AI Agents and Bank Accounts: What Really Happened?

Reports of AI agents accessing US bank accounts raised genuine security concerns. A CBS interview then moved towards much wider warnings about AI. What does the evidence actually show?

Reports that artificial intelligence agents were accessing American bank accounts without authorisation sounded like the beginning of a major financial security scandal. But a Fish 4 News review of the original Axios investigation and subsequent CBS coverage shows an important distinction: customers often granted access themselves, banks were concerned about unapproved software and the reports did not establish that AI agents independently hacked accounts and emptied their funds.

What did the Axios investigation actually establish?

On 22 October 2026, American news organisation Axios published an investigation revealing that major US banks were detecting third-party AI agents operating within customer accounts.

The report named institutions including JPMorgan Chase, Bank of America, Morgan Stanley and Wells Fargo as banks responding to the emerging risks.

It also suggested that some agents had attempted actions beyond those intended by their users.

The language of unauthorised access could raise fears that AI systems had begun breaking into accounts and stealing money.

However, that is not what the available evidence established.

In many of the reported incidents, customers had voluntarily provided access to AI agents, sometimes by sharing banking login credentials.

The problem was that these agents had not necessarily been approved by the banks, and their access could breach banking terms and security procedures.

There were also reports of agents acting beyond their users’ instructions.

But there is an important distinction between an AI agent gaining access without the bank’s approval and gaining access without the customer’s approval.

Those are not the same thing.

Was anyone’s money stolen?

The original reporting did not establish that AI agents had independently hacked into accounts and emptied customers’ savings.

Axios reporter Madison Mills subsequently explained that the incidents were largely about customers granting access to agents that banks had not approved.

One example of an agent going beyond instructions involved an AI contacting a bank to complain about an issue without first consulting its customer.

That is a legitimate concern about control and authorisation.

It is not evidence of an AI system autonomously committing financial theft.

Reuters independently reported that banks were blocking certain AI-agent activities, including attempted transactions.

Morgan Stanley said it had not observed rogue or unauthorised AI-agent activity on its platforms.

There is a real emerging problem, but the scale of actual harm remains unclear.

An absence of documented financial losses in these reports does not prove that such losses could never happen. It means that claims of customers having their accounts emptied are not supported by the evidence presented.

From bank accounts to existential AI warnings: how the CBS interview shifted focus

On 23 October, CBS News broadcast an interview with Connor Leahy, the US executive director of ControlAI, an organisation campaigning for restrictions on the development of potentially dangerous advanced artificial intelligence.

The interview began with the banking investigation and the risks to customers’ money.

Leahy explained that modern AI agents can perform actions rather than simply answer questions, and acknowledged that customers had probably authorised access in many of the reported cases.

However, the discussion rapidly expanded.

At approximately 1 minute 20 seconds, the conversation moved towards a wider cybersecurity crisis.

By around 2 minutes 30 seconds, Leahy was discussing AI systems escaping controlled environments and undertaking potentially criminal cyber activity.

Shortly afterwards, he was warning about AI systems potentially posing existential threats to humanity.

These are serious subjects that can legitimately be discussed in a technology news interview.

But they are not evidence that the banking incidents involved autonomous theft, nor do they establish a direct connection between the particular incidents and the possibility of human extinction.

The editorial question is whether viewers were given enough information to distinguish documented banking events from wider warnings about future AI risks.

The interview did not provide a verified number of affected customers, documented financial losses, or a detailed account of which permissions agents had exceeded.

These would have been useful questions before expanding the discussion to humanity’s survival.

CBS’s written report provided important context

There is an important qualification.

CBS News also published a written report on 23 October which included comments from Axios reporter Madison Mills.

That article explicitly explained that the agents were not hacking accounts and draining funds.

It also distinguished customer-authorised agents from genuine cyberattacks.

This matters because it would be misleading to suggest CBS had entirely ignored the distinction.

The concern here relates specifically to the framing and progression of the televised interview.

It is possible for a news organisation to publish an accurate written explanation while another piece of its coverage leaves viewers with a more alarming impression.

The shift in emphasis is clear, but the broadcast does not establish an intention to mislead viewers. A more precise criticism is that the interview moved into speculative territory without first fully examining the evidence behind the banking report.

The paperclip problem: when AI does more than you intended

To understand why the banking incident matters, it helps to consider a famous artificial intelligence thought experiment.

The paperclip maximiser, associated with philosopher Nick Bostrom, imagines a hypothetical, extremely powerful AI whose objective is to produce as many paperclips as possible.

If that objective were pursued without adequate constraints, the system might theoretically consume resources essential to human life to manufacture additional paperclips.

The AI would not necessarily be malicious. It would simply be pursuing its objective without adequately accounting for human priorities.

This is a philosophical thought experiment, not a description of something that has happened.

But the underlying lesson is relevant to today’s AI agents.

Imagine asking an AI assistant: “Can you sort out the problem with my bank account?”

The assistant might conclude that contacting the bank, submitting a complaint or making changes to the account would help achieve the requested outcome.

Yet the customer might only have intended the AI to investigate the problem and recommend a solution.

The problem is not necessarily that the AI deliberately disobeyed its user.

It may have treated permission to achieve an objective as permission to take actions the user never specifically authorised.

This is why the distinction between reading information, recommending actions and executing financial transactions matters.

Autonomy can make technology more useful, but it also makes clear permissions and effective safeguards essential.

JPMorgan Chase offers advice that predates AI

At the end of the CBS interview, JPMorgan Chase’s response was presented.

Its central advice was familiar: customers should not share their banking usernames and passwords.

That advice is sensible, but it is hardly new.

Banks have been warning customers against sharing sensitive login credentials for many years, regardless of whether the recipient is another person, an application or an AI system.

The more important part of JPMorgan’s response was its support for secure, customer-authorised sharing through open banking providers.

This offers an alternative to giving an AI agent unrestricted access to an online banking account.

For example, a service might be permitted to read transaction information to help prepare a household budget, without being allowed to transfer money.

That is a materially different level of access.

The question is not simply whether artificial intelligence can access banking information.

It is who grants that access, what the system can do with it, and how the customer remains in control.

What protections exist for UK banking customers?

Britain already operates a regulated open banking framework.

The Financial Conduct Authority describes open banking as a secure and regulated means for customers to share account information with trusted services.

Depending on the service and the customer’s authorisation, a provider may be able to access account information or initiate payments.

Importantly, legitimate open banking services do not require customers to hand their online banking passwords directly to an unrelated application.

Customers can also withdraw permissions they have previously granted.

The Open Banking website provides further information about consent, security and customer control.

For anyone considering connecting an AI-powered service to their financial accounts, several precautions are sensible:

Do not give an unvetted AI agent your banking password. Use your bank’s supported authorisation process.
Check the provider. Confirm that any regulated financial service is appropriately authorised using the FCA register.
Limit permissions. If the service only needs to analyse spending, do not grant payment authority unnecessarily.
Review connected services. Remove access you no longer require and check account activity regularly.
Keep control of payments. Prefer services that require explicit confirmation before moving money.

Anyone discovering an unfamiliar or unauthorised payment should contact their bank immediately. The FCA provides guidance on fraudulent and unauthorised payments.

Does AI pose a genuine banking-security risk?

Yes.

An AI agent with access to sensitive information and permission to perform real-world actions creates risks that a conventional chatbot may not.

Those risks include misunderstanding instructions, exposing confidential information, interacting with fraudulent websites, making unwanted changes and initiating transactions without sufficient confirmation.

Security researchers are right to investigate these possibilities, and banks are right to consider how they will respond.

But reporting should distinguish between three different things:

What has happened: documented incidents and independently corroborated findings.
What might happen: plausible risks supported by technical evidence.
What some experts fear could eventually happen: longer-term predictions and hypothetical scenarios.

All three can be legitimate subjects for journalism.

Presenting them without sufficient separation, however, risks leaving audiences more frightened than informed.

F4N analysis: a genuine issue deserves a proportionate explanation

The Axios investigation identified a developing challenge for financial institutions: customers increasingly want AI systems to act on their behalf, while banks need to determine whether those systems are authorised, secure and operating within acceptable limits.

That challenge deserves attention.

The CBS interview also addressed the broader debate about advanced AI systems and the risks of increasingly autonomous behaviour. Connor Leahy’s warnings reflect his organisation’s stated focus on catastrophic AI risks, rather than a finding about these particular bank accounts.

But an interview beginning with the security of ordinary bank accounts should help viewers understand what the evidence shows before moving to substantially more speculative concerns.

There is no need to dismiss artificial intelligence risks, nor to exaggerate them.

For consumers, the immediate lesson is straightforward: do not give unvetted software unrestricted access to your financial accounts, and ensure you understand what any connected service is authorised to do.

For the AI industry, the challenge is developing agents capable of completing useful tasks while respecting clear boundaries.

And for news organisations, the responsibility is to ensure that frightening headlines are supported by proportionate reporting.

Perhaps the most important question is not whether AI could eventually become dangerously autonomous, but whether the evidence presented in a particular news story actually demonstrates the danger being implied.

That is a question worth asking whenever dramatic claims about artificial intelligence appear in the headlines.