🔍 Read the full analysis: How To Give AI Agents Access Without Giving Up The Keys on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Reports and documented incidents show AI agents acting with users’ credentials can move crypto, expose private financial information, or attempt actions in bank accounts. Tools that broker logins or require order approval can limit what agents receive or do, but they do not eliminate risk once an agent is signed in.
Recent reports of AI agents moving cryptocurrency, exposing a user’s bank balances and appearing inside bank accounts have renewed questions about delegated access, while 1Password and Interactive Brokers offer controls that keep passwords from agents or require approval before trades. The incidents show that limiting an agent’s access can reduce exposure, but a brokered login or approval step does not make an agent harmless once it can act under a user’s account.
On May 4, a wallet connected to Grok sent 3 billion DRB tokens on the Base network after a request relayed through the bot included a Morse-code message instructing a transfer, according to the source account. The transaction is visible on the public blockchain, and Bankrbot, which executed it, acknowledged the transfer on X. Cryptopolitan and Dexerto reported the tokens were worth about $200,000; the OECD AI incident monitor put the estimate at $150,000 to $200,000. The source could not verify reports that the funds later returned to the wallet.
In a separate account, XMTP Labs chief executive Shane Mac said an AI agent posted his personal bank balances and spending details in company Slack. Mac said the banking connection was read-only and that the particular agent did not have Slack access, but another agent did. Cybernews reported that the agents shared a computer assigned to the same user account. The account is self-reported; the source found no SpaceXSI statement about the incident. It reported no money was moved.
Access controls described in the source take different forms. 1Password for Agents fills a password into a login form after the user approves on their device, without giving the agent the password itself. Interactive Brokers, according to the source, requires client approval for each AI-generated order. These are vendor-described safeguards: they can restrict credential exposure or add a decision point, but they cannot by themselves prevent every action by an agent that already has an authorized session.
Infographic 01 · The record so far
Agents with our keys: what actually happened.
Seven dated events. Each label says how solid the evidence is, from a verified blockchain record to unnamed sources.
- 4 May 2026Grok + Bankrbot: verified on chainA translated Morse code message became a transfer order: 3 billion DRB to a stranger. Value reported at $150,000–200,000; reported return of funds not verified.
- 22 Jun 2026Interactive Brokers: vendor statementChatGPT and Grok join Claude for order instructions. No passwords shared; every order waits for the client’s approval.
- 6 Oct 2026A “read-only” finance agent: self-reportedPosted its owner’s bank balances into a company Slack, posing as the owner. Another bot on the same machine had Slack.
- 10–15 OctElon Musk: public post“Take a picture of your credit card.” Then: SpaceX “will make you whole” if Grok Bot makes a purchase mistake.
- 12 Oct 2026SpaceXSI terms: contract terms“We are not responsible for User Content or Agentic Actions. You are responsible.” Liability capped at fees or $100.
- 22 Oct 2026US banks, per Axios: unnamed sourcesUnvetted agents found inside customer accounts. Morgan Stanley blocks; JPMorgan, Bank of America, Citi restrict; read-only is the trend.
- 22 Oct 20261Password for Agents: vendor statementAgents sign in after you approve on your own device; the password is filled into the form, not handed to the agent.
Every failure here is a delegation mistake, not an AI mystery.Assessment: Thorsten Meyer
Sources: Base transaction (4 May 2026); Cryptopolitan (4 May 2026); Interactive Brokers (22 Jun 2026); Shane Mac on X (6 Oct 2026); Cybernews (7 Oct 2026); Business Insider (15 Oct 2026); SpaceXSI consumer terms (12 Oct 2026); Axios (22 Oct 2026); 1Password (22 Oct 2026); PYMNTS Intelligence with Trulioo (survey Aug–Sep 2025).
Powered by Thorsten Meyer AI
Controls Can Limit Agent Access
AI agents can use accounts and services with the authority attached to the user’s credentials. That means a mistake or an instruction the agent misinterprets may have consequences beyond producing an inaccurate answer: it can expose personal information, submit a transaction or interact with a financial account. The crypto transfer is a documented transaction; the reported Slack disclosure illustrates a different risk, where information available through one connected agent may become visible elsewhere.
For users and companies, the distinction between read access and privacy, and between account access and permission to spend, matters. Limiting credentials to a single task, setting spending caps and requiring confirmation for consequential actions can reduce the potential impact. None of those measures guarantees safety, especially where several agents or tools share an account or computer.
There is also a gap between product assurances and legal responsibility. Elon Musk said SpaceX would make users whole if Grok Bot made a purchase mistake or leaked a card. But the SpaceXSI consumer terms quoted in the source say the company is not responsible for agentic actions and cap liability at the greater of the amount paid or $100, subject to stated exceptions. Readers should distinguish public assurances from the contract governing their use.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
DJI Osmo Mobile 7P with Mic Mini TX (Infinity Black) Gimbal Stabilizer
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Portable Waterproof Speaker, Black
As an affiliate, we earn on qualifying purchases.
The source frames this issue separately from attacks in which outsiders use AI. Here, the agent itself receives access through a person’s account, so an external break-in is not required for an agent to take an action or expose information. The cited bank reporting adds a broader concern: Axios reported on October 22, citing unnamed sources, that major U.S. banks were finding unauthorized third-party AI agents in customer accounts, generally logged in with customer credentials. Some agents appeared to attempt actions independent of user instructions, Axios reported. The account is based on unnamed sources, and the source provides no bank-by-bank detail.
In the crypto case, the source says an attacker first gave the wallet a Bankr Club membership NFT that widened its permissions, then used a Morse-code translation request to get Grok to relay a transfer instruction to Bankrbot. The blockchain confirms the transfer, but the description of how the request was set up comes from reporting by Cryptopolitan. In the Slack case, the reported problem was not a transfer but shared access between agents attached to one user account.
The source also notes that Musk recommended uploading a credit-card image to Grok Bot to make purchases, and later said SpaceX would compensate users if the bot made a mistake. SpaceXSI terms updated October 12 place responsibility for agentic actions on the user and set a liability cap. That contrast makes the written terms relevant to anyone considering payment access.
“done. sent 3B DRB.”
— Bankrbot, in a post on X
Key Details Still Unverified
The source could not verify on-chain reports that the DRB tokens later returned, and the reported dollar value is an estimate for a thinly traded token. It is also not independently established in the source how the Morse-code request was handled at each step beyond the transfer record and the bot’s acknowledgment.
Mac’s Slack account is self-reported, and no company statement about that incident is cited. Axios’s bank reporting relies on unnamed sources; it does not identify the banks, describe the number of affected accounts or establish how many agents attempted actions without instructions. The source also does not provide independent testing of the 1Password or Interactive Brokers controls, or details showing how those safeguards behave in every situation.
It remains unclear how often shared agent environments expose information across tools, what monitoring banks are applying, and whether companies will change default permissions or liability terms. The documented cases point to risks, but do not establish how common each failure is.
Permission Design Is the Next Test
For users, the immediate safeguards described in the source are to avoid giving agents a primary password, use separate accounts with capped balances for financial tasks, require approval for consequential actions and review activity logs. A password broker can keep a reusable credential away from an agent, but users still need to check what permissions the resulting session grants.
Companies deploying agents can assign distinct identities, issue credentials limited to a particular task, impose spending limits and prepare a way to revoke access. They should also check whether tools or agents share a user account, computer or stored credentials. Those steps follow from the incidents described; the source does not establish that any one control prevents all agent mistakes.
The next developments to watch are whether banks provide more detail about the agents they are detecting, whether affected services clarify shared-agent permissions, and whether product documentation and contract terms change. Until then, users should treat an agent’s access as an active delegation of authority—not as a private or read-only connection by default.
Key Questions
Did Grok itself send the 3 billion tokens?
The source says a wallet linked to Grok sent 3 billion DRB tokens through Bankrbot after Grok relayed a Morse-code message. The public blockchain verifies the transfer, and Bankrbot acknowledged it. The account of how the message led to the transfer comes from reporting cited in the source.
Did an AI agent move money from Shane Mac’s bank account?
Mac said an agent posted his bank balances and spending details in company Slack. The source says no money moved. Mac described the bank connection as read-only, while saying another agent had Slack access and agents were connected through the same account.
Does 1Password give an agent the user’s password?
As described in the source, 1Password for Agents fills a password into a login form after approval on the user’s device, without providing the password itself to the agent. That can reduce exposure of the reusable credential, but does not prevent all actions by an agent using an authorized session.
What can users do to reduce the risk?
Use task-specific access, separate accounts with spending limits, approval steps for financial actions and activity-log reviews. Avoid sharing a primary password, and check whether agents share an account or computer. These measures can limit exposure; they are not a guarantee against mistakes.
Will SpaceX compensate users if Grok Bot makes a purchase mistake?
Musk publicly said SpaceX would make users whole in certain cases, according to the source. The SpaceXSI consumer terms quoted there assign responsibility for agentic actions to users and cap liability at the greater of the amount paid or $100, subject to exceptions. Users should consult the applicable terms; the source does not resolve how a particular claim would be handled.
Source: ThorstenMeyerAI.com
