AI agents are creating a new challenge for banks and other consumer-facing businesses as software designed to act on behalf of people begins interacting directly with financial accounts and online services. In an October 22, 2026, report, Axios revealed that major US banks had detected third-party AI agents accessing customer accounts, with some systems appearing to attempt actions beyond users' instructions.
The developments highlight a growing tension in the adoption of agentic artificial intelligence. Businesses want to make digital services faster and easier to use, while customers increasingly expect AI assistants to compare products, manage routine tasks and complete transactions. However, when these systems operate with access to sensitive accounts, errors or unclear permissions can have consequences beyond an incorrect chatbot response.
The challenge extends beyond banking. Retailers, travel companies and online marketplaces also need to determine how autonomous software should interact with their services, particularly when it can search inventory, make purchases or change bookings. The central issue is no longer simply whether AI can provide a useful answer, but whether it can take action safely and within the limits of a user's authority.
Why autonomous AI agents create a different kind of risk
Traditional generative AI systems primarily respond to prompts by producing text, images, code or other content. Agentic AI goes further by combining model-generated reasoning with tools that allow software to retrieve information, plan tasks and execute actions across connected services.
Depending on its configuration, an agent may access websites, interact with application programming interfaces (APIs), retrieve account information, coordinate multiple tasks and complete a workflow with limited human intervention. Some systems can also use credentials or browser sessions supplied by a user to navigate services that were originally designed for direct human interaction.
This capability can make everyday activities more convenient. A personal finance agent could compare banking products, while a travel assistant might search for suitable flights and accommodation. A shopping agent could identify products that match a budget and attempt to purchase them.
However, each additional capability introduces a question about authority. Permission to read account information does not necessarily mean permission to transfer money, make a purchase or change a booking. An agent may also misunderstand a request, encounter misleading information or continue pursuing a task after circumstances have changed.
The Canadian Centre for Cyber Security, working with security agencies in several allied countries, advises organisations to assess agentic AI risks carefully and avoid giving these systems broad or unrestricted access, particularly to sensitive data and critical systems.
Banking faces an immediate security challenge
Banking systems are a particularly sensitive environment because AI agents may encounter personal information, payment facilities and account-management functions. A mistaken action in a shopping search can be inconvenient; an unauthorised transfer or an improperly executed financial transaction can have direct monetary consequences.
According to Axios, financial institutions including Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo were among those confronting concerns about third-party AI agents accessing customer accounts. The report said some access occurred when customers supplied their own login credentials to AI assistants, even though many banks' rules require customers themselves to log in.
Axios also reported that several institutions were restricting third-party agent access. Morgan Stanley had begun blocking such agents, according to people familiar with the decision. A Morgan Stanley spokesperson told the outlet that the bank had not observed instances of rogue AI agents accessing its platforms.
The distinction matters: an AI agent accessing an account is not automatically evidence of malicious activity. A customer might deliberately use an assistant to retrieve information or carry out a task. The difficulty is determining whether the agent is authorised, whether its actions match the customer's intentions and whether the system can enforce those limits reliably.
Banks also face a technical problem when trying to distinguish automated activity from normal customer behaviour. An agent may use a browser, credentials and established online workflows in ways that resemble a human user. Conventional security systems may identify an unfamiliar session without being able to determine whether the underlying software is trustworthy or acting within its permissions.
One possible approach is to permit restricted, read-only access to financial information while requiring additional verification before transactions can be executed. This would allow some useful automation without handing an external agent unrestricted control over an account.
Such arrangements would still need strong identity verification, explicit permissions, transaction limits and reliable records of what an agent has done. Institutions would also need a way to revoke access quickly if an agent behaves unexpectedly.
Retail and travel face similar operational problems
The same underlying technology is changing how consumers may interact with retailers and travel providers. Instead of visiting multiple websites manually, customers can ask an AI agent to compare products, find available services or assemble options that meet specific requirements.
For businesses, this could create a new route to customers. An agent that searches across several providers might help consumers discover alternatives more efficiently. Automated systems could also handle repetitive tasks that currently require multiple searches, forms or customer-service interactions.
But autonomous agents do not necessarily interact with websites in the same way as ordinary shoppers. They can generate repeated requests, navigate pages at speed and attempt to complete several transactions within a short period. If their behaviour is poorly controlled, they may place additional demands on digital infrastructure or interfere with services intended for individual customers.
Retailers must also consider what happens when agents purchase products, reserve limited inventory or interact with promotions. A system that repeatedly attempts to secure an item could affect availability for other shoppers, while a poorly configured purchasing agent could select an unsuitable product or complete an order the user did not intend.
Travel introduces additional complexity because bookings can involve changing prices, limited availability, cancellation conditions and several connected services. An agent that searches for a flight or hotel needs accurate information about dates, passenger requirements, total costs and booking terms. If it acts on outdated information or misunderstands an instruction, the result could be an incorrect reservation or an unexpected charge.
These examples describe potential failure modes rather than evidence that every sector is already experiencing widespread disruption. The scale of the problem will depend on how extensively businesses permit agent access, the capabilities of the software involved and the safeguards surrounding individual transactions.
How agentic AI works under the hood
Agentic AI is not a single model or a standardised product category. It generally combines several technical components that work together to translate a user's goal into a sequence of actions.
- AI models: Large language models or other AI systems interpret instructions, generate plans and decide which available tools may help complete a task.
- Planning and orchestration: Software breaks a broader objective into smaller steps, manages their order and determines whether additional information is needed.
- External tools and interfaces: Browser automation, APIs and application integrations allow the agent to retrieve information or interact with external services.
- Memory and task state: Some systems retain information about earlier steps, user preferences or the current workflow, helping them continue tasks across multiple interactions.
- Authentication and permissions: Credentials, access tokens and permission rules determine which accounts, data and operations the agent can reach.
- Monitoring and execution controls: Logging, transaction limits, human approvals and automated checks can help prevent errors or restrict actions that exceed the agent's authority.
The combination is what makes these systems useful, but it also creates additional points of failure. An agent may interpret a request incorrectly, select an unsuitable tool, receive misleading information from a website or use a legitimate connection in an unintended way.
Errors can also spread between connected agents. For example, one system might incorrectly classify a transaction, after which another agent uses that result to prepare a report or initiate a subsequent workflow. Without independent validation, the original mistake can influence multiple downstream actions.
Security agencies warn that agentic systems can inherit familiar AI vulnerabilities while introducing additional risks associated with their ability to access tools, communicate with other systems and execute actions. These include excessive permissions, compromised credentials, manipulation through untrusted inputs and failures in coordination.
There is no single hardware specification, AI model or computing framework that defines a rogue agent. The risks depend heavily on the particular implementation, its connected services and the level of autonomy it has been granted.
Industry data points to a growing trust and identification gap
Measuring the scale of agentic AI activity remains difficult because businesses do not always have a reliable way to distinguish autonomous agents from conventional automated software or human-operated sessions.
Cybersecurity company Arkose Labs reported in its third-quarter 2026 agentic AI trust report that only 2.3% of legitimate AI-agent sessions in its measured dataset presented a verified Web Bot Auth signature. The company said 97.7% of legitimate agent sessions in that dataset carried no verified disclosure.
These figures relate to Arkose Labs' own measurements and should not be interpreted as a global estimate of all AI-agent traffic. They nevertheless illustrate a specific problem for digital services: identifying which software is acting, and whether it has a legitimate relationship with the person it claims to represent, can be difficult.
Agent identification alone would not solve the problem. A registered or identifiable agent could still make mistakes, exceed its permissions or be manipulated by malicious inputs. Conversely, an agent that lacks a recognised identity signal is not necessarily malicious.
Businesses therefore need to combine identification with authorisation and behavioural controls. Knowing which agent is connected is different from knowing which actions it should be permitted to perform.
Consumer protection and accountability remain unresolved
The growth of autonomous purchasing and financial tools also raises questions about responsibility when something goes wrong. If an agent makes an unauthorised purchase, changes a booking or initiates a financial action, the outcome may involve the customer, the AI provider, the service provider and the organisation that processes the transaction.
The UK's Competition and Markets Authority addressed these broader issues in its March 2026 report, Agentic AI and consumers. The report identified potential benefits from automated services while highlighting risks involving reliability, consumer choice, manipulation and the loss of meaningful user control.
For businesses, the practical challenge is to establish clear rules about consent and accountability before agents receive access to consequential operations. Users should be able to understand what an agent can do, which information it can access and when it will ask for confirmation.
Financial transactions and other high-impact actions may require stronger safeguards than ordinary information retrieval. Depending on the application, these could include step-up authentication, explicit approval for payments, limits on transaction value and clear cancellation or recovery procedures.
Organisations must also consider how they investigate incidents. Useful audit records should show which agent initiated an action, what permissions were available, what information was used and whether a human approved the operation. Without this evidence, determining responsibility and reversing the consequences can become more difficult.
What businesses need to address over the next 12 to 24 months
As agentic AI adoption develops, businesses will need to balance the advantages of automation against the costs of tighter security and oversight. The following areas are likely to remain important as organisations expand deployments.
- Agent identity: Develop reliable ways to identify automated systems and distinguish authorised agents from unknown or impersonating software.
- Least-privilege access: Give agents only the data and capabilities needed for their assigned tasks, rather than unrestricted access to accounts or internal systems.
- Human approval: Require additional confirmation for sensitive actions, including financial transfers, purchases above defined limits and irreversible changes.
- Transaction monitoring: Detect unusual activity, repeated requests, unexpected changes in behaviour and attempts to exceed established permissions.
- Interoperability: Establish consistent methods for communicating permissions, identity and transaction intent across agents and service providers.
- Incident response: Prepare procedures to suspend agents, revoke credentials, restore access and investigate disputed actions.
- Consumer transparency: Explain when an agent is acting, what it is authorised to do and how users can review or challenge its actions.
These measures are not a guarantee against every failure. Their effectiveness will depend on implementation, testing and the ability to monitor systems as models, tools and external services change.
Regulatory requirements may also vary by jurisdiction and application. Financial services providers must account for existing obligations concerning authentication, privacy, payments and consumer protection, while businesses in other sectors must determine how their existing legal responsibilities apply to automated transactions.
The challenge is controlling actions, not stopping AI altogether
Agentic AI could make banking, shopping and travel more convenient by reducing the effort needed to compare options and complete routine tasks. Its usefulness, however, depends on whether people and organisations can establish trustworthy boundaries around its actions.
The recent concerns reported by Axios show that banks are already grappling with how third-party agents should access their systems. Research and guidance from cybersecurity agencies and consumer-protection authorities point to a broader need for carefully scoped permissions, transparent behaviour and effective oversight.
Over the next two years, an important measure of progress will be whether businesses can support legitimate AI-driven activity without exposing customers or critical services to unacceptable risks. Better identification, stronger access controls and clearer approval mechanisms could help make that possible.
The long-term direction remains uncertain. Some services may allow agents to perform narrowly defined tasks, while others may continue to require customers to complete sensitive actions themselves. What is clear is that systems designed to act autonomously need security and accountability measures that reflect their ability to affect the real world.
Sources: This article is based on reporting by Axios on third-party AI agents accessing US bank accounts, analysis by McKinsey on AI agents and retail banking, guidance from the Canadian Centre for Cyber Security on the careful adoption of agentic AI, the UK government's report on agentic AI and consumers, and Arkose Labs' Q3 2026 agentic AI trust report.
