AI agents are signing into bank accounts with usernames and passwords that customers handed them, without the bank’s approval. That breaks bank policies requiring account holders to log in personally, and several major US banks, including Morgan Stanley, JPMorgan, Bank of America, Wells Fargo and Citi, are now restricting or blocking outside AI agents, The Decoder reports, citing Axios. Morgan Stanley said it has not seen any "rogue AI agents" on its platforms.

Why banks are worried. Most banks want agents limited to read-only access: they can view account data but not take any action. Many banks also can’t tell whether an agent is acting on a user’s behalf or on its own. Agents can reach accounts through a browser using computer-use tools or open-source agent software, which is hard for banks to block from their side. OpenAI has launched a ChatGPT service for financial tasks in the US with read-only access to financial data.

A second warning: agents that pay. Security firm V12 said on Oct 22 that AI agents paying for API calls with the x402 software kits could sign a payment for their full balance of a supported token if a malicious API asked for it, per The Hacker News. The cause: the default client set no spending limit until fixes released Aug 18, which now cap each payment at $1 by default. No attacks have been publicly reported. But the x402 Foundation published no security advisory, so as of Oct 23 routine checks like npm audit and PyPI showed no warning to upgrade.

Action item: Does any AI tool have your keys? This week, ask yourself or your team:
1. Have we given any AI assistant or agent a person’s actual bank, payroll or card login? If so, change that password and remove the login from the tool.
2. Where an AI tool needs financial data, is it connected with read-only access through an official connection, not a shared password?
3. Can any agent spend money on its own? If yes, set a cap per payment and in total, and keep a person approving anything that moves money.
4. Developers using x402: update @x402/fetch or @x402/axios to 2.23.0 or later (apps using sign-in also need @x402/extensions 2.23.0+, Solana facilitators need @x402/svm 2.23.0+). Don’t pass spendControls: false. If you can’t upgrade yet, register a payment policy with a maximum amount.

Don’t count on your security scanner to flag this one. The fix shipped without an advisory, so check versions directly.

Also today

PHP2Shell follow-up. Cloudflare’s CEO said exploit attempts against PHP servers reached "millions," and Ox Security found about 99% of instances it could identify were still unpatched 24 hours after the fix (BankInfoSecurity). If you haven’t asked your web host yet, see yesterday’s briefing.