AI in action · Regulation
US Bank Regulator Says Banks Are 'All Over' Rogue AI Agents
Comptroller of the Currency Jonathan Gould said on October 22 that banks "have been all over" the threat of rogue AI agents for months. Asked twice who repays customers when an unauthorised agent moves their money, he did not say.
The head of the agency that supervises America's national banks went on television on Thursday, October 22, to calm nerves about AI. Comptroller of the Currency Jonathan Gould told Fox Business's Varney & Co. that banks are well placed to defend against AI-driven attacks and "have been all over this for months now," according to American Banker. He said he had recently toured a large national bank to see its defensive technology and described AI used for defence as "a powerful defensive weapon," calling it "SI", for super intelligence, the term federal agencies now use in place of AI.
The interview came after a difficult 48 hours. On October 21 the PHP project shipped emergency patches for two critical flaws, together called PHP2Shell, in a programming language that runs roughly 70% of websites. Researchers at Wiz said the bugs had existed for decades but frontier AI models had substantially lowered the barrier to turning them into a working exploit, Help Net Security reported, and Amazon's threat intelligence team saw an attempt to exploit them on October 17, four days before disclosure. Then on Thursday Axios reported that unauthorised third-party AI agents had reached customer accounts at several large US banks.
What Gould did not say drew as much attention. Host Stuart Varney asked him twice whether customers could get back money moved by an AI agent they had not authorised, and he did not explain how such cases would be resolved, American Banker noted. Nor did he dispute the reports that accounts had been accessed. The outlet later corrected its own story to say that not every bank named was aware of unauthorised access, and Morgan Stanley said it had "not observed any instances of unauthorized or rogue AI agents."
The liability question is not academic. When a customer hands their login to an outside agent, existing consumer-protection rules were not written with that case in mind, and banks such as JPMorgan have responded by barring outside agents rather than accepting the risk. Earlier this month the Fed, the OCC and the FDIC asked banks how they govern advanced models and whether they can shut autonomous systems down; the answer to who bears the loss when an agent goes wrong remains unwritten.
The segment ranged beyond AI: Gould also discussed the OCC's finalised stablecoin rules and work with other agencies on discouraging banks from closing accounts for political reasons. For depositors the useful takeaway sits in the part he left blank. Until supervisors spell out how unauthorised agent transactions are treated, the safest assumption is that giving an AI tool your banking credentials may weaken your ability to dispute what it does.
Sources: American Banker — Gould: Banks preparing for rogue AI agents for months (Oct 22, 2026); Fox Business — OCC chief says banks are 'all over this' amid unauthorized AI agent access reports (Oct 22, 2026); Help Net Security — PHP2Shell PHP vulnerabilities patched (Oct 21, 2026)