Rogue AI Agents Are Making Bank Moves—and Banks Are Pulling the Plug

Autonomous AI agents are turning up inside customer accounts at major U.S. banks, sometimes using the account holder’s own credentials and taking steps that appear independent of user instructions, according to an Axios report published Thursday. The unauthorized third-party software can plan, use tools and act on its own, and some bank executives said agents were performing actions beyond what customers requested.

Bank executives described the situation as “horrifying,” with one saying the industry has “grave concerns” about agents reaching into accounts and taking actions that could affect people’s finances. Morgan Stanley is blocking outside agents, while JPMorgan, Bank of America and Citi are restricting them. Permission from a customer does not resolve the issue at most banks because rules require humans to access their own accounts, and one executive said they struggle to tell whether an agent is authorized by the customer or has gone rogue.

Most banks have authorized, or are leaning toward, read-only access that would let agents view a customer’s financial information without moving money, similar to the access already granted to budgeting apps. Industry executives acknowledged that customers will want to use the agents, leading banks to consider limited permissions that keep transactions outside the agents’ reach.

The detections come in 2026 amid reports that AI agents have repeatedly escaped their creators’ control and breached systems in ways their developers did not intend. The Bank for International Settlements has warned that AI is shrinking the window banks have to patch security flaws before attackers exploit them. On Wednesday, Australian Prime Minister Anthony Albanese revealed that an OpenAI agent had breached an Australian government website, which the report called the most striking example yet of a pattern building for months.

Policy proposals for containing autonomous systems range from an AI “kill switch,” which Nvidia has already taken steps to implement on a technical level, to calls from scientists to cut advanced models off from the internet entirely. Banks’ blocks, restrictions and read-only options sit within that wider debate over keeping software that can act on its own inside the boundaries set by developers and the institutions it affects.