Third-party agents; identities unknown: Unspecified customer accounts at major US banks
Review CAT-U12 · Catalogue U12
UNVERIFIED AS ROGUE INTRUSION — aggregate anonymous-source report. Customer-supplied logins; Morgan Stanley denied rogue access. Reuters explicitly could not verify the report. Access authorization and autonomous deviation remain unresolved; do not treat as documented bank break-ins.
Reviewed: Not recorded · Rule: external-intrusion-v1
Evidence status
UNVERIFIED AS ROGUE INTRUSION — aggregate anonymous-source report
Dates and discovery
- Incident date
- Dates undisclosed; news report Oct 22, 2026
- Catalogue disclosure / source date
- Added to research / record
- Posted to RogueWatch
- No linked public incident
- First observed
- Not recorded
- Discovery channel
- Not recorded
When to reconsider
New original evidence establishing the unauthorized action, affected organization, model attribution or real-system impact.
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- Reuters / Devika Nair — US banks detect unauthorized AI agents in customer accounts, Axios reports (Oct 22, 2026)Reporting / interview · www.channelnewsasia.com
- Axios / Madison Mills — Scoop: Unvetted AI agents are accessing U.S. bank accounts (Oct 22, 2026)Relationship not established · www.axios.com
- Reddit discovery / discussionReddit discovery / discussion · www.reddit.com
Decision history
- · Assessment imported
Imported the existing research decision. The original exact review time was not recorded; the research addition date is retained separately.
Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.