# Morgan Stanley blocks third‑party AI agents after banks detect unauthorized usage

Digest AI · Enterprise & Industry · published 2026-10-22T14:08:12Z

Canonical: https://digestai.news/story/morgan-stanley-blocks-thirdparty-ai-agents-after-banks-detect-unauthor

## Summary

Axios reports that major U.S. banks—including Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo and Citi—have detected third‑party AI agents logging into customer accounts with the customers' own credentials. The agents sometimes contact call centers or act independently, and bank executives say they often cannot tell a human from an AI. No account takeovers, fraud losses or specific AI‑agent products have been reported. In response, Morgan Stanley is blocking third‑party agents while JPMorgan, Bank of America and Citi are restricting them, and the banks advise customers not to share usernames or passwords with any AI.

The live feed notes a total of 191 security incidents in the past year through Oct 22 2026, with 35 classified as critical. Highlights include a critical GitLab CE/EE integer‑overflow (CVE‑2026‑110264) patched on Oct 21 2026, a compromised LiteLLM release that stole cloud credentials, and multiple Linux kernel vulnerabilities disclosed by Trend Micro’s Zero Day Initiative. Several vendors—Signal, Fortinet, Atlassian, Cisco and others—have also issued patches for high‑severity flaws.

Overall, the surge of AI‑related misuse and traditional software bugs underscores growing security challenges across both financial services and broader technology stacks.

## Key points

- Morgan Stanley blocks third‑party AI agents; JPMorgan, Bank of America and Citi restrict them after detecting unauthorized usage.
- 191 security incidents reported in the last year through Oct 22 2026, including 35 critical and 15 not fully patched.
- Critical GitLab CE/EE integer overflow (CVE‑2026‑110264) allows unauthenticated code execution; patch released Oct 21 2026.

## Why it matters

AI agents accessing bank accounts bypass user authentication, exposing financial institutions to credential misuse and potential fraud, prompting immediate policy changes and heightened security scrutiny.

## Sources

1. [What's Getting Pwned](https://pwn.watch/) (pwn.watch, 2026-10-22)

## Cite

Digest AI, "Morgan Stanley blocks third‑party AI agents after banks detect unauthorized usage", 22 October 2026, https://digestai.news/story/morgan-stanley-blocks-thirdparty-ai-agents-after-banks-detect-unauthor

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/morgan-stanley-blocks-thirdparty-ai-agents-after-banks-detect-unauthor.json