{
  "slug": "banks-locking-out-ai-agents",
  "title": "Why America’s biggest banks are locking out AI agents",
  "description": "Customers are handing online-banking passwords to personal AI agents. Banks can’t tell them apart from people, so they are blocking them and rewriting who carries the risk. A plain-English explainer for people in digital banking.",
  "url": "https://tanveerriaz.me/blog/banks-locking-out-ai-agents",
  "datePublished": "2026-10-25",
  "dateModified": "2026-10-25",
  "markdownUrl": "https://tanveerriaz.me/blog/banks-locking-out-ai-agents/index.md",
  "jsonUrl": "https://tanveerriaz.me/blog/banks-locking-out-ai-agents/index.json",
  "text": "For agents Markdown JSON Explainer Banking · Digital channels AI agents and online banking Why America’s biggest banks are locking out AI agents Customers are handing their online-banking passwords to personal AI assistants. Banks often cannot tell those assistants from the customer, so they are shutting the door and rewriting who carries the risk. As of 24 October 2026 About 8 minutes’ read Image: CBS News / Getty Images Key points Big US banks are blocking or restricting personal AI agents that sign in using customers’ own usernames and passwords. Most of the activity reported so far is customers giving an agent their login, not hacking. But banks say they often cannot tell a person from an agent, or an approved agent from a rogue one. Banks are steering agents to approved, read-only connections and changing their terms so that customers carry more of the risk. No losses or case counts have been reported. The news peaked within a day, but the policy debate is still building. 1 · The scene A week in which banks drew a line On Thursday 22 October, Axios reported that major US banks were detecting unauthorised third-party AI agents operating inside customer accounts, “with some agents attempting to take actions that appear to be independent of user instructions.” ( Axios ) Reuters reported the same day that major US banks had been blocking such agents from operating inside accounts and making transactions. ( CNA (Reuters) , Investing.com (Reuters) ) Axios summed up the problem in one line: “The difficulty in distinguishing between a human and an unauthorized bot is forcing banks to block the technology and rapidly rewrite their terms of service.” ( Axios ) Timeline US dates 8 Sep Meta launches its Muse personal agent. Bank shares fall on fears for deposits. ( CNBC Investing Club ) 13 Oct Jamie Dimon says JPMorgan will not let outside agents in. ( CNBC ) 14–16 Oct Bank of America, Schwab and Citi set out similar limits. ( PYMNTS ) 21 Oct Meta says Muse has 10 million users. ( USA Today ) 22 Oct Axios scoop; Reuters follows. Reporter Madison Mills’ post on X passes 8.8 million views. ( Axios , CNA (Reuters) , X: Mills ) 22 Oct DeSantis, Sanders and Sacks respond on X. The OCC’s Jonathan Gould says banks are prepared. ( X: DeSantis , X: Sanders , X: Sacks , American Banker ) 23 Oct Protos puts losses across five bank stocks at about $22.8bn. Senator Warren writes to the Fed. CNBC asks whether markets are overreacting. ( Protos , Bloomberg Law , CNBC Investing Club ) 24 Nov Wells Fargo’s new online access agreement takes effect. ( USA Today ) The cases described so far do not look like a cyber-attack. “In a lot of cases, this is just going to be customers giving their username or password to an AI agent that the bank hasn’t had a chance to vet yet, that goes against the bank’s terms of service,” Mills, the Axios reporter behind the story, told CBS News. She also said the agents were not going rogue, hacking accounts or draining funds. They were largely following their users’ instructions, but without the bank’s permission to act for the account holder. ( CBS News ) Banks also say they have seen no rogue agent activity and no hack affecting customer funds or accounts. ( Axios ) Morgan Stanley, which has begun blocking third-party agents, said it had not observed “rogue AI agents accessing our platforms.” ( Axios ) No losses or case counts have been reported. The background is a fast-growing group of consumer “personal agents”: AI assistants that act on their own once given a task. Meta launched Muse on 8 September, OpenAI followed weeks later with Dots, and an invitation-only service called Instinct works mainly over text message. ( CNBC , CNBC Investing Club ) Meta said on 21 October that Muse had reached 10 million users. ( USA Today ) 2 · How it works Step by step: how an agent gets into an account None of this needs a security flaw. The agent uses the same front door as the customer. The customer shares the login. The customer gives a personal AI agent their online-banking username and password so that it can handle money tasks for them. ( Axios , CNA (Reuters) ) The agent signs in like a person. The agent signs in with those details, working the bank’s website or app much as a person would. This is often called screen automation : software that types into boxes and clicks buttons for you. Banks’ own guidelines usually require humans to log in to their own accounts. ( Axios ) The bank sees a normal login. The correct username and password were entered, so to the bank’s systems it looks like the customer. Banks “are broadly not able to parse whether agent account activity is user-directed,” Axios reported. One executive said they struggle to tell agents apart, and to tell an agent the customer approved from one that has “gone rogue.” ( Axios ) The agent acts inside the account. It can check balances and, if allowed, make purchases or move funds. Some banks tracked agents contacting call centres or appearing to act without a matching instruction. ( Axios ) One example Mills gave CBS was an agent calling a bank with a complaint without first checking with the account holder. ( CBS News ) That raises an awkward legal point. Reuters reported that when a customer has shared their credentials, the resulting transactions cannot be deemed unauthorised, even though banks typically flag and block them. ( CNA (Reuters) ) Andre Durand, chief executive of identity-security firm Ping Identity, described the problem in two parts: “how can we detect that it is an agent and not a human asking. And if we can detect that it’s an agent not a human, how do we know that the agent is acting on the authority of the human?” ( USA Today ) Two ways in The shared-password route banks are blocking, and the approved route they say they support Illustration based on reporting by Axios , Reuters and USA Today . Examples of approved connectors from CNBC and Fortune . The approved route Banks already have a safer channel. With open banking , a customer authorises an approved third party to get data from the bank through a formal interface (an API) instead of handing over a password. Access is limited to what was granted and can be withdrawn. At JPMorgan, outside agents can see some data, such as balances, read-only through Plaid or another connector, “but they can’t send money or pay a bill,” CNBC reported. ( CNBC ) Muse itself connects financial accounts through Plaid for balances, transactions and holdings. ( Fortune ) David Sacks, who has served as the White House AI czar, pointed to American Express as an authorised connection inside Muse, “making it easy for users to grant, limit, and revoke access.” ( X: Sacks ) Schwab says it will build controlled connections, known as MCP servers, so that a client’s chosen AI can check balances and run research under rules Schwab sets, without moving money. ( PYMNTS ) 3 · The response What the banks are doing, in their words JPMorgan Chase was first to say so publicly. “We’re not going to allow just any … outside agent to come in inside the company, because it’s just too risky for clients and for JPMorgan,” Jamie Dimon told analysts on the bank’s third-quarter earnings call on 13 October. ( CNBC ) “You don’t want rogue agents, and it could be thousands of them.” Jamie Dimon, JPMorgan Chase, Q3 earnings call · CNBC After the Axios report, a JPMorgan spokesperson went further: “There exist secure open banking platforms that don’t involve handing over the keys to your account. Customers are the first line of defense in protecting their accounts.” ( Axios ) “Under no circumstance should customers share passwords with any person or thing. Period.” JPMorgan spokesperson · Axios Charles Schwab chief executive Rick Wurster said: “I get a report every day tracking how many times we’ve had to block one of the different agents, and it’s not many because I think people aren’t using it in that way in their financial life. We are blocking it because we want to have control over authentication and the experience.” ( CNA (Reuters) ) He told Bloomberg that the big agents are blocked in the “tens and twenties.” ( USA Today ) Citi told USA Today: “We do not permit third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms.” Customers can instead give agents “limited, read-only access to their account information with certain Citi-approved open banking providers.” ( USA Today ) Bank of America is restricting agents’ access to consumer deposits while it works on protocols with agent developers. ( USA Today , PYMNTS ) “We strongly believe there should be a human in the loop to authorize money moving out of your account,” chief executive Brian Moynihan told CNBC. ( CNBC Investing Club ) Wells Fargo says it has “taken steps to block unauthorized agents from accessing customer accounts.” It has also rewritten its online access agreement, which takes effect on 24 November. ( USA Today ) From Wells Fargo’s updated terms, as reported by USA Today Users agree they are “solely responsible” for supervising agents. Transactions by authorised representatives such as agents, “including those you did not want or intend,” are considered authorised. “If you permit an AI Agent or other third party access to the Service, you acknowledge that doing so may adversely impact the commercially reasonable security procedures that you’ve otherwise agreed to, and you accept the risk of such access.” Source: USA Today In short, banks are doing three things: blocking agent logins that use customer passwords, rewriting terms so that a human must log in or the customer carries the risk, and allowing read-only access through approved providers. 4 · The stakes Why banks care so much Security and fraud A bank’s fraud controls assume a person is on the other end. When a login is shared, a payment request or a call-centre contact may not reflect what the customer actually wants. In a 2026 Palo Alto Networks study cited by USA Today, two-thirds of chief information security officers in financial services and software ranked agentic AI among their top three cyber risks. ( USA Today ) Liability If an agent makes a mistake, who pays? “If people are using them, they should understand the risk,” Dimon said. “They should understand there’s a liability transfer.” ( CNBC ) RBC analyst Gerard Cassidy has raised the case of an authorised agent sending money to the wrong account. Unlike card fraud, where consumer protections are well established, responsibility for an agent’s mistakes is unclear. ( CNBC Investing Club ) The Wells Fargo terms show where some banks are heading. Control of the customer relationship Wurster’s words, “control over authentication and the experience,” go to the heart of it. ( CNA (Reuters) ) Banks are building their own assistants for the jobs outside agents want to do. JPMorgan is piloting Smart Cash, a tool that forecasts cash flow and moves funds to maximise yield. Schwab has launched Charley, which answers questions and handles routine tasks but cannot trade. ( CNBC , USA Today ) Deposits Investors worry that agents will shop for better rates and move cheap deposits automatically. One economist has floated the idea of a bank run driven by agents moving household cash into higher-yield accounts. ( Axios ) Between Muse’s launch on 8 September and 21 October, Bank of America shares fell 18% and Schwab’s 14%, though CNBC notes other factors too, including the Federal Reserve’s September rate rise. ( CNBC Investing Club ) Analysts are sceptical of the worst case. “I’m very strongly in the camp that the risk should be taken seriously, but it’s exaggerated,” said Wells Fargo analyst Mike Mayo. Third-quarter earnings showed no clear sign of deposits shifting. ( CNBC Investing Club ) 5 · The backlash A fast news cycle and a slower political fight The story spread quickly. Mills’ post on X has had about 8.8 million views. ( X: Mills ) Florida governor Ron DeSantis wrote that “imposing criminal liability on AI executives might help mitigate it at the front end.” ( X: DeSantis ) Senator Bernie Sanders wrote: “We cannot allow AI agents to go into your bank account and act independently without your authorization,” ending, “Pause AI NOW!” ( X: Sanders ) Senator Adam Schiff said the threat of rogue agents “has long since stopped being a hypothetical,” and Senator Mark Warner joined calls for regulation. ( Techmeme , Axios ) “This may violate bank terms requiring humans to log in themselves, but these are in no way cyberattacks.” David Sacks, on X · post , also reported by CBS News Sacks argued that most of the activity was customers sharing credentials, and that “frightening the public by blurring the line between user-authorized agentic behavior and cyberattacks is irresponsible.” He called read-only access “a sensible interim step.” ( X: Sacks ) Comptroller of the Currency Jonathan Gould told Fox Business that banks “have been all over this for months now, fortifying their defenses.” ( American Banker ) Markets reacted. JPMorgan, Morgan Stanley, Wells Fargo, Citi and Bank of America lost a combined $22.8bn in market value within hours of the report, though some of the losses were later recovered. ( Protos ) Senator Elizabeth Warren wrote to the Federal Reserve, arguing that as AI makes cyber-attacks easier, the Fed should be strengthening examiners’ supervisory tools, “not gutting them.” ( Bloomberg Law ) CNBC’s Investing Club asked whether Wall Street was overreacting. ( CNBC Investing Club ) Posts mentioning banks and AI agents on X, per UTC day. Source: X API recent post counts, broad keyword query. *24 October partial, to 15:41 SGT. Daily counts for 18–21 October fell between about 470 and 610. Attention faded almost as fast as it rose. Posts on X went from a few hundred a day to more than 26,000 on 22 October, then fell back near that baseline by 24 October. The policy questions have not gone away. 6 · For digital banking teams What it means for online and mobile channels For people who run digital sales, online banking and other digital channels, these are the practical issues the episode raises. Logins were designed for humans Passwords and one-time codes assume a person is typing. Durand warned that one-time passwords sent by email are no longer secure enough, because agents often have access to the customer’s email. “Passkeys and biometrics ensure that the human is the one authenticating, and/or that the human is the one authorizing,” he said. ( USA Today ) Know your agent Banks verify customers (“know your customer”). The next step is verifying the agent: who it is, who runs it, and what it may do. The UK’s Financial Conduct Authority is urging banks to prepare for “know your agent” checks. ( The Banker ) Meta is developing “Poppy”, a protocol with Sierra covering “how a personal agent identifies itself, gets the customer’s permission, and works with a company.” ( Fortune ) A sanctioned door, not just a locked one Customers will want to use agents, and banks know it. Axios reported that executives see the need for a middle ground. ( Axios ) In practice that means read-only APIs through approved providers, controlled connections such as Schwab’s planned MCP servers, and banks’ own assistants. ( PYMNTS , USA Today ) Customer messaging The simplest message is the one Chase is using: customers should not give their username and password to anyone. They should use the bank’s approved data-sharing route instead. ( CBS News , Axios ) Terms and conditions Wells Fargo’s update shows how liability can move to the customer through the online access agreement. Product, legal and complaints teams should expect these clauses to be tested. ( USA Today ) Singapore and the UK No bank outside the US has been reported publicly blocking agents in the coverage cited here. In Singapore, the Monetary Authority of Singapore (MAS) said on 9 October that version 1.1 of its SAFR (Safeguards for Agentic Finance at Runtime) paper and open-source reference code are available. SAFR describes three linked checks: establish the agent’s identity and authority, compare the proposed action with the user’s mandate before it executes, and keep an audit record. It is a research prototype, not a new MAS rule. ( Fintech.com.sg ) 7 · What to watch The next milestones 24 Nov Wells Fargo’s new online access agreement takes effect. Watch whether other banks adopt similar agent clauses. ( USA Today ) CFPB 1033 The US open-banking rule is being rewritten. The proposal was sent for White House review in August. Publication for public comment is the next step. ( Consumer Finance Monitor ) Congress Possible hearings or bills following Warren and Warner, including Warner’s AI AGENT Act (S.5051), introduced in July and still in committee. ( Bloomberg Law , Congress.gov ) Industry Whether Meta’s “Poppy” agent protocol, or similar standards, are taken up by banks. ( Fortune ) Regulators Formal moves from the FCA on “know your agent”, and from MAS on agent safeguards. ( The Banker , Fintech.com.sg ) Sources Axios — “Scoop: Unvetted AI agents are accessing U.S. bank accounts”, 22 Oct 2026 Axios — “Wall Street prepares for AI’s ‘day after’”, 23 Oct 2026 CNA (Reuters) — “US banks are blocking third-party AI agents access to customer accounts, sources say”, 22 Oct 2026 Investing.com (Reuters) — “US banks detect unauthorized AI agents in customer accounts, Axios reports”, 22 Oct 2026 CNBC — “JPMorgan Chase blocks outside AI agents like Muse, Instinct from directly accessing accounts”, 13 Oct 2026 CNBC Investing Club — “AI agents could disrupt bank deposits. Why Wall Street may be overreacting”, 23 Oct 2026 Fortune — “‘You don’t want rogue agents’: Jamie Dimon bars outside AI agents like Meta’s Muse from JPMorgan accounts”, 15 Oct 2026 PYMNTS — “Big Banks Won’t Let Outside AI Agents Move Money”, 19 Oct 2026 CBS News — “AI agents are roaming around consumers’ bank accounts, and banks aren’t happy about it”, 23 Oct 2026 USA Today — “‘Window of vulnerability’: Banks move to restrict AI agent access”, 23 Oct 2026 American Banker — “Gould: Banks preparing for rogue AI agents for ‘months’”, 22 Oct 2026 Protos — “Bank stocks crashed by $22 billion after AI access scare”, 23 Oct 2026 Bloomberg Law — “Bank Regulators Overlook AI-Enabled Cyber Risks, Warren Says”, 23 Oct 2026 Techmeme — Coverage roundup, 22 Oct 2026 OECD.AI — AI Incidents Monitor entry, 22 Oct 2026 Fintech.com.sg — “MAS highlights open-source safeguards for AI agents in finance”, 9 Oct 2026 The Banker — “Prepare for ‘know your agent’ AI checks, says FCA” Consumer Finance Monitor — “CFPB Sends New Section 1033 ‘Open Banking’ Proposal to OIRA for Review”, 6 Aug 2026 Congress.gov — S.5051, AI AGENT Act of 2026 (Sen. Mark Warner) X — Madison Mills (Axios), post of 22 Oct 2026 X — David Sacks, post of 22 Oct 2026 X — Sen. Bernie Sanders, post of 22 Oct 2026 X — Gov. Ron DeSantis, post of 22 Oct 2026 Quotes are taken from the linked articles and posts and attributed to the outlet that carried them. Where an outlet was reporting another outlet’s interview (for example USA Today citing Bloomberg), the outlet we read is named. Schiff’s remark is quoted from Techmeme’s roundup of his Bluesky post. The X post counts come from the X API’s recent-counts endpoint using a broad keyword query, so they show the trend rather than an exact total. As of 24 October 2026. A summary of public reporting for general information. Not financial or legal advice."
}