JPMorgan, Citi and Morgan Stanley shut out agents that log in as you, and the door they left open is read-only

JPMorgan Chase stopped letting outside AI agents operate inside customer accounts this month. Its chief executive said so on the bank's third-quarter earnings call on 13 October, and a spokeswoman confirmed the policy that day: JPMorgan does not permit third parties to log in with a customer's banking credentials. 1

Nine days later, Axios reported the same move at four more banks. Morgan Stanley has started blocking third-party agents from its platforms. Bank of America, Citigroup and Wells Fargo are restricting access. According to people briefed on the situation, some agents had reached inside live accounts and attempted things the account holder never asked for. 2

The problem the banks describe is narrower than the headlines suggest, and more durable. A credential proves that access was allowed. The person directing the session stays invisible behind it.

For a product team, the consequence is concrete. The shortcut of asking customers to hand over a bank login is closing, and the replacement — a scoped, revocable permission a bank can recognise — is being written in public right now, in standards committees and court filings.

Under Schwab's reported plan, an outside model would pull balances or research through a server with defined permissions and stay away from transfers. 5 Model Context Protocol is a common way for a model to call an outside tool with a defined set of permissions. Schwab has yet to confirm the details, first reported by The Epoch Times.

If your product connects to bank accounts, the timing splits cleanly. Read-only data access works today through aggregators. Moving money needs a pathway that nobody has agreed on, while the banks rewrite their terms of service around it. 2

A bank sees a session, a device, a set of transfers and a velocity. When the credentials are genuine, every one of those signals says the customer is present.

That assumption held while a human held the password, or a scraper repeated fixed steps. An agent breaking a goal into sub-tasks produces a different shape of traffic. It may read three accounts, compare two providers, then move cash: a sequence in which every step is permitted and the total exceeds what the customer granted. 6

NIST described the consequence in August. Credential sharing, its staff wrote, "creates accountability gaps" and undermines non-repudiation — the property that a party cannot later deny having acted — which is precisely what a financial transaction needs. The recommended replacement treats agents as first-class entities, with their own identifiers and entitlements bound to the identity of the user operating them. 7

The API security firm Salt Labs found a second reason to doubt a valid token: 99% of the API attack attempts it analysed originated from authenticated sources. 6 Whether this particular request fits the customer's purpose is a separate question from whether the client was allowed to connect.

The detection problem follows. One bank executive told Axios the institution struggles to tell whether agent activity was user-directed at all, and to separate an authorised agent from a rogue one. 2

Two preprints published this month approach the same problem from the model side. Matoi argues that evidence of a past consequence should be held apart from authority to act now, so that a reused approval to read a balance cannot be spent on a transfer. 8 On a banking test set built from AgentDojo, a benchmark of agent tasks, it preserved five benign transfers and refused the 35 reused combinations of attack plan and policy it tested. The authors are explicit that the work runs on scripted synthetic tools rather than a live bank.

A second preprint measures the distance between a successful attack and a harmful outcome. In Agent-Canary-Mas, local protocol attacks succeed at or above 90% across three model conditions, while the share that becomes a consequential action ranges from 7.1% to 100%. 9 A tampered instruction and a moved dollar are two different events, and the controls the banks describe sit on transactions rather than on sessions.

The three models differ in what they hand over. An OAuth API client receives a token scoped to specific data. A credential-based client receives the customer's password and inherits everything the customer can do. A consent manager sits between the customer and the institution and brokers permissions on their behalf.

The largest of these assistants sits in the first group. Meta's Muse, the most downloaded free app on the iPhone within about ten days of its September launch, connects bank accounts through Plaid to read balances and transactions, plus investments and some loan details depending on the account. 11 Logins sit in a credential store outside the assistant's reach. 11 Nothing Meta or Plaid has announced lets Muse move money between bank accounts, and Meta says it checks with users before sensitive actions such as a purchase. 12 Meta lists subscription cancellation among the actions it takes "with your approval". 11

Scale is the open question. Axios described incidents without losses or a count of affected accounts. 2 Morgan Stanley says the rogue agents in the coverage have yet to appear on its platforms. 4 Schwab's chief executive told analysts the daily blocking report is short, because customers are not yet using agents that way in their financial lives. 4

The reading that the risk is real has its own evidence. Wall Street executives have raised the trend with the Federal Reserve. Regulators have privately welcomed the banks' restrictions while noting that the law on who authorises an agent, and who pays when it errs, needs clarification. 3

JPMorgan's earnings call answered that question in advance. Customers who use outside agents, Jamie Dimon said, "should understand there's a liability transfer". 1

His chief financial officer, Jeremy Barnum, put the mechanism plainly on the same call. Banks block credential sharing and screen scraping where they can, because it is "not secure". And if a customer hands credentials to an agent and the agent does something unwanted, "that's going to be on them". He added: "that's sort of not an ideal state of things." 13

Reuters reported the same rule from the banking side: a transaction cannot be treated as unauthorised when the customer supplied the credentials. 4

Read together, those statements move the loss onto the person who installed the agent. For a product team, that changes the onboarding screen, the failure messaging and the support path. A feature whose worst outcome lands on a customer's balance needs to say so before the first transfer, and needs a route to unwind it afterwards.

Follow the deposits and the timing acquires a commercial logic. Apollo's chief economist, Torsten Slok, warned that assistants could sweep household cash into accounts paying 3.3% to 5%, against a 0.1% national average on checking. 3

The exposure is large enough to matter. JPMorgan, Bank of America and Wells Fargo hold $1.6 trillion of non-interest-bearing deposits, equal to 16% of their liabilities. 3 Paying 3% on that balance would cost the three banks about $47 billion a year, close to half of their combined annual earnings. 3

Security and margin point the same way for now, which is a reason to read the banks' public statements carefully. A restriction that protects customers also protects cheap funding. Wells Fargo's Charlie Scharf called the idea of an AI-driven exodus to higher-yielding accounts "completely overdone" on 13 October. 5

Jim Marous, who publishes the Banking Transformed podcast, argues the influence arrives well before any transfer. A customer's paycheck can keep landing in the same checking account while an agent decides which card or loan comes next. 12

The policy split is already public. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, drew a line between the agents a customer chose and rogue ones that could amount to an intrusion.

Sacks also points to a working example: American Express as an authorised connection inside Muse, where a user grants, limits and revokes access. 14 Whether a bank can test which case it is facing is the open question, and at present the test does not exist.

Three pieces of infrastructure would settle the question. All three are still being built.

The first is a legal definition of consent. The United States has an open-banking rule, section 1033 of the Dodd-Frank Act, and its compliance dates have been stayed since 29 October 2025 by a court in Kentucky, with the Consumer Financial Protection Bureau reconsidering the rule. 15

The second is a standard for agent access that reaches transactions. The Financial Data Exchange counts about 200 members across banks, aggregators and fintechs, and its API standards carry more than 114 million customer accounts. 16 In April it opened an initiative on agent identity and classification, consent and delegation, data minimisation and downstream accountability. Its published scope is data sharing; payments work, where authorising a transfer would land, is something the body says it may take up with partners.

The third is a way to recognise an agent as an agent. NIST points to OAuth, SPIFFE (a standard for issuing identities to software workloads) and emerging workload identity standards for internal systems, and notes that the consumer case is harder because the institution controls neither the agent nor its operator. FIDO's work on issuing agent authenticators bound to a user identity is at an early stage. 7

The banks are adding a fourth piece themselves. JPMorgan is building tools to manage agent risk and has piloted an internal cash-management agent called Smart Cash. 1 Bank of America says it is working with agent providers on how a customer would handle a payment they did not understand. 3 Both point at the same shape: the bank becomes the gatekeeper for agent actions, and the screen stops being the interface.

Six decisions survive the uncertainty, and each one is cheap to take before the rules land.

Design for read-only as the ceiling. Analysis, alerts, planning and comparison stay available. Moving money needs a separate route through an institution's own rails. 12

Give the agent its own identity. A distinct credential bound to a specific user, with a purpose, an expiry and a revocation path, is the shape NIST recommends and the shape identity vendors are building toward. 67

Authorise the action, every time. The permission to read a balance should carry no power to transfer. Ping frames the four questions every interaction must answer: who is acting, whose authority they use, what is permitted now, and what evidence remains. 6 That framing works as an API contract, not only as a compliance form.

Keep a receipt per action. Evidence that links the user, the agent, the consent, the policy decision and the outcome is what makes a dispute resolvable. Matoi suggests treating stored evidence as reusable while revalidating the authority behind each new action. 8

Put the human at the money boundary only. Bank of America's chief executive wants a human in the loop before money leaves an account. 3 Asking at every step trains customers to approve without reading, which NIST flags as consent fatigue. 7

Test institution by institution. Each bank's policy differs, and the terms of service are being rewritten now. A flow proven at one bank proves only that bank. 12

Four events would move a product decision.

A final rule from the consumer bureau, or a court decision lifting the stay, would put a compliant machine-access path back on a schedule. 15

Published guidance from the Financial Data Exchange on agent identity and delegation would give banks a shared vocabulary, which is the precondition for any bank letting an agent act. 16

A live agent authenticator standard from FIDO would answer the recognition problem NIST calls the hard part. 7

The first reported loss would end the ambiguity in the other direction. Until a bank or a customer publishes a figure, the argument over how much harm agents have caused runs on quotes rather than data. 2 Royal Bank of Canada's chief executive has said he is weighing whether to cut Meta's Muse off from customer data, which would extend the blocking past the five banks named so far. 5

The account layer of regulated finance has closed to agents that borrow a customer's password, and the route left open is reading data. Every product decision that depends on an agent moving money now waits on a permission model that four separate bodies are still writing. Teams that build against scoped, revocable, receipted authority today will be the ones able to switch on the action path when it exists.