• Customers are increasingly enlisting AI agents to handle banking jobs for them
• Banks are struggling to distinguish between human, legitimate AI and rogue activity
• Many are now preparing for worst-case scenarios when AI does go rogue

Several major US banks have detected third-party AI agents accessing their customers' bank accounts, sometimes even attempting to carry out actions beyond what users actually wanted them to do.

New Axios reporting has claimed banks are now said to be struggling to even distinguish between legitimate human activity and agentic activity – but especially between authorized and rogue AI agents.

Importantly, the concern isn't so much disconnected, rogue AI going after system vulnerabilities to obtain customer information – banks are currently worrying about AI agents that human users themselves are setting off on their behalves.

Banks are struggling to deal with an influx of customer-authorized AI activity

In many cases, customers are voluntarily providing their banking usernames and passwords to AI assistants to hand over some workflows and processes to them, however while customers may be prepared to share these sensitive details, it can often violate banks' policies – which require the customers themselves to log into the accounts.

Morgan Stanley, JPMorgan Chase, Bank of America and Citigroup have all started to restricted third-party agent access. Well Fargo is also said to be responding to potential threats.

Besides a lack of visibility and account security, banks are also worried about financial liability, because it's still unclear who's responsible for AI agents' activity if things go wrong.

Charles Schwab CEO Richard Wurster explained that he now expects a daily report about "how many ⁠times we've had to block one of the different agents" so that the bank has "control over ​authentication and the experience."

Looking ahead, banks are now likely scrambling to prepare for worst-case scenario events. With huge parts of the internet recently shut down due to outages and vulnerabilities, banks are now preparing to quickly shut down customer accounts in the event of unwarranted access – and restore them post-incident.

• Critical PHP2Shell flaws also impact internet-exposed NAS devices and PHP-based Docker workloads
• Major vendors are still releasing patches, leaving some Synology, QNAP, and other systems exposed
• Researchers urge immediate updates, removal of public exposure, and VPN-only remote access

Websites and web servers are apparently not the only products affected by the php2shell vulnerability - Network Attached Storage (NAS) devices are at risk, too - and to make matters worse, some of the most popular manufacturers have not yet released a patch, despite the flaws being actively abused in the wild.

Research by Apple Insider noted that the flaw also affects software maintained by NAS manufacturers, as well as applications running independently in Docker containers, with NAS devices that are reachable through the public internet also at risk.

What's particularly concerning is that some of the biggest NAS manufacturers have said to be working on a fix, but the work is yet to be done. Synology, for example, released a new security advisory saying PHP versions 7.3 - 8.4, Mail Station, and Synology Calendar are all affected and adding that it released updated PHP packages to address the flaws. Those running Synology NAS products should head over to the company’s Package Center and download archive and look for updated PHP 8.2 and PHP 8.4 packages.

Twofold risk

The company also stressed that there is a difference between installed PHP packages and PHP components within DiskStation manager, and added that its built-in PHP isn’t exposed to the public internet, therefore most likely not at risk.

Another major NAS manufacturer, QNAP, confirmed a wide range of affected products, including QTS 5.2.11 and older, QTS 6.1.9, QuTS hero and QuTScloud, and Note Station 3. It said it was currently working on a fix, but did not give a timeline on when the patch might become available. So far, there is no evidence of in-the-wild attacks, but the company does recommend removing the devices from the open internet, disabling unnecessary port forwarding, UPnP, and remote-access services.

Other manufacturers are also currently working on a fix, including TerraMaster, Ugreen, and Asustor, Apple Insider found. “NAS owners should check their manufacturer's security notices and available updates for their specific models,” the publication said.

For NAS owners, the risk is twofold, since PHP is found in both the operating system and Docker containers.

Those running PHP-based services in Docker should check if their container images are running affected versions of PHP, and update them as soon as humanly possible.

There is also the problem of running older devices that have reached end-of-life and are, as such, no longer supported with patches. These, security experts agree, should be removed from public access. Unsolicited inbound connections should be blocked, and the device should be kept accessible only locally. Remote access should be achieved through a secure VPN, instead of forwarding NAS management ports.

P2PShell?

PHP2Shell is a name for a pair of vulnerabilities - CVE-2026-109618 and CVE-2026-109619 - that were recently discovered in the PHP programming language. They are considered critical and allow malicious actors to take over websites, steal data, deploy malware, and more. However, the story that has so far revolved around internet sites and web apps is now expanding into NAS devices, too.

PHP2Shell is shaping up to be the biggest security incident of the year, and possibly longer, arguably rivaled only by the Spectre/Meltdown flaws from eight years ago.

The pair of vulnerabilities - both critical in severity and both allowing for remote code execution - affects the vast majority of websites and web apps in existence today.

Knowledge of the flaws leaked four days before the patches were released, according to Amazon, and the number of exploitation attempts went from a few hundred 10 hours before publication, to millions today.

However, most of these attempts seem to have been unsuccessful. Analysis is ongoing as to why that is the case, with some researchers thinking code execution needs to get past ASLR, which is a difficult thing to do remotely. However, breaking in only seems to be a matter of time, which is why the security community urges manufacturers to release a fix as soon as possible, and owners to apply them without delay.