AI agents accessing bank accounts have become one of the week’s most widely discussed technology stories after reports that major American banks were detecting third-party artificial intelligence assistants entering customer accounts and, in some instances, appearing to perform actions beyond what users had requested.
The development has raised understandable concerns about the security of online banking, particularly as AI assistants become capable of carrying out transactions and completing tasks on behalf of users. However, the most important detail behind the headlines is that many of these agents were initially given access by the account holders themselves, using their personal banking credentials. The issue was therefore not necessarily an AI system independently breaking into a bank, but software operating through access that customers had provided, often without the bank’s approval.
The story also arrives during a separate cybersecurity emergency involving vulnerabilities in PHP, the technology supporting a large proportion of websites. Some online services were temporarily suspended as organisations installed security updates, allowing unrelated events to become mixed together in online discussions. Understanding what actually happened is important because the risks are genuine, but the evidence does not support every alarming interpretation.
AI Agents Accessing Bank Accounts: What Actually Happened?
On 22 October, Axios reported that major US financial institutions, including JPMorgan Chase, Bank of America, Morgan Stanley and Wells Fargo, were responding to third-party AI agents entering customer accounts. The original report relied partly on people familiar with the situation and described banks struggling to distinguish ordinary customer activity from actions performed by automated assistants.
In many instances, the mechanism was straightforward. A customer wanted an AI assistant to examine account information, monitor spending or complete a financial task, and provided the software with the username and password normally used for online banking. The assistant could then appear to the bank’s systems as an ordinary account login, even though the activity was being performed by software rather than the account holder.
This creates a problem because customer permission is not necessarily the same as bank authorisation. A customer may willingly provide access to an assistant while still breaching the bank’s security conditions, which often prohibit sharing login credentials with third parties. The bank may also have difficulty establishing whether subsequent activity was specifically approved by the customer.
Did the Agents Really Act Independently?
This is where the distinction between verified facts and reported concerns becomes particularly important.
The Axios report described cases in which some agents appeared to contact customer-service centres or pursue actions beyond the user’s instructions. However, those claims were attributed to unnamed sources, and the publicly available information does not establish that AI agents independently compromised banking systems or carried out unauthorised transfers without any initial customer involvement.
Morgan Stanley has specifically said it has not observed rogue AI agents accessing its platforms, despite taking steps to restrict outside agents. Reuters subsequently confirmed that several major banks were blocking third-party AI access, while explaining that some activity involved customers voluntarily sharing their login information.
The central difficulty is accountability. When an automated assistant performs an action through a customer’s credentials, it may be difficult to establish whether the action was deliberately requested, incorrectly interpreted or performed without sufficient authorisation. That is a legitimate security concern even without evidence of an AI system developing independent intentions.
Why Major Banks Are Restricting AI Assistants
Several large US banks have already moved to restrict third-party agents from accessing accounts or carrying out transactions. JPMorgan Chase has taken a particularly firm position against external agents using customer credentials, while Bank of America, Citi, Morgan Stanley and other institutions have introduced or supported restrictions.
Their concern is not necessarily opposition to artificial intelligence. Banks already use AI extensively for fraud detection, customer support, risk analysis and operational efficiency. The difficulty arises when independently developed AI products attempt to interact with secure financial systems without an agreed method of authentication, supervision and liability.
There is also a possible commercial consequence. An AI assistant capable of comparing deposit interest rates and transferring money between banks could make customers more responsive to better savings offers. That could increase competition for deposits, although such an outcome would depend on banks developing safe, authorised systems for agent-assisted transactions.
The longer-term solution may involve controlled access through approved banking interfaces. An assistant could be permitted to read selected financial information without receiving a customer’s password, while payments or transfers would require separate customer confirmation.
Such arrangements would allow banks to accommodate useful AI services without giving outside software unrestricted control over customer accounts.
Another Security Emergency Was Unfolding at the Same Time
While banks were dealing with the question of AI-agent access, website operators across the world were responding to a separate problem involving PHP, a widely used programming language supporting content-management systems, online services and business websites.
On 21 October, the official PHP development team issued emergency updates for two serious vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. The flaws, collectively known as PHP2Shell, could allow attackers to execute malicious code on vulnerable web servers without first logging in.
The vulnerabilities received critical severity assessments, and cybersecurity authorities advised organisations to update affected systems immediately. Some public and private services temporarily suspended their websites while fixes were installed or security checks were completed.
Those interruptions were not evidence that AI agents had taken control of the internet. They were primarily precautionary responses to vulnerabilities that could potentially be exploited by attackers, irrespective of whether AI tools were involved.
Why Some Websites Went Offline
The PHP security problem was serious because the affected technology sits behind many everyday digital services. Banks, businesses, educational institutions and government organisations can all operate applications that depend on PHP, sometimes without their customers being aware of the underlying software.
The Cloudflare security response confirmed that protective rules were deployed to help block attempts to exploit the vulnerabilities. Cloudflare also reported observing malicious traffic targeting customers, while emphasising that website operators still needed to install the official patches.
Security researchers used AI-assisted methods in identifying the vulnerabilities, demonstrating another important aspect of the technology debate. AI can help researchers discover weaknesses faster, but attackers may also use increasingly sophisticated tools to investigate vulnerable systems. The same technological progress can therefore strengthen cybersecurity while creating new defensive challenges.
This incident does not establish that the entire internet was compromised. The reported service interruptions were individual organisations responding to a specific software problem, rather than evidence of a worldwide network failure.
Is There Evidence of an Imminent Global Internet Shutdown?
The broader online rumours suggesting that the internet is about to stop functioning worldwide are not supported by credible evidence available as of 23 October.
The internet is made up of interconnected networks, operators, infrastructure providers and communications systems distributed across countries. Individual services can fail because of software vulnerabilities, infrastructure problems, cyberattacks or local restrictions, but a temporary interruption affecting several websites does not mean the entire global network is shutting down.
The week’s developments should therefore be understood as two different security challenges: banks determining how to control access by autonomous AI assistants, and website operators addressing critical vulnerabilities in their server software. Neither development independently establishes the dramatic scenario suggested by some social-media claims.
What This Means for Sri Lankan Banking Customers
Although the banking reports concern the United States, the underlying issue is relevant wherever people use digital banking services. Sri Lankan customers are increasingly familiar with mobile payments, financial applications and AI-powered tools, making it important to understand the difference between an authorised service and an application requesting direct access to confidential banking credentials.
The Central Bank of Sri Lanka has consistently warned customers against sharing banking usernames, passwords, PINs and one-time passwords with third parties. That advice remains relevant even when the third party is a sophisticated AI assistant claiming that access will make financial management easier.
Customers should use their bank’s official applications and approved integrations, enable transaction notifications and seek immediate assistance from their bank if they discover unfamiliar account activity. Anyone who has already provided banking credentials to an unapproved AI tool should consider changing those credentials and reviewing account access permissions.
For businesses, there is another practical responsibility. Companies using PHP-based websites should ask their hosting providers or technical teams to verify whether affected systems have received the October security updates. The official fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while older installations may require vendor-specific fixes or an upgrade to a supported version.
The Bigger Banking Question Is Who Controls the Agent
The development highlights a question that will become increasingly important as AI moves beyond answering questions and begins acting directly within financial systems.
Traditional banking security is built around identifying customers, verifying transactions and establishing responsibility for financial decisions. Autonomous assistants introduce another participant into that relationship, and existing authentication systems may not always distinguish between a customer acting personally and software operating with the customer’s credentials.
Financial institutions will therefore need mechanisms that allow customers to benefit from AI without surrendering control of their accounts. Clear permissions, limited access, transaction approval requirements and reliable activity records could become central features of the next generation of digital banking.
For consumers, the lesson is equally straightforward. An AI assistant may be useful for explaining financial information or helping prepare a budget, but allowing it unrestricted access to a bank account involves a different level of trust and risk.
The reports from major American banks do not prove that autonomous AI systems have begun independently taking over customer accounts. They demonstrate that people are already using AI in ways that existing banking safeguards were not necessarily designed to accommodate.
That makes this week’s news important beyond the immediate headlines. The future of AI-powered banking will depend not only on what these assistants are capable of doing, but on who authorises their actions, how those actions are controlled and who remains responsible when something goes wrong.
For further context on the risks associated with increasingly autonomous systems, read our earlier Lanka Biz News analysis of recursive self-improvement AI risk.
This article is intended for educational, technology and business analysis purposes. Reports of AI agents acting beyond customer instructions remain subject to verification. The PHP security vulnerabilities and reported US banking restrictions are separate developments and should not be interpreted as evidence of a common cyberattack.
