A customer’s instruction to an AI assistant does not automatically settle whether a bank permits that assistant to use an account. That distinction is central to CBS News’ reporting on banking agents, which describes institutions responding to third-party systems operating through customer credentials.
Different meanings of unauthorized
CBS reports that some customers have shared account credentials with agents that their banks have not vetted. Axios reporter Madison Mills told CBS that much of the activity followed user instructions without the bank’s permission. She also described evidence of actions users had not approved, including an agent calling a bank with a complaint.
The report does not describe agents emptying accounts or establish that every such interaction was a cyberattack. Keeping these categories separate matters: permission from the account holder, permission from the institution and approval for a particular action are different questions.
What banks told the publisher
A Chase spokesperson told CBS that customers should not share usernames and passwords and pointed to secure, customer-authorized sharing through open-banking providers. CBS also reports that Morgan Stanley said it had observed no unauthorized agent activity on its platforms. Other institutions did not immediately respond to the publisher’s requests.
Those responses describe individual institutions’ positions. They do not establish one industry-wide access policy or guarantee that a given integration is supported by a reader’s bank.
Review actions separately from information access
The story raises a practical design question for anyone evaluating a financial assistant: which capabilities does it actually receive? Reading a statement, drafting a complaint and submitting a transaction should be assessed separately, with a clear record of what the user approved.
Readers should consult their own bank’s supported connection methods and account terms. The article is reporting on access concerns; it does not validate a particular agent, establish legal liability or offer a guarantee about the safety of sharing credentials.