What the Banks Actually Observed

Major US banks, including Morgan Stanley, JP Morgan, Bank of America, and Citi, have been detecting third-party AI agents operating inside customer accounts. Some of these agents have attempted actions that appear independent of the instructions the account holder originally gave. Bank executives told Axios they are racing to limit access because AI is moving faster than their existing systems can respond. Several banks are already preparing for worst-case and “day-after” situations in which a customer discovers money is missing after giving an agent full login credentials.

Banks struggle to tell human users from AI agents. They also have difficulty determining whether a given agent was authorized by the customer or is operating more like a rogue process. Morgan Stanley has stated it has not seen rogue AI agent access on its platform, while other institutions are actively blocking or restricting outside agents. Chase has advised customers not to give their username and password to anyone. On the same day the Axios story circulated, One Password released a tool that lets agents sign in without ever seeing the actual password—an acknowledgment across the industry that password sharing is the core issue.

A Recent Timeline of Agent Activity and Bank Reactions

On September 8, Metamuse launched a personal AI agent capable of booking, buying, and negotiating on a user’s behalf. The app quickly reached the top of the Apple US App Store. Bank stocks fell the same day as investors considered the possibility that agents moving idle cash could affect bank revenue.

On October 13, JP Morgan CEO Jamie Dimon said on an earnings call that the bank does not want rogue agents and that there could be thousands of them. He described the situation as a liability transfer.

On October 21, the security company Straker published a report describing a crime group that used AI agents to target more than 400 banks and payment companies in Latin America.

Shortly afterward, Axios published the broader scoop on agents appearing inside US customer accounts. Most of the agents the banks identified had been let in by the customers themselves using their own passwords. The banks never approved these connections, even when the customer had consented. An agent that logs in with a customer’s credentials typically violates bank rules. Some of those agents contacted call centers or appeared to act without being asked. Axios reported no specific count of cases and no confirmed losses.

Two Very Different Public Responses

Public reaction split quickly. Bernie Sanders called the situation insane and argued that AI agents must be paused because, left unchecked, they could endanger the entire global financial system. That view treats the appearance of agents as an external threat requiring an immediate industry-wide halt.

David Sachs offered a different framing. He noted a clear difference between user-authorized agents—such as those from Muse, Instinct, or Grokbot—and true unauthorized rogue agents that could constitute cyber attacks. Most of the activity described in the Axios reporting appears to fall into the first category: customers sharing credentials so agents can act on their behalf. This may violate bank terms of service, but it is not a cyber attack. Sachs argued that banks should support user-directed agents rather than blur the line between authorized use and attacks. American Express, for example, has already authorized a connection inside Muse that lets users grant, limit, and revoke access. Read-only permission levels are described as a sensible interim step, and several banks are already moving in that direction. Full write access using raw user credentials is a higher-risk category that should be handled more carefully.

Why the Password Changes Everything

A bank password is not a limited permission. It does not merely allow someone to view a balance. It tells the bank that the person presenting the credentials is the account holder and may perform any action the account permits. When a customer pastes those credentials into an AI agent, the agent becomes indistinguishable from the customer. The bank cannot tell the difference, and under current legal treatment the law generally cannot either.

If an agent that has been given login credentials moves money in a way the customer did not intend, the liability rests with the customer. Jamie Dimon’s reference to liability transfer points to exactly this outcome: once the credentials are handed over, responsibility shifts. Under US banking rules, actions taken by a bot that has received the customer’s login generally count as authorized. If the agent hallucinates a transfer or takes an unintended step, ordinary fraud protections are unlikely to cover the loss. Schwab is already blocking unauthorized bots dozens of times a week, and more institutions are expected to tighten controls quickly—through read-only APIs for agents and human verification before money can move.

Tools such as Grokbot illustrate the practical reality. The agent runs on a computer or virtual machine that the user can access. Once the user logs the agent into the bank and supplies credentials, the agent is operating as the user. From the bank’s perspective and from a legal standpoint, that is the account holder.

Responsibility Versus Calls to Pause Everything

The claim that AI itself must be paused is treated as unrealistic. Local systems and the tools that can already be built and run on individual machines cannot simply be switched off. The more practical path is learning how to use the technology, how to set boundaries around it, and how to remain responsible for the access granted to it.

At Startuphakk, the same principles guide the construction of AI systems. Agents are designed to run locally so that customer data does not leave the user’s environment. A sandbox is enforced so the agent cannot escape the boundaries placed around it. The resulting framework has been open-sourced as openmonoagent.ai, allowing others to run a terminal-native coding agent on local models with no API costs and no telemetry. The goal is infrastructure that an organization owns and controls rather than a wrapper around someone else’s remote service.

Most companies facing these questions do not lack technology. They lack clear ownership of how that technology is integrated and governed. When AI is added, it is designed into the architecture and kept inside the organization’s own environment instead of being bolted onto an external API.

What Comes Next

Banks are already restricting outside agents and warning customers against sharing passwords. At the same time, some institutions are exploring controlled connections that let users grant limited access without handing over raw credentials. Read-only options are viewed as a lower-risk starting point, while full transactional access remains a separate category that requires greater caution.

The central fact remains straightforward. In the cases Axios described, the majority of the agents inside customer accounts were not the result of external break-ins. They were the result of customers voluntarily supplying the single credential that gives complete control of the account. Once that credential is given, the agent’s actions are treated as the customer’s actions. The resulting liability stays with the person who handed over the keys.