Big US banks are locking AI agents out of customer accounts

The personal AI agent was supposed to be the moment AI stopped talking and started doing things for you. In the banking world, that moment has run into a locked door. Within a single week in October 2026, four of the biggest names in American finance said they will not let outside AI agents log into customer accounts and move money. JPMorgan Chase, Charles Schwab, Citigroup and Bank of America all drew roughly the same line: agents may look, maybe, but they may not touch the money.

The trigger is a wave of consumer agents that launched this autumn. Meta released its personal agent Muse on 8 September, and according to PYMNTS it passed ChatGPT to reach the top of Apple's App Store ten days later. OpenAI followed with its own agent, Dots, and the text message concierge Instinct, built by a San Francisco startup that CNBC says reached a 10 billion dollar valuation last month, is also in the mix. All of them promise to act on your behalf. Some users handed these agents their bank passwords. The banks have now answered.

JPMorgan: no rogue agents, and a liability warning

The first and loudest voice was Jamie Dimon. On JPMorgan's third quarter earnings call on 13 October, the chief executive of the largest US bank by assets told analysts that the bank will not let just any outside agent operate inside its systems. "We're not going to allow just any … outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan," Dimon said, as reported by CNBC. He added: "You don't want rogue agents, and it could be thousands of them."

A JPMorgan spokeswoman then confirmed to CNBC that the bank currently blocks external AI agents from operating on behalf of retail customers. The bank's statement is precise about the method it rejects: "we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf." In other words, the problem is the classic pattern of giving a username and password to a piece of software that then pretends to be you.

That does not mean Chase is a fortress. Through open banking connectors such as Plaid, agents can still read some data, for example balances, if the customer has authorized that link. What they cannot do is send money or pay a bill, which are exactly the actions that make an agent useful in daily life. The spokeswoman said there is no timeline for when safeguards would be ready to let agents act directly in accounts.

Dimon also made a point that will matter for anyone who ignores the rules. "If people are using them, they should understand the risk," he said. "They should understand there's a liability transfer." Read plainly: if you give your login to an agent and something goes wrong, do not expect the bank to carry the loss.

At the same time, JPMorgan is building its own version. Chief Financial Officer Jeremy Barnum said the bank started a targeted pilot of a tool called Smart Cash, which predicts a customer's cash flow and moves funds to earn more yield. CNBC notes that this looks like a defensive move. If an agent is going to optimize your cash, JPMorgan would prefer it to be JPMorgan's agent.

Schwab: tens to twenties blocks per week

Three days later, Charles Schwab chief executive Rick Wurster went further and named a product. In a Bloomberg Television interview on 16 October, reported by Bloomberg Law and The Verge, he said Schwab is actively blocking unauthorized agents that try to move client money, including Meta's Muse.

"We don't want someone just giving their password to Muse, and letting Muse come in and take action on that client's behalf. We can't control it, the client can't control it, something could go wrong and who's liable?" Wurster said. "For the protection of the client and for the protection of us, we're not allowing it."

He also gave a rare number. Wurster said he receives a weekly report on how often Schwab blocks clients from using one of these agents, and that it is "in the tens and twenties, per week" for the big agents. His reading: people love AI, but most are not ready to turn over their financial accounts to it yet. That is an important nuance. The blocks are not a reaction to a flood of agent traffic. They are a policy set early, while numbers are still small.

Schwab's alternative is more interesting than a flat ban. Wurster said the company will prepare Model Context Protocol servers, the standard way for AI models to connect to outside tools, so that external language models can link to Schwab under rules Schwab controls. "What that allows us to do is control the authentication process and also control what they can access," he said. "We're not going to allow them to move money, but if they want to come in and see their account balances and do research, they will be able to do that through their LLMs." Schwab also wants clients to use Charley, its own assistant announced on 30 September, according to The Next Web.

Citi and Bank of America: a human in the loop

On the same day the Financial Times reported that Citigroup and Bank of America had become the latest US banks to restrict AI agents from client accounts. Citi said it does not allow "third party AI agents or assistants to log into customer accounts or directly initiate transactions" on its digital banking platforms, a step it describes as protecting accounts and customer data.

Bank of America chief executive Brian Moynihan framed it as a question of authorization. In an interview on 14 October he said money leaving an account must have human review and approval, and that the bank is talking with agent makers about it. The Verge summarized his position: Bank of America does not want customers turning to the bank after an agent botched a transaction, and it argues for human payment authorization at least until agents become more capable. According to the FT, the bank restricts agent access to retail deposits until there is a clear process for deciding who is responsible for payments an AI approved.

The real fear: an agentic bank run

Security and liability are the official reasons. But the FT also reports that lenders have raised another concern with regulators: agents could drain deposits by moving idle cash in search of higher returns. That risk has a name since late September.

On 27 September, Apollo chief economist Torsten Slok published a note titled Is an Agentic Bank Run Coming?. His argument is simple. The national average on checking accounts is about 0.1 percent. Online banks and fintech accounts pay between 3.3 and 5.0 percent. On a balance of 10,000 dollars that is roughly 10 dollars a year versus about 100. Most people never move that money because it takes time and attention. An agent does not get bored. "If every household used AI agents to optimize the return on their cash balances, banks could lose a large share of the cheap deposits they rely on to make loans, which would be a problem for the entire financial system," Slok wrote.

The pool is huge. The FT reported that JPMorgan Chase, Bank of America and Wells Fargo alone hold about 1.6 trillion dollars in deposits that pay no interest at all. Those deposits are the cheapest funding a bank has. In September, CNBC notes, bank stocks fell as Muse climbed the download charts, on exactly this fear.

Seen this way, the bank blocks have two effects at once. They protect customers from agents that act on stolen or shared passwords, and they protect the bank's own deposit base from a machine that would shop around every night. Both are true, and the banks only talk about the first one.

It is not only banks

The banking story is part of a wider pattern. In a long piece on 17 October, The Verge describes how popular websites are closing their doors to agents. Users of Muse, xAI's Grok, OpenAI's Dots and Instinct have reported blocks at major sites. Yelp told TechCrunch it only allows agents that pay for its data licensing program. Delta Air Lines prevents agents from booking tickets. Users say Cars.com and Amtrak stopped working for their agents, which suggests quiet blocks elsewhere.

Amazon has been fighting this battle the longest. It sued Perplexity over its shopping agent, and has now told Meta that the continued access of Muse violates its site policies. Meta's public answer is that "turning away a personal agent means turning away the customer behind it," and it has partnered with retailers such as Walmart, Gap, Sephora and Best Buy so that Muse can shop there. Shopify has opened its storefront network to agents as well.

Even sites that welcome agents may block them by accident. Anti bot systems were built to stop scrapers and fraud, and an agent clicking through a checkout looks a lot like a bot. "These AI agents trigger those same safeguards," Chris Canal, chief executive of the AI evaluation company EquiStamp, told The Verge.

What this means for agent builders and users

For people building agents, the message from the banks is clear and fairly consistent. Credential sharing, where the agent logs in as the user, is finished at the largest US banks. The paths that remain are sanctioned ones: open banking connectors for read only data, and in Schwab's case dedicated MCP servers with bank controlled authentication. Any agent that wants to move money will need an authorization step that a human confirms, at least for now.

For users, three practical points follow.

• Do not give your bank password to an agent. At JPMorgan, Schwab and Citi this is against policy, and Dimon has already signaled that the liability may land on you.
• Read only access is the realistic option. Checking balances, sorting transactions and researching investments through approved connectors will keep working and will likely expand.
• Expect the banks' own assistants. JPMorgan's Smart Cash and Schwab's Charley show where this is going: the bank wants to be the one that optimizes your money, inside its own walls.

Our take

There is a real security argument here. An agent that holds your password is a single point of failure, and recent months have shown that AI systems can behave unpredictably when given broad access. A human approval step before money leaves an account is a reasonable rule, and it is the same rule many people already apply to their own family members.

But the banks are also defending a business model that depends on customers not paying attention. Agents are, at their core, attention machines that never get tired. If agents become safe enough to move money, the pressure on the 0.1 percent checking account will be enormous. The current blocks buy time. They do not answer the question of who gets to optimize your money in the long run: you, your agent, or your bank.

Sources

• CNBC, JPMorgan Chase blocks outside AI agents like Muse, Instinct from directly accessing accounts, 13 October 2026
• Bloomberg Law, US Banks Block AI Agents Attempting to Move Money for Customers, 16 October 2026
• Financial Times, Citi becomes latest US bank to restrict AI agents from accessing accounts, 16 October 2026
• The Verge, Bank of America CEO wants a human in the loop, 15 October 2026
• The Verge, Websites are closing their doors to AI agents, 17 October 2026
• Apollo, Is an Agentic Bank Run Coming?, Torsten Slok, 27 September 2026
• PYMNTS, AI Agents Wake Up 1.6 Trillion Dollars in Sleepy Bank Deposits, 8 October 2026