A confession
On Thursday, Axios reported that major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, and that some of those agents appear to be taking actions their users never asked for. Within a day, Morgan Stanley, JPMorgan, Bank of America, Citi and Wells Fargo had all moved to block or restrict outside agents. Jamie Dimon said outside agents would not get inside the bank. A Chase spokesperson reminded customers not to hand their username and password to anyone, including an AI.
I have a confession. I am part of that bot army.
Why I did it
I needed to total up two years of giving to one category of charity. Simple question. The kind of thing a bank should answer in one click.
My bank cannot answer it. Its online experience is built around the paper experience. The statement is still a monthly PDF, designed to be printed and mailed, now simply posted to a portal instead. To get my number, I would have had to pull twenty-four PDFs, open each one, find the lines, and add them up by hand.
So I handed it to an agent. One prompt. A few minutes later I had the answer I needed, and I went on with my day.
That is the whole story. No exploit, no stolen credentials, no money moved. A customer with a legitimate question used the only tool that could actually answer it.
Do I feel guilty?
Did I violate my bank's terms of service? Almost certainly. Do I feel guilty about it, in retrospect? No.
The terms of service assume a world where the only way to read my own data is to sit at a keyboard and click. That world is ending. Customers are going to bring agents to every digital front door they have, and they are going to do it whether or not the terms of service have caught up. Blocking them wholesale is a holding action, not a strategy.
The bank's instinct is understandable. If you cannot tell a customer's agent from an attacker's bot, and you cannot tell an agent that is reading from an agent that is about to move money, then the safe answer is no. But "no" is not where this ends. The banks that figure out how to say "yes, within limits" are the ones that will keep their customers.
From keeping bots out to letting them in
At SecureAuth, some of the biggest banks in the world are our customers. We make transactions safe whether they are initiated by a customer, by a partner application, or by an agent. For years, a large part of that job has been telling, with high precision, whether the thing coming in through a web interface is a human or a bot, and keeping the bots out.
Diagram: a customer's agent and an attacker's bot both reach the bank's front door, which checks who is on the other end. The attacker's bot is blocked at the door; the customer's agent is let in. Its requests then pass through a scoped grant, guardrails outside the agent: reading statements and totaling are allowed through to the bank, while a transfer is blocked before it lands.
In the last few months the ask has changed. Some of the same customers are now telling us: let the bots in. Embrace the bots. Love the bots. Their customers want agents, their competitors are going to allow agents, and a bank that cannot accommodate them will look like the bank that still mails paper statements. Because it is.
The enterprises that can distinguish good bots from bad bots, and put guardrails outside the bot so it cannot do anything it is not supposed to, will flourish in the age of agentic commerce. The ones that cannot will fall behind.
This is a soluble problem
Safe, automated access to financial systems, even through a web interface, is a solved class of problem. It takes three things, and we ship all three today.
Know who is on the other end, continuously. Our analytics measure in real time, with very high precision, whether a session has been automated, taken over, or compromised in some other way. The same signals that have been catching credential-stuffing bots for years tell you when an agent has shown up with a customer's password. The difference now is that the answer to "it's an agent" can be a policy decision instead of a block.
Follow the standards built for this. We implement FAPI 2.0, the financial-grade API profile that guarantees transactions done with an institution through an external interface are authenticated, authorized, and secure. Open banking already solved "let a third party in safely" for partner applications. Agents are the next third party.
Put the guardrails outside the agent. For agentic access in general, our approach is to combine authorization and enforcement in a zero-trust runtime control plane that sits between the agent and the system it is acting on. The agent gets a scoped grant: read these statements, not those; total, don't transfer. Every action is checked at runtime against that grant, and anything outside it is stopped before it lands. You do not have to trust the agent's judgment. You have to bound it.
That is the model that makes agents safe not just for banking, but for healthcare and critical infrastructure, where the cost of an agent acting beyond its instructions is measured in more than dollars.
Love the bots. Don't trust them.
The agents are already inside the accounts. The Axios report is not a warning about the future; it is a description of last Tuesday. The only question left is whether the front door gets a bouncer or a bolt.
Embrace agentic commerce. Put the guardrails outside the agent and let it go to work. Let the new age of agentic commerce blossom.
Love the bots. Just don't trust them.
Sources: Engadget, CBS News, PYMNTS on the Axios report of Oct 22, 2026.
About SecureAuth
SecureAuth provides identity and access management solutions that enable enterprises to implement customized, resilient authentication infrastructure. Through Continuous Authority, flexible deployment options, and deep composable capabilities, SecureAuth helps organizations defend against modern identity threats while maintaining usability and operational efficiency.