What's Getting Pwned

Using AI agents with your bank account credentials can lead to unauthorized access and restrictions by financial institutions.

Major U.S. banks including Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo, and Citi are detecting unauthorized third-party AI agents operating within customer accounts. These agents often use customer credentials, violating bank policies that require direct user login. Some agents have contacted call centers or acted independently, making it difficult for executives to distinguish between human and AI activity, or authorized versus unauthorized agents. While no account takeovers or fraud have been reported, Morgan Stanley is blocking these agents, and JPMorgan, Bank of America, and Citi are restricting them. Separately, GitLab released a critical patch for an unauthenticated RCE vulnerability (CVE-2026-110264) affecting all versions of GitLab CE/EE since 2014. In other incidents, unpatched Linux kernel vulnerabilities in ksmbd (RCE, CVSS 9.0) were publicly leaked by Trend Micro's Zero Day Initiative, and LiteLLM experienced a supply-chain compromise affecting PyPI and Docker images, stealing credentials.

The proliferation of AI agents accessing customer bank accounts highlights a significant security and policy challenge for the financial industry. Banks are struggling to differentiate between legitimate AI usage and potentially malicious activity, forcing them to implement restrictive measures. This situation signals a broader concern about the security implications of integrating AI tools into sensitive financial workflows and underscores the need for robust AI governance and authentication protocols.

The simultaneous disclosure of critical vulnerabilities in widely used software like GitLab and the Linux kernel, alongside a supply chain attack on LiteLLM, indicates a challenging security landscape. Organizations must be vigilant not only about direct exploits but also about compromised dependencies. The public leak of unpatched Linux kernel bugs by ZDI suggests an acceleration in the disclosure-to-exploit timeline, pressuring maintainers and users to patch rapidly.