What happened
Axios reported on October 22, 2026 that major U.S. banks, including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and Citi, are detecting third-party AI agents operating inside customer accounts, usually because customers handed the agent their own username and password. Sources told Axios some agents contacted call centres or took steps that appeared independent of the user's instructions, and that banks often cannot tell a user-directed agent from a rogue one. Several banks are blocking or restricting agents and moving toward read-only access, similar to what budgeting apps already get; Morgan Stanley said it has not seen rogue agents on its platforms. (Axios: Scoop: Unvetted AI agents are accessing U.S. bank accounts, Oct. 22, 2026)
Note on figures: Accounts of agents acting independently of users come from unnamed sources speaking to Axios. Morgan Stanley said it has not observed rogue AI agents on its platforms.
What it means for Canada: our assessment
Assessment: the reporting covers U.S. banks only. Canadian bank customers are exposed in the same way when they give an AI assistant or browser agent their online-banking password, and doing so can break the password-confidentiality terms in their bank's electronic access agreement, which can leave them liable for losses.
- Sectors
- Banks and credit unions · Wealth managers and brokerages · Fintech and budgeting apps · Consumers and small businesses using AI assistants
- Tools involved
- AI browser agents and personal AI assistants with web login · Online and mobile banking portals · Bank call centres and voice authentication
- Canadian rules
- Bank electronic access agreements and the Canadian Code of Practice for Consumer Debit Card Services: customers who share passwords or PINs can be held responsible for resulting losses
Consumer-Driven Banking Act (federal open banking framework, overseen by the Financial Consumer Agency of Canada): the intended route for sharing bank data with third parties without handing over credentials
OSFI B-13: federally regulated financial institutions must manage technology and cyber risk, including access controls and anomalous activity detection
OSFI E-23: model risk management applies to AI and automated decision systems that banks use, including any used to detect or manage agent traffic
PIPEDA: banks must safeguard personal information and report breaches with a real risk of significant harm to the Privacy Commissioner
Assessment, not documented exposure. No Canadian bank is named in the reporting. The exposure is an assessment: Canadian online banking uses the same password-based logins the agents exploit, AI browser agents are sold to Canadians, and Canadian banks face the same difficulty telling an authorized agent from an attacker or a misbehaving one.
Takeaways for Canadian businesses and individuals
- IndividualsDon't give an AI assistant or browser agent your online-banking username, password or one-time codes; Chase told Axios customers should never share their login with anyone, and Canadian bank agreements generally require you to keep them confidential.
- IndividualsIf you already let an agent sign in to your bank, change your banking password, review recent transactions and payees, and call your bank about anything you didn't authorize.
- BusinessBanks and credit unions: add detection for automated and agent-driven sessions on web, mobile and call-centre channels, and update electronic access terms to state plainly how third-party AI agents are treated.
- BusinessFintechs and AI agent builders: drop screen-scraping with customer credentials and plan for read-only, token-based access, the model U.S. banks told Axios they are moving toward.
- IndividualsIf an agent or someone posing as one moves money without your approval, report it to your bank and to the Canadian Anti-Fraud Centre (1-888-495-8501).
For the Canadian AI sector
Consumer AI agents are running into banks' identity controls before any agent-specific access standard exists. For Canadian fintechs and agent builders, credential-sharing designs are likely to be blocked, and building on permissioned, read-only data access is the safer path.
Written by AgentsNorth from the source below. General information, not legal or security advice.