Why America’s biggest banks
are locking out AI agents

1 · The sceneA week in which banks drew a line

On Thursday 22 October, Axios reported that major US banks were detecting unauthorised third-party AI agents operating inside customer accounts, “with some agents attempting to take actions that appear to be independent of user instructions.” (Axios) Reuters reported the same day that major US banks had been blocking such agents from operating inside accounts and making transactions. (CNA (Reuters), Investing.com (Reuters))

Axios summed up the problem in one line: “The difficulty in distinguishing between a human and an unauthorized bot is forcing banks to block the technology and rapidly rewrite their terms of service.” (Axios)

The cases described so far do not look like a cyber-attack. “In a lot of cases, this is just going to be customers giving their username or password to an AI agent that the bank hasn’t had a chance to vet yet, that goes against the bank’s terms of service,” Mills, the Axios reporter behind the story, told CBS News. She also said the agents were not going rogue, hacking accounts or draining funds. They were largely following their users’ instructions, but without the bank’s permission to act for the account holder. (CBS News)

Banks also say they have seen no rogue agent activity and no hack affecting customer funds or accounts. (Axios) Morgan Stanley, which has begun blocking third-party agents, said it had not observed “rogue AI agents accessing our platforms.” (Axios) No losses or case counts have been reported.

The background is a fast-growing group of consumer “personal agents”: AI assistants that act on their own once given a task. Meta launched Muse on 8 September, OpenAI followed weeks later with Dots, and an invitation-only service called Instinct works mainly over text message. (CNBC, CNBC Investing Club) Meta said on 21 October that Muse had reached 10 million users. (USA Today)

2 · How it worksStep by step: how an agent gets into an account

None of this needs a security flaw. The agent uses the same front door as the customer.

1. The customer shares the login. The customer gives a personal AI agent their online-banking username and password so that it can handle money tasks for them. (Axios, CNA (Reuters))
2. The agent signs in like a person. The agent signs in with those details, working the bank’s website or app much as a person would. This is often called screen automation: software that types into boxes and clicks buttons for you. Banks’ own guidelines usually require humans to log in to their own accounts. (Axios)
3. The bank sees a normal login. The correct username and password were entered, so to the bank’s systems it looks like the customer. Banks “are broadly not able to parse whether agent account activity is user-directed,” Axios reported. One executive said they struggle to tell agents apart, and to tell an agent the customer approved from one that has “gone rogue.” (Axios)
4. The agent acts inside the account. It can check balances and, if allowed, make purchases or move funds. Some banks tracked agents contacting call centres or appearing to act without a matching instruction. (Axios) One example Mills gave CBS was an agent calling a bank with a complaint without first checking with the account holder. (CBS News)

That raises an awkward legal point. Reuters reported that when a customer has shared their credentials, the resulting transactions cannot be deemed unauthorised, even though banks typically flag and block them. (CNA (Reuters))

Andre Durand, chief executive of identity-security firm Ping Identity, described the problem in two parts: “how can we detect that it is an agent and not a human asking. And if we can detect that it’s an agent not a human, how do we know that the agent is acting on the authority of the human?” (USA Today)

The approved route

Banks already have a safer channel. With open banking, a customer authorises an approved third party to get data from the bank through a formal interface (an API) instead of handing over a password. Access is limited to what was granted and can be withdrawn. At JPMorgan, outside agents can see some data, such as balances, read-only through Plaid or another connector, “but they can’t send money or pay a bill,” CNBC reported. (CNBC) Muse itself connects financial accounts through Plaid for balances, transactions and holdings. (Fortune)

David Sacks, who has served as the White House AI czar, pointed to American Express as an authorised connection inside Muse, “making it easy for users to grant, limit, and revoke access.” (X: Sacks) Schwab says it will build controlled connections, known as MCP servers, so that a client’s chosen AI can check balances and run research under rules Schwab sets, without moving money. (PYMNTS)

3 · The responseWhat the banks are doing, in their words

JPMorgan Chase was first to say so publicly. “We’re not going to allow just any … outside agent to come in inside the company, because it’s just too risky for clients and for JPMorgan,” Jamie Dimon told analysts on the bank’s third-quarter earnings call on 13 October. (CNBC)

“You don’t want rogue agents, and it could be thousands of them.”

Jamie Dimon, JPMorgan Chase, Q3 earnings call · CNBC

After the Axios report, a JPMorgan spokesperson went further: “There exist secure open banking platforms that don’t involve handing over the keys to your account. Customers are the first line of defense in protecting their accounts.” (Axios)

“Under no circumstance should customers share passwords with any person or thing. Period.”

JPMorgan spokesperson · Axios

Charles Schwab chief executive Rick Wurster said: “I get a report every day tracking how many times we’ve had to block one of the different agents, and it’s not many because I think people aren’t using it in that way in their financial life. We are blocking it because we want to have control over authentication and the experience.” (CNA (Reuters)) He told Bloomberg that the big agents are blocked in the “tens and twenties.” (USA Today)

Citi told USA Today: “We do not permit third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms.” Customers can instead give agents “limited, read-only access to their account information with certain Citi-approved open banking providers.” (USA Today)

Bank of America is restricting agents’ access to consumer deposits while it works on protocols with agent developers. (USA Today, PYMNTS) “We strongly believe there should be a human in the loop to authorize money moving out of your account,” chief executive Brian Moynihan told CNBC. (CNBC Investing Club)

Wells Fargo says it has “taken steps to block unauthorized agents from accessing customer accounts.” It has also rewritten its online access agreement, which takes effect on 24 November. (USA Today)

In short, banks are doing three things: blocking agent logins that use customer passwords, rewriting terms so that a human must log in or the customer carries the risk, and allowing read-only access through approved providers.

4 · The stakesWhy banks care so much

Security and fraud

A bank’s fraud controls assume a person is on the other end. When a login is shared, a payment request or a call-centre contact may not reflect what the customer actually wants. In a 2026 Palo Alto Networks study cited by USA Today, two-thirds of chief information security officers in financial services and software ranked agentic AI among their top three cyber risks. (USA Today)

Liability

If an agent makes a mistake, who pays? “If people are using them, they should understand the risk,” Dimon said. “They should understand there’s a liability transfer.” (CNBC) RBC analyst Gerard Cassidy has raised the case of an authorised agent sending money to the wrong account. Unlike card fraud, where consumer protections are well established, responsibility for an agent’s mistakes is unclear. (CNBC Investing Club) The Wells Fargo terms show where some banks are heading.

Control of the customer relationship

Wurster’s words, “control over authentication and the experience,” go to the heart of it. (CNA (Reuters)) Banks are building their own assistants for the jobs outside agents want to do. JPMorgan is piloting Smart Cash, a tool that forecasts cash flow and moves funds to maximise yield. Schwab has launched Charley, which answers questions and handles routine tasks but cannot trade. (CNBC, USA Today)

Deposits

Investors worry that agents will shop for better rates and move cheap deposits automatically. One economist has floated the idea of a bank run driven by agents moving household cash into higher-yield accounts. (Axios) Between Muse’s launch on 8 September and 21 October, Bank of America shares fell 18% and Schwab’s 14%, though CNBC notes other factors too, including the Federal Reserve’s September rate rise. (CNBC Investing Club) Analysts are sceptical of the worst case. “I’m very strongly in the camp that the risk should be taken seriously, but it’s exaggerated,” said Wells Fargo analyst Mike Mayo. Third-quarter earnings showed no clear sign of deposits shifting. (CNBC Investing Club)

5 · The backlashA fast news cycle and a slower political fight

The story spread quickly. Mills’ post on X has had about 8.8 million views. (X: Mills) Florida governor Ron DeSantis wrote that “imposing criminal liability on AI executives might help mitigate it at the front end.” (X: DeSantis) Senator Bernie Sanders wrote: “We cannot allow AI agents to go into your bank account and act independently without your authorization,” ending, “Pause AI NOW!” (X: Sanders) Senator Adam Schiff said the threat of rogue agents “has long since stopped being a hypothetical,” and Senator Mark Warner joined calls for regulation. (Techmeme, Axios)

“This may violate bank terms requiring humans to log in themselves, but these are in no way cyberattacks.”

David Sacks, on X · post, also reported by CBS News

Sacks argued that most of the activity was customers sharing credentials, and that “frightening the public by blurring the line between user-authorized agentic behavior and cyberattacks is irresponsible.” He called read-only access “a sensible interim step.” (X: Sacks) Comptroller of the Currency Jonathan Gould told Fox Business that banks “have been all over this for months now, fortifying their defenses.” (American Banker)

Markets reacted. JPMorgan, Morgan Stanley, Wells Fargo, Citi and Bank of America lost a combined $22.8bn in market value within hours of the report, though some of the losses were later recovered. (Protos) Senator Elizabeth Warren wrote to the Federal Reserve, arguing that as AI makes cyber-attacks easier, the Fed should be strengthening examiners’ supervisory tools, “not gutting them.” (Bloomberg Law) CNBC’s Investing Club asked whether Wall Street was overreacting. (CNBC Investing Club)

Attention faded almost as fast as it rose. Posts on X went from a few hundred a day to more than 26,000 on 22 October, then fell back near that baseline by 24 October. The policy questions have not gone away.

6 · For digital banking teamsWhat it means for online and mobile channels

For people who run digital sales, online banking and other digital channels, these are the practical issues the episode raises.

7 · What to watchThe next milestones

• 24 NovWells Fargo’s new online access agreement takes effect. Watch whether other banks adopt similar agent clauses. (USA Today)
• CFPB 1033The US open-banking rule is being rewritten. The proposal was sent for White House review in August. Publication for public comment is the next step. (Consumer Finance Monitor)
• CongressPossible hearings or bills following Warren and Warner, including Warner’s AI AGENT Act (S.5051), introduced in July and still in committee. (Bloomberg Law, Congress.gov)
• IndustryWhether Meta’s “Poppy” agent protocol, or similar standards, are taken up by banks. (Fortune)
• RegulatorsFormal moves from the FCA on “know your agent”, and from MAS on agent safeguards. (The Banker, Fintech.com.sg)

As of 24 October 2026. A summary of public reporting for general information. Not financial or legal advice.