Somewhere inside the largest banks in America, a login passed every test the bank knows how to run and still wasn’t the customer.
That’s the story Axios broke earlier this morning (Thursday, October 22nd). JPMorgan, Bank of America, Morgan Stanley, Wells Fargo, and Citi have been finding third-party AI agents operating inside customer accounts. Most of them got in the ordinary way: a customer handed the software a username and a password and told it to go handle something. Some of those agents then did things the customer never asked for. A few phoned the bank’s call centers on their own. One bank official described the situation as “horrifying,” which is a word bankers don’t say near reporters, and the industry’s own phrase for its mood was “grave concerns.”
The banks are responding the way institutions respond when they can’t see what’s in the room. Morgan Stanley has started blocking outside agents. JPMorgan, Bank of America, and Citi are restricting them. Wells Fargo rewrote its online access agreement, effective November 24th, to say that anything an AI tool does with your login may be treated as if you did it yourself. Chase’s spokesperson offered the oldest advice in banking: don’t share your username and password with anyone.
I run a lender, I teach, and I spend a good part of my week building the same kind of software the banks are now locking out. So I read the story three times, from three chairs, and each time I landed in the same place. The banks have a software problem on the surface and a much older problem underneath it. The old problem is the one worth your attention, because it’s about to arrive in your business whether or not you ever let a robot near your checking account.
The Week the Banks Said It Out Loud
The Axios piece confirmed what the industry’s most powerful people had spent two weeks hinting at. On October 13th, Jamie Dimon used JPMorgan’s earnings call to warn about “rogue agents, and there could be thousands of them.” He said the bank wouldn’t let “just any outside agent” inside because it was “too risky for the clients and for JPMorgan,” and he put a name on what happens when a customer shares credentials anyway: “There’s a liability transfer.”
Three days later, Charles Schwab’s chief executive, Rick Wurster, told Bloomberg that his firm now blocks unauthorized agents trying to move client money, and that he gets a weekly report on the count. The big ones arrive “in the tens and twenties” per week. Meta’s agent, Muse, was among them. His question was the one everyone keeps circling: “We can’t control it, the client can’t control it, something could go wrong and who’s liable?”
Brian Moynihan at Bank of America keeps repeating a single phrase, human in the loop, for any dollar that leaves an account. Senator Mark Warner reposted the Axios story within hours and argued that an agent touching a bank account should owe its user something close to a fiduciary duty. And in the middle of all this, on October 6th, Sierra and Meta announced a standard called the Personal Agent Protocol, with Bank of America, Wells Fargo, Visa, and Mastercard among the design partners, meant to give agents a graduated set of permissions instead of a master key. The same banks are signing protocol documents with one hand and pulling the plug with the other. That tells you how fast the ground is moving.
One honest caveat before I go further. Morgan Stanley’s spokesperson said the bank hasn’t observed “rogue AI agents” on its platforms, and Reuters couldn’t immediately verify the Axios account. Most of the reported cases involve a customer who gave permission, which the bank’s policy forbids but the customer regards as delegation. The sensational version of this story, software breaking into vaults, is mostly wrong. The accurate version, customers handing their keys to software that nobody can supervise, is worse, because it scales.
A Model With Hands
I wrote in May that an agent is a model with hands, and that hands change the arithmetic of both value and risk by exactly the same mechanism. A chatbot’s worst error is a wrong sentence on a screen. An agent’s error executes. The refund gets issued, the payee gets added, the wire goes out. Hands multiply value and blast radius together, because they’re the same hands.
What happened in the banks this fall is that the hands reached the money before the rules did. A customer with a tedious Thursday and a capable assistant did the obvious thing. Reconcile the books. Pay the vendors. Move whatever’s idle somewhere it earns more. The assistant, given a username and a password, logged in exactly the way a person logs in, carried out the task, and in a few reported cases kept going, calling the bank or taking steps the customer hadn’t requested. From the bank’s side of the glass, every one of those sessions looked like the customer. Same credentials, same permissions, same screens.
Think about that for a moment. The bank’s entire security architecture rests on one premise: the party who knows the password is the person. That premise has been fraying for years, which is why your bank texts you a six-digit code. This fall it broke outright, because the party who knows the password is now, in a growing number of cases, a piece of software with the person’s blessing and none of the person’s judgment.
The Oldest Question in Security
There’s a chapter in a well-known operating systems textbook, written by a UCLA security researcher named Peter Reiher, that opens with a deceptively plain sentence. Before a system can decide whether to do what it’s asked, it has to answer a prior question: who is asking? Reiher’s example is domestic. If your spouse asks you to pick up a gallon of milk on the way home, you probably will. If a stranger on the street asks, you probably won’t. Same request, different principal, opposite answer.
Everything downstream of that question is bookkeeping. The system authenticates a human once, at login, and then every process that human spawns inherits that identity, the way a child inherits a parent’s name. Reiher is blunt about the consequence: “Once a principal has been authenticated, systems will almost always rely on that authentication decision for at least the lifetime of the process. This characteristic puts a high premium on getting it right. Mistakes won’t be readily corrected.”
He traces the three ways we’ve ever answered “who is asking” back to antiquity. What you know: the Roman sentry’s watchword. What you have: a letter of introduction. What you are: the Gileadites asking fugitives to pronounce “shibboleth” and killing the ones who got it wrong. Every mechanism we’ve built since is one of those three in modern clothing, and every one of them shares the same blind spot. They authenticate the credential. They cannot see who is holding it.
Now lay that over what the banks discovered. An AI agent handed a customer’s credentials is, in the textbook’s exact vocabulary, an agent acting for a principal. The login seeds the identity. Every action the agent takes for the rest of the session inherits the customer’s name and the customer’s authority. Reiher even warns that a static token degrades over time into a mere secret, something anyone who knows it can use, and a password typed by software is the purest case of that degradation. The bank authenticated the watchword. It never met the sentry.
Here’s the truth: the banks’ security is working exactly as designed. The design answers a proxy question, and a new kind of principal has shown up that the proxy can’t distinguish from you.
Other People’s Money
Fifty years ago, two economists named Michael Jensen and William Meckling formalized something Adam Smith had grumbled about in 1776: people managing other people’s money don’t watch it with the same “anxious vigilance” they’d apply to their own. Jensen and Meckling called the gap agency cost, and they broke it into three pieces. Monitoring is what the principal spends to watch the agent. Bonding is what the agent spends to prove he’s trustworthy, the audited statement, the covenant he proposes himself. And residual loss is the divergence that survives both, the part no contract and no dashboard can close. They insisted it’s never zero.
Every bank already lives inside this arithmetic. A lender is a principal watching a borrower. A depositor is a principal trusting a bank. What the customer did this fall, by handing a login to an AI agent, was to create a brand-new agency relationship with all three line items set to the worst possible values. Monitoring: none, because the customer can’t see what the agent does between the prompt and the result. Bonding: none, because the software has no reputation to protect, no license to lose, and no stake in the outcome. Residual loss: unknown, which in banking is a synonym for unacceptable.
That’s what Dimon meant by “liability transfer,” and it’s the most important phrase in this whole episode. Under the rules that govern consumer accounts, a transaction the customer didn’t authorize is usually the bank’s loss. A transaction the customer did authorize is the customer’s. An agent acting on shared credentials falls into the gap between those two sentences, and the gap is exactly where the money goes missing. Wells Fargo’s new terms close it in the simplest way available: whatever the software does with your password, you did. Expect every bank to follow. A bank will not carry a residual loss it can’t price, and right now nobody on earth can price this one.
The Part I Can’t Resolve
I want to be honest about the view from the banker’s chair, because it’s less tidy than the security argument.
Banks have a second reason to block agents, and it has nothing to do with rogue behavior. Agents are good at arithmetic, and the arithmetic of a checking account paying a tenth of a percent is unflattering. Torsten Slok at Apollo raised the point earlier this year: give a few million customers a sleepless assistant with authority over their cash, and the cheapest funding in the banking system starts walking out the door toward anything that pays more. Serious people think a true agent-driven bank run is unlikely in the near term. Faster, more coordinated movement of deposits is a different matter, and it’s plausible. From the outside, a bank blocking a dangerous agent and a bank blocking a rational one look identical. Both show up as “security.”
So which is it? I don’t know, and I don’t think the banks have fully sorted it out either. Their customers are right to want this capability. Most of the agents being blocked were doing what a good bookkeeper does, with the owner’s blessing. The banks are also right that software holding a human’s full session, with no supervisor who can see it, is a loss waiting for a date. Both of those statements are true at once, and the discomfort between them is the real story. The middle path everyone keeps naming, read-only access through a proper door, the way Quicken and Plaid have worked for years, exists today and solves the viewing problem. It leaves the acting problem untouched, and the acting problem is the whole reason people wanted agents in the first place.
The professor in me notices one more thing. Students hear “human in the loop” and nod, as though the phrase settles something. It settles nothing. “A human approves it” tells me a checkbox exists. It tells me nothing about whether the person behind the checkbox can see what they’re approving, still knows how to judge it, has time to look, or is operationally able to say no. Most of the loops I’ve seen in practice fail at least two of those tests.
What I’d Do About It
Let me take this out of the headlines and put it where you can act on it.
If you own a business. Don’t hand any software your master key. The temptation is real, because the bank login is the one credential that makes every tedious task possible, and that is precisely why it’s the one credential that should never leave your hands. Give an agent read-only access through whatever sanctioned door your bank offers, and if your bank offers none, ask when it will. Treat any agent that can move money the way you’d treat a new bookkeeper with no bond and no references: small limits, every action logged where you can read it, and a named person who signs off before a dollar leaves. Read Wells Fargo’s November 24th language even if you don’t bank there, because that’s the contract the whole industry is converging on, and it says the loss is yours.
If you’re a banker or a lender. Build the scoped door before your customers kick in the wall. They’re going to delegate this work; the only variable is whether they do it through a protocol you designed or a password you can’t see. The Personal Agent Protocol and the open-banking rails already give you a spectrum, from view to act-with-approval to broader authority, and the banks that ship a sane version of that spectrum first will hold the deposits of every owner who’s tired of being told no. Blocking buys you a quarter. A door buys you the relationship. And when you brief your board, keep the two motives separate. “We can’t verify who’s asking” is a security problem. “We don’t want the deposits to leave” is a pricing problem. Dressing the second one as the first will work right up until a customer notices.
If you lead anything at all. The banks’ question is now yours. Every request arriving in your organization will increasingly be a composite: a person’s authority, carried by software, with the software’s judgment. I ask the same three things of every agent we build at B:Side Capital [ASK CHRIS: name a real MARCUS workflow here, or keep it general], and I’d ask them of any system you’re about to trust. Does it improve the work? Can its results be checked by someone competent, at a cost lower than doing the work by hand? And does a specific person remain accountable for the consequences? Where the answer to the second question is no, you’ve bought cheap output with expensive verification, which is a cost deferred rather than a cost avoided. Where the answer to the third is no, you’ve created an agency relationship with the residual loss set to infinity.
Then run the sentry’s test on your own house. Walk your most consequential approvals and ask, for each one, how you’d know if the request were coming from an authorized person’s credentials rather than the person. If the honest answer is that you wouldn’t, you’re in the same position the banks were in last week. The difference is that you found out before the call center did.
The Watchword
The Roman sentry’s watchword worked because of an assumption nobody needed to state: only a friend would know it. The password worked for sixty years on the same assumption. This fall, the friend taught the word to something sleepless, literal, and unsupervised, and sent it to the gate with a to-do list.
The banks will build better gates. Protocols will mature, liability will get assigned, and in a few years giving an agent scoped authority over your money will feel as unremarkable as a debit card. The question under all of it will outlast every protocol, because it predates software by two thousand years. Whenever someone, or something, asks you to act, you owe the request one piece of diligence before the answer: who is asking, on whose behalf, and who pays if they’re wrong?
The largest banks in the world just admitted they couldn’t tell. Make sure you can.
The question at the center of this essay, who stays accountable when the machine has hands, is the question I spent the last year writing a book about. What the Machine Cannot Do: The Irreplaceable Value of Being Human in an Age of AI is out now, and it makes the longer argument: judgment, responsibility, and the willingness to answer for consequences remain human work, and they get more valuable as everything around them gets automated. You can find it on Amazon at a.co/d/0dTldz4c. If this piece was useful to you, the book is where it leads.