Last week we covered Jamie Dimon saying JPMorgan would not let 'just any outside agent' into customer accounts and Amex publishing a framework to check what a customer authorised before an agent spends. On Thursday Axios reported why the banks moved in such a hurry.
Axios reporter Madison Mills, citing people familiar with the issue, reported that several major US banks are scrambling to contain the risks posed by third-party AI agents.
The banks include Morgan Stanley, Bank of America, JPMorgan and Wells Fargo. Some have reportedly detected unauthorised agents operating within customer accounts.
In most cases a customer handed over their own login. In some, banks tracked agents contacting call centres or appearing to act independently of the user's instructions.
If you run a consultancy, swap 'bank account' for Aconex, Procore, Asite or Viewpoint, and the story reads the same. Those portals hold the contract record, and a valid credential can read it and, depending on the role, change it. The question this week is whose credentials the agents on your team are using and whether anyone would know.
What the banks found and what they did about it
Axios reports that Morgan Stanley has begun blocking third-party agents from its platforms and that JPMorgan, Bank of America and Citi are also restricting them. A Morgan Stanley spokesperson told Axios, though, that the bank has not observed instances of "rogue AI agents accessing our platforms", so the detection claims rest on unnamed sources.
Citi told Retail Banker International on 19 October that it does not permit third-party agents to log into or transact in customer accounts, while allowing limited read-only access through approved open banking providers, and Axios says most banks are heading the same way.
Jeremy Barnum, JPMorgan Chase's chief financial officer, spelt out on the bank's third-quarter call where the liability lands.
It's important that customers understand that if they give up their credentials to the agent, and the agent does something that they don't want, that's going to be on them, and that's sort of not an ideal state of things.
Jeremy Barnum, JPMorgan Chase's chief financial officer, as reported by American Banker.
Replace 'customer' with a senior QS and 'the agent' with the assistant who connected to a client's portal, and that sentence is a conversation with your PI insurer waiting to happen.
Whose login is the agent using?
Nylas published the H2 2026 wave of its State of Agentic AI survey on 20 October: 1,030 US-based professionals who build, buy or influence AI systems were fielded from 26 August to 12 September. 54% said an agent did something wrong in the past 90 days, most often by triggering a workflow the team had to reverse. The rate climbs with scale, reaching 70% among organisations running more than 20 agents.
53% said they could produce a full log of what their agents did last week and which agent did it. 23% of organisations run the agent through a shared team inbox or OAuth on an employee's account. Where the agent has an identity of its own, 66% of teams report full audit capability. Where it runs on an employee's account, 51% do.
Nylas's own summary: "Where an agent acts as a person, the log shows the person." Nylas sells Agent Accounts, a product for exactly this, so the finding suits its business, but the mechanism holds. An Aconex audit trail reading 'J Smith uploaded revision C at 02:14' is technically true and practically useless if an agent did the uploading on J Smith's token.
The agent is an insider now
Hayete Gallot, Executive Vice President for Microsoft Security, argued on the company's blog on 19 October that organisations have implicitly trusted the agents they deployed themselves, and that the trust is misplaced.
These agents are frequently overprivileged, have access to data, tools and systems and can take actions and make decisions in critical processes. They have become active participants in the enterprise.
Her term is 'agentic insiders'. Her fix is Microsoft's own Project Perception, so there is a product behind the framing, but the diagnosis stands.
Jen Clark, Managing Director and leader of EisnerAmper's AI Advisory practice, made the same point the same day. "Personal agents add a twist. Someone else builds and runs them, and they act with a person's credentials, so to your systems, the agent looks like the person." Her five permission questions:
What can it read?
What can it say (or commit to on someone's behalf)?
What can it spend?
What can it change?
Who is told when it fails or drifts, and who can stop it?
What does a ‘read-only first’ look like for a consultancy?
Nylas found 59% of teams already run a middle mode where reads are automatic and writes wait for a person. That is where the banks are heading too. An agent may read the portal: pull the RFI register, flag an overdue instruction. It may not upload, issue, certify or reply. Those actions stay with a named person whose name on the audit trail is true.
If the vendor offers API access or a non-human account, the agent gets its own, scoped to read. If the vendor offers only a human seat, the agent works from an export. Then tell the client, because on most jobs the portal is theirs, and their terms may already say what the banks' terms said.
Takeaway
The banks had the budgets and the fraud teams and still found agents inside accounts before they had a policy. A consultancy on four portals will not do better by waiting.
Ask every team this week which agents are connected to a client portal and whose login each one uses.
Move any agent off a personal credential and onto read-only access with its own account or key.
Keep uploads, instructions, certifications and RFI replies with a named human, and write that rule into the project execution plan.
We have followed the agent-access question since September. The weekly Project Flux newsletter tracks each move and what it means for the portals your projects run on: sign up here.
Links and Stuff
All content reflects our personal views and is not intended as professional advice or to represent any organisation.
