--- title: "Banks Found AI Agents Inside Customer Accounts. Nobody Approved What They Did." date: 2026-10-30 author: "TheFrameGuy" featured_image: "https://www.meshiq.com/wp-content/uploads/blog-agentpatrol-banks-10302026.jpg" categories: - name: "AIOps" url: "/sort-by/aiops.md" - name: "Cloud Security" url: "/sort-by/cloud-security.md" - name: "Compliance" url: "/sort-by/compliance.md" - name: "meshIQ" url: "/sort-by/meshiq.md" - name: "Observability" url: "/sort-by/observability.md" --- # Banks Found AI Agents Inside Customer Accounts. Nobody Approved What They Did. **Key takeaways** - Major US banks are finding unauthorized third party AI agents inside customer accounts, signed in with credentials customers handed over themselves. The banks cannot reliably tell an agent from a human, or an approved agent from one acting past its brief. - Authentication answers whether an identity may enter. It cannot answer whether a specific action should run. Most banks responded by cutting agents down to read only access, which is containment rather than governance, and every enterprise running agents is about to face the same choice. - AgentPatrol™ by meshIQ governs agents in-flow. Every action is allowed, confirmed, escalated or denied before it runs, with a full audit record of who approved what. ## **What did US banks find inside customer accounts?** Bank security is built to answer one question with real confidence. Is this person who they claim to be? For thirty years that question carried most of the weight, because whatever got through the door behaved predictably once it was inside. In October, that stopped being true. On October 22, [Axios reported](https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access) that major US banks were detecting unauthorized third party AI agents operating inside customer accounts, with some attempting actions that appeared independent of user instructions. Morgan Stanley, Bank of America, JPMorgan and Wells Fargo were among the banks named. Executives described the situation as horrifying, and one said the industry has grave concerns about agents taking steps that could affect customer finances. The agents were not breaking in. They were signing in, using usernames and passwords that customers had given them. Morgan Stanley has started blocking third party agents from its platforms, while JPMorgan, Bank of America and Citi are restricting them, though a Morgan Stanley spokesperson said the bank has not observed rogue AI agents on its platforms. The detail worth sitting with came from one bank executive, who told Axios they struggle to tell agents apart at all, or to know whether a given agent was authorized by the customer or has gone rogue. The login told them nothing useful. ## **Why did a valid login stop being an answer?** Enterprise security has spent thirty years on a reasonable assumption. If an identity proves itself at the door, what happens inside is broadly predictable, because software did what it was told and people were accountable for the rest. Agents break that assumption in a specific way. An agent decides how to use its access once it is already inside the session. It reads a record, picks a tool, chains to a second system, and the route it takes was never written down in advance. Permission is granted once, at the door. The decisions happen continuously, deep inside. This is also why an agent exceeding its instructions is less mysterious than it sounds. The usual cause is prompt injection, where instructions hidden inside content the agent was asked to process, such as an email, an invoice or a web page, get treated as a new task. The agent was never compromised the way a laptop gets compromised. It was persuaded, and it was still holding every credential it needed to act on the persuasion. What you are left with is an identity that passed authentication, carrying real permissions, taking an action nobody approved. The access log shows a successful login and nothing out of place. ## **Is read only access governance, or containment?** Most banks converged on the same answer. Agents can look at balances and transactions. They cannot move money. Jamie Dimon [said on JPMorgan’s October 13 earnings call](https://fortune.com/2026/10/15/jamie-dimon-ai-agents-meta-muse-jpmorgan/) that outside agents would not be allowed inside the bank, Citi [confirmed](https://www.retailbankerinternational.com/newsletters/us-banks-limit-ai-agents-access/) that it does not permit third party AI agents or assistants to log into a customer’s account, and Charles Schwab CEO Rick Wurster [told Bloomberg on October 16](https://www.bloomberg.com/news/articles/2026-10-16/us-banks-block-ai-agents-attempting-to-move-money-for-customers) that the firm blocks large unauthorized agents dozens of times a week, Meta’s Muse among them. It is a sensible emergency measure and a poor permanent position. Banks did not choose read only because read only is the correct level of agent autonomy. They chose it because it was the only line they could actually enforce. When an organization cannot evaluate an individual action, its options collapse to allow everything or allow nothing, so it picks nothing and calls that AI risk management. Every enterprise is heading for a smaller version of the same decision. Security cannot say which agent actions are safe, so agents get confined to drafting and summarizing, the automation business case quietly evaporates, and the agents that matter get built anyway by teams that stopped asking. Shadow AI is not a discipline problem. It is what happens when the only governance on offer is a blanket no. ## **What does an AI governance framework actually have to do?** Governance that survives contact with real agents answers a different question. Not whether an identity can get in, but whether this specific action should run, right now, in this context. That breaks into four requirements. 1. **Explicit Authorization Per Action Class:** A human delegates a bounded task, not an account. Moving money, deleting records, sending external messages and granting access each need their own standing permission, held separately from the ability to read. 2. **Bounded Permissions That Expire:** An agent should carry its own identity rather than borrowing a person’s, with scopes narrow enough that an injected instruction has nowhere useful to go. Today most agents inherit a human’s credentials, which is precisely how one tricked agent becomes a breach. 3. **Independent Monitoring:** The agent cannot be the thing that reports on the agent. In October, NIST, CISA and the NSA published [ten voluntary practices](https://www.nist.gov/news-events/news/2026/10/key-practices-incident-readiness-and-response-super-intelligence-training) for responding to agents that act without instruction, and one of their points is that AI powered monitoring tools introduce vulnerabilities of their own. Monitoring belongs outside the thing it watches. 4. **Revocation That Reaches:** Cutting access means nothing if the agent holds a token that outlives the session, or has already handed work to a second agent nobody knew about. Revocation has to reach everything the original grant touched. Underneath all four sits a fifth requirement, and it is the one most organizations fail. You need to trace any agent action back to the human whose authority it used. In a 2026 Cloud Security Alliance survey, [only 28 percent of organizations](https://labs.cloudsecurityalliance.org/agentic/agentic-identity-governance-framework-v1/) could do that across all their environments. ## **Why can an AI gateway not see the action?** This is where most AI governance tools run out of road. A gateway sits between the agent and the model, or between the agent and an external endpoint, and inspects what passes through it. That is useful for the traffic it can see. The difficulty is how much of an agent’s work never passes through it. Tools that run inside the agent, direct connections to databases, message queues and file systems, and calls to MCP servers that teams stood up themselves all execute without touching the gateway. MCP security is a live concern for exactly this reason. The protocol agents use to reach tools has become a path around controls built for a different era. A gateway governs what an agent sends. It does not govern what an agent does. The second limitation is timing. Most of what gets sold as an AI governance platform records what agents did, scores it and routes it to a review queue. That is valuable for audit and useless for prevention, because by the time the record exists the money has moved or the data has left the building. A dashboard telling you an agent transferred $50,000 is a report. A control that holds the transfer until a named approver signs off is a guardrail. AI runtime security means the narrower, harder thing. Every tool call and every data request is evaluated against policy before it executes, and an action that violates policy never runs. ## **What changes when governance runs in-flow?** [AgentPatrol™](https://www.meshiq.com/products/agentpatrol/) runs inside each agent’s execution path and checks every action against policy before it runs, resolving it to allow, confirm, escalate to a named approver, or deny. Because it sits inside the agent rather than outside it, policies can read the actual values inside a tool call rather than only the name of the tool. A refund agent can process a $50 refund on its own, ask the user to confirm at $1,500, and wait for a supervisor at $5,000. Compliance teams set those thresholds centrally in the console, so developers are not coding approval logic into every agent by hand. That same control plane answers the three problems the bank story exposed. - **Discover:** Every agent, MCP server, tool and credential already running, including the ones nobody registered. - **Constrain:** Action-level policy that allows, requires approval, rate limits or blocks, enforced before the action executes. - **Prove:** An immutable, replayable audit of every prompt, tool call, data touch and outcome, which is the record that answers who authorized what. It also maps agent behavior to the EU AI Act, the NIST AI risk management framework and your own internal risk framework. It works across the frameworks teams have already chosen, including LangGraph, the OpenAI Agents SDK, CrewAI, AWS Strands and Google’s Agent Development Kit, so governance is not a reason to make everyone standardize on one stack. ## **Why does a middleware company build AI agent governance?** Agents are not replacing the systems underneath them. They are acting on them, through the same messaging and integration layer that has carried orders, payments and claims between enterprise systems for decades. MeshIQ has spent 25 years making that traffic visible and governable, for customers including 7 of the world’s top 10 banks. AgentPatrol™ applies the same discipline to the newest kind of traffic moving through it. The banks are learning in public what every other industry will learn quietly, in an audit, months later. Agents were given access long before anyone decided what authority that access carried. The organizations that close that gap first will be the ones still saying yes to AI when everyone else has retreated to read only. ## ********See every agent already acting inside your enterprise******** AgentPatrol™ discovers the agents running in your environment, registered or not, and checks every action against policy before it executes. meshIQ is running 30 day proofs of concept on customers’ own agents and frameworks. [Book a Demo](https://www.meshiq.com/request-a-demo/) ## **Frequently asked questions** **Q1. Were these AI agents hacking customer bank accounts?** No. The agents were signing in with credentials customers gave them. What the banks found were actions taken inside legitimately authenticated sessions that nobody appears to have authorized, which is a governance failure rather than a breach. **Q2. **What is AI agent governance?**** AI agent governance is the set of controls that decide what an AI agent is allowed to do, record what it did, and prove who approved it. **Q3. How is in-flow governance different from an AI gateway?** A gateway sits outside the agent and only sees traffic routed through it. In-flow governance runs inside the agent’s execution path, so it sees every call however it is made, and it can pause or stop an action before it runs. **Q4. ****Does governance slow agents down?****** It does not have to. With policies based on the values in each call, low risk actions run on their own and only high impact ones wait for a person **Q5. ****Where can I see AgentPatrol™?****** meshIQ is running 30 day proofs of concept on customers’ own agents and frameworks. [Contact us](https://www.meshiq.com/request-a-demo/) to learn more.