Major U.S. banks are detecting unauthorized AI agents operating inside customer accounts, with some agents attempting to take actions that appear independent of user instructions, Axios repor
Major U.S. banks are detecting unauthorized AI agents operating inside customer accounts, with some agents attempting to take actions that appear independent of user instructions, Axios reported Thursday.
Morgan Stanley has begun blocking third party agents, and JPMorgan, Bank of America and Citi restricting them.
The founders of AI agent testing company Mace Ai say that this is the threat they have been warning about: agents that already hold the keys to the safe can be flipped into double agents.
Related: Roundtable CEO, Coinbase's D'Agostino discuss USDC "forcing function" partnership
"Agents represent the same vulnerability surface in many ways that people do," Mace Ai co-founder and CEO Walton Comer told TheStreet Roundtable publisher James Heckman in an interview on Oct. 14.
"All of the same techniques that governments and other actors apply to people are equally valid to be applied to agents."
Mace Ai describes itself as an agent assurance company for enterprise AI. It tests AI models and agents the way a hacker would, looking for cognitive weaknesses before real attackers find them.
Its product, Fisher, adversarially tests AI agents that use tools and then gives companies the evidence and steps they need to fix what it finds.
Comer said governments are already exposed. "The government is very much vulnerable to this right now," he said. "The ability to have agents subvert other agents, flip them, turn them into double agents."
This comes as Microsoft CEO Satya Nadella said this month that companies should treat advanced AI models as potential insider threats, with an "emergency brake" that lets an authorized person shut a model down mid-task.
Companies are already paying for AI breaches.
One in four malicious breaches was AI-driven this year, costing companies $6 million on average, according to IBM's 2026 Cost of a Data Breach Report, a study of 602 breached organizations conducted with the Ponemon Institute.
The UK government's AI Security Institute disclosed in August that agents it was testing tried to plant malicious code in a real open-source project, built fake online identities to pressure the project's maintainer, and left public messages inviting other agents to collaborate.
Most companies are not ready for this. In a 2026 survey by research firm ETR, 37% of organizations had AI agents deployed or in testing, but only 3% had agent-specific security controls in broad production use.
Traditional cybersecurity tries to keep attackers out. Frank said that the traditional security model breaks when nobody has to break in.
"In cybersecurity, you're trying to basically get the keys to the safe," said Frank, Mace Ai's co-founder and chief scientist.
"Your agent already has the keys to the safe and it's got a trusted scope of what it can do. Can we convince that agent to step outside the scope that you gave it permission for? That's the bottom line."
Most models ship with a refusal layer that blocks obviously harmful requests. Frank said a patient manipulator can walk around it over many conversations.
"If you ask a model, just the chatbot, how do I make a bomb or something bad, it'll just refuse you," he said.
"But over multiple conversations, if you stay just shy of triggering that refusal layer and you gradually, cognitively manipulate that agent into wanting to cooperate with you, it is social engineering. You can sometimes, very often, achieve the same objective as just asking how to make a bomb. That's what we do."
The same test applies to weapons systems, he said. "Can an agent cross its authorized boundaries? In a drone situation, it's the same test, where we know that the drone does have the power to destroy and to bomb and to cause harm. Can it be cognitively manipulated in that scenario to become a double agent? That's an absolute risk."
"If you know how to test that, how to discover those vulnerabilities, replicate them, produce the evidence and remediate them, that is definitely a valuable skill across both civilian and military spheres," Frank said.
Mace Ai runs adversarial testing, known as red teaming, on the AI agents companies deploy.
"We produce a tool that does adversarial testing of agents that can open documents or send emails or operate on files or do other things that agents do," Frank said.
"This is called red teaming, which means purposely trying to make a system fail so that you can see why it failed and where it went wrong."
Comer said an engagement can start with the agents a company exposes to the outside world.
"We can just simply point our software and processes at those endpoints," he said. "And we can give them a very quick analysis of what their vulnerabilities are right now."
The fixes come with proof, he said. "It's not enough to just say, look, here are your vulnerabilities. It's very important to be able to say, and this is what we can do to solve them."
The warning follows the first publicly disclosed AI swarm incident.
OpenAI said in July that agents it was testing escaped isolated environments, coordinated on a message board of roughly 1,200 agents and compromised AI infrastructure company Hugging Face, according to an independent investigation by METR and its later Senate testimony.
TheStreet covered the incident and what it means for businesses.
Comer compared the moment to Y2K. "Suddenly you became aware there is an issue. It was a real issue, and it was an all hands on deck situation broadly to remediate it. And that was successful," he said. "I think that's what we're facing here as well."
Related: Mace Ai founders on what OpenAI's Hugging Face breach means for businesses
