US banks block AI agents from logging in to customer accounts

Key takeaways

• JPMorgan Chase, Citigroup, Bank of America and Charles Schwab have each said they are stopping third-party AI agents from logging in to customer accounts or moving money on a customer's behalf.
• Read-only data sharing through open-banking connectors such as Plaid is still allowed at JPMorgan and Citi; Schwab plans a read-only route for outside AI tools.
• JPMorgan CEO Jamie Dimon warned of "rogue agents" and of a "liability transfer" to customers who hand their credentials to an agent.
• Consumer assistants such as Meta's Muse, launched in September 2026, are the most visible products affected.
• Nobody has yet settled who pays when an AI agent authorizes a payment the customer did not intend.

Why US banks are blocking AI agents from customer accounts

US banks block AI agents: JPMorgan Chase, Citigroup, Bank of America and Charles Schwab say they are stopping third-party AI agents from logging in to customer accounts or moving money on a customer's behalf. Who pays for an agent's mistakes is unresolved. Governments are drawing similar lines: Sweden will block ChatGPT and Claude on government staff computers, citing information security.

The target is narrow but important. The banks are not banning artificial intelligence. They are refusing to let outside software log in with a customer's username and password and then act inside the account: moving funds, paying bills or placing transactions.

On 22 October, Crypto Briefing, citing a report by Axios, said several large lenders had found unauthorized third-party agents inside customer accounts, often using the customers' own credentials, and that some agents had moved funds or contacted call centers. Those details came from anonymous reporting; the banks have not published incident figures, and Bullquill could not independently confirm them.

What each institution has confirmed

The statements so far differ in detail. The table below summarizes what each firm, or its chief executive, has said on the record.

JPMorgan Chase

Dimon told analysts the bank would not let "just any outside agent" inside the company, according to Fortune. "You don't want rogue agents," he said. A bank spokesperson added that when JPMorgan detects a third-party agent trying to get into accounts by obtaining customers' banking credentials, "we do not allow it," while saying the bank supports customer-authorized data sharing through open-banking providers.

Chase's online terms of use already list AI agents among tools that may not access its systems unless they identify themselves as agents, and they make the user responsible for an agent's actions, including actions that exceed the authority it was given. Separately, The Paypers reported that JPMorgan is piloting its own cash-management tool, Smart Cash, which forecasts cash flow and moves funds to improve yield.

Citigroup and Bank of America

Citi said its policy protects customer accounts and information, according to The Paypers. Bank of America CEO Brian Moynihan told CNBC: "We strongly believe there should be a human in the loop." The Paypers reported that the bank is also working with agent providers so consumers can trace funds an agent has moved.

Charles Schwab

Schwab CEO Rick Wurster told Bloomberg Television that the problem is clients giving their passwords to an agent that then acts for them. "We can't control it, the client can't control it, something could go wrong and who's liable?" he said, as quoted by The Next Web. Schwab plans to offer model context protocol (MCP) connections that let outside AI check balances and do research but not move money, and it is steering clients to its own assistant, Charley, announced on 30 September.

Why it matters for Meta's Muse and other AI assistants

Meta launched Muse in September 2026 as a personal agent that can browse, fill in forms, negotiate and buy on a user's behalf. Fortune reported that Muse connects to financial accounts through Plaid, letting users share balances, transactions, holdings and mortgage details. Meta declined to tell Fortune whether Muse could keep offering financial help if more banks restrict agents.

The practical effect is a split. Assistants can still read data through sanctioned connectors, so budgeting and "where is my money" features survive. What stops is the agent that logs in as you and acts. If you are building agents yourself, our guides to tool calling in Python and building an MCP server show why scoped, permissioned access is easier for institutions to accept than shared passwords.

The deposit question

Money is part of the story. The Paypers and FStech, citing a report from Apollo's chief economist, said JPMorgan, Bank of America and Wells Fargo hold about $1.6 trillion in non-interest-bearing deposits, roughly 16% of their liabilities. Paying 3% on those balances would cost the three banks about $47 billion a year, close to half their combined annual earnings, according to the same report. With the national average checking rate at about 0.1%, an agent that automatically sweeps idle cash into accounts paying 3.3% to 5% could erode a cheap funding source. The banks cite security and customer protection, not deposits, as the reason for the blocks.

Who is liable when an AI agent pays?

This is the unresolved part. Dimon spoke of a "liability transfer" to customers who authorize outside agents. Bank of America says its restrictions stay until it has protocols to decide who is liable for AI-authorized payments. Wurster asked the same question publicly.

According to the Financial Times, as reported by FStech and The Paypers, Wall Street executives have raised the rise of consumer AI agents with the Federal Reserve, which declined to comment, and regulators have privately welcomed the restrictions. Officials believe legal clarification may be needed on how customers authorize autonomous systems. The Next Web noted that agent liability is still being debated in Congress. No US regulator has issued formal guidance yet.

Security concerns add pressure. Earlier coverage of OpenAI agents weakening internal monitoring and new agentic payments ventures shows both the risks and the commercial push behind agent-led money movement. Anthropic's consumer agent push, covered in our Claude Duet explainer, points the same way.

What it means

• For consumers: sharing a bank password with an AI assistant may break the bank's terms and, at Chase, leaves the user responsible for what the agent does. Read-only connections remain the sanctioned route.
• For AI companies: agents that rely on screen-scraping logins face a closed door at the largest US institutions. Expect a shift toward bank-approved APIs, open-banking connectors and MCP-style permissioned access.
• For banks: the blocks buy time to build their own assistants, as Schwab and JPMorgan are doing, while liability rules are written.
• Still unknown: how many unauthorized agent sessions banks have actually detected, whether Morgan Stanley or other lenders will publish policies, and when regulators will set rules on who pays for an agent's mistakes.

Sources

• Fortune: Jamie Dimon on AI agents, Meta's Muse and JPMorgan (15 Oct 2026)
• The Paypers: JPMorgan Chase blocks external AI agents from customer accounts (15 Oct 2026)
• The Paypers: Citi and Bank of America restrict AI agents from accessing accounts (19 Oct 2026)
• FStech: Citi and Bank of America block AI agents from customer accounts (19 Oct 2026)
• The Next Web: Schwab and JPMorgan are blocking AI agents from moving customer money
• Chase: Terms of Use (AI agent provisions)
• Crypto Briefing: Major US banks detect unauthorized third-party AI agents in customer accounts (22 Oct 2026), citing Axios
• OECD.AI Incidents Monitor: Banks block AI agents (hazard entry, 16 Oct 2026)