enjoined by a federal court and reopened by the CFPB. The first compliance date, 1 April 2026, passed without becoming enforceable. In practice, many US consumer tools still run on shared credentials, and agents have inherited that habit.

Europe's next step is in sight. PSD3 and the Payment Services Regulation were politically agreed on 27 November 2025, with final texts published in April 2026 and adoption expected in the second half of this year. The package keeps the scraping ban, adds a dashboard where customers see and revoke third-party access, and will apply from around 2028.

This is not immunity. Europe's rails were built for licensed fintechs, not general-purpose assistants, so an agent needs a licence or a licensed partner to use them. Nothing physically stops a European customer typing a password into an agent. What differs is that the sanctioned door exists, and strong customer authentication means a password alone should not move money.

What a proper door looks like

The global standard-setters have already sketched it. On 15 October the Financial Stability Board finalised twelve non-binding practices for AI in finance, asking firms to set clear, risk-based triggers for when an agent must get human approval. It gives financial transactions above a certain value as an example, alongside limiting access to the systems and tools an agent needs and documenting its actions. The final report no longer includes the draft suggestion of treating agents as "synthetic employees".

Translated to a customer's account, a workable model has five parts:

Its own identity. The agent presents a credential of its own, never the customer's password.
Scoped permissions. Reading and acting are separate grants, and the default is reading.
A human gate on money. Payments above a set threshold need the customer's explicit approval.
A shared record. Customer, bank and agent provider see the same log of what was done.
Revocation in one place. The customer can switch any agent off without changing a password.

The door, not the guest

America's banks are right to stop strangers walking in with a customer's key. They will be wrong if they treat the lock as the strategy. Bank executives already told Axios that customers will keep wanting agents and that a middle ground is needed.

The question was never whether agents enter finance. It is which door they use, whose identity they carry, and who signs before money moves. Europe built that door for apps and now has to widen it for agents. The US still has to decide whether open banking is a rule or a private deal.

Until then, the agent is not the intruder. The shared password is.