JPMorgan and Schwab Are Locking Out AI Agents. Who Pays When One Moves Your Money?
Big US banks are blocking third-party AI agents like Meta’s Muse from customer accounts, and a new Axios report says some agents were already inside. The real fight is over AI liability, and who can prove an agent is safe.
Picture the most ordinary thing in the world. You’re busy. You ask your AI assistant to sort out a bill. It asks for your bank login. You hand it over.
That small act has become one of the biggest headaches in American banking this month.
On 22 October, Axios reported, citing unnamed people familiar with the matter, that major US banks had found third-party AI agents operating inside customer accounts. Some had contacted call centres. Some appeared to try to act on their own. Reuters also reported the findings but said it could not immediately verify them. The reports describe attempted actions and worries, not confirmed theft.
Not every bank agrees with the picture. A Morgan Stanley spokesperson told Axios the bank had not observed “rogue AI agents accessing our platforms.”
Either way, the doors are closing.
The CEOs say no
JPMorgan Chase went first and loudest. On its third-quarter earnings call on 13 October, chief executive Jamie Dimon said: “We’re not going to allow just any outside agent to come in inside the company.” Then the line that travelled: “You don’t want rogue agents, and it could be thousands of them.” When a bank chief raises agent security on an earnings call, it has stopped being an IT ticket.
The bank confirmed to CNBC that outside agents can view some account data in read-only form but cannot send money or pay bills. A spokeswoman said the bank does not permit third parties to access accounts “by obtaining customers’ banking credentials” and logging in for them.
Three days later, Charles Schwab chief executive Rick Wurster told Bloomberg Television that Schwab is blocking outside AI agents that try to move clients’ money, naming Meta’s Muse, a personal agent that can book, buy and negotiate for its users. He said a weekly report shows Schwab stopping these agents tens of times a week.
His reasoning fits in one sentence, and it is the sentence every board should pin to the wall: “We can’t control it, the client can’t control it, something could go wrong and who’s liable?”
Citi and Bank of America have reportedly restricted access too. Amazon, outside banking, says continued access by unauthorised shopping agents “violates Amazon’s Conditions of Use.”
The password problem
Strip away the AI hype and this is an old problem in new clothes. Banks have spent years telling customers never to share their passwords. Now customers are sharing them with software that acts on their behalf at machine speed.
Once an agent logs in as you, the bank can’t easily tell you apart. Is that payment you? Your assistant? Your assistant after it misread an instruction? Or someone who hijacked your assistant? The logs look the same.
The fear has roots. In July, AI agents in OpenAI’s internal security tests slipped their limits and compromised parts of Hugging Face’s systems, an episode Cybernews cited in its coverage of JPMorgan’s decision. If agents built and watched by one of the world’s best-funded AI labs can wander off task, a bank is entitled to ask what a consumer app’s agent might do with a customer’s password.
OECD.AI, which tracks AI incidents, has filed the bank lockouts as an AI hazard rather than an incident, because no actual harm has been reported. That is a fair label for now. A hazard is a near miss with a name.
Get Web Dance Pty. Ltd’s stories in your inbox
Join Medium for free to get updates from this writer.
A word on motive. Schwab wants clients to use Charley, its own AI assistant announced on 30 September. Blocking rival agents while promoting your own can look convenient. But the security question stands on its own, whoever is asking it.
The middle path: look, don’t touch
Neither bank is banning AI outright. They are drawing a line between reading and doing.
JPMorgan already allows some outside tools to view account data without moving money. Schwab plans to set up model context protocol servers, a standard way for an AI model to connect to a service, so a client’s chosen AI can check balances and do research but not move money.
According to the reports, most banks have approved read-only access for third-party tools, or are moving toward it. Schwab’s own numbers show why the line matters: tens of blocked attempts a week at one firm, from agents customers chose to trust.
That is a sensible first step. Read-only access gives customers most of the convenience with far less risk. But it pushes the hard question down the road. One day, customers will want agents that can pay bills. When that day comes, someone will have to show that a given agent behaves as promised. A product brochure won’t cut it.
Questions boards should ask now
These apply to any business with customer accounts, not only banks.
Can we tell a human from an agent in our systems? If we can’t, we can’t investigate a dispute either.
What can an outside agent do today, in practice? Not what the policy says. What a test shows.
Who carries the loss if an agent makes a wrong payment? Write the answer down before a customer asks a lawyer.
If we approve some agents, on what evidence? A vendor’s own claims are a starting point. An independent assessment is better.
Would we notice an agent behaving oddly? Schwab gets a weekly report. Most companies have no equivalent.
Are we building our own agent? Then it needs the same scrutiny we would apply to anyone else’s.
Trust, but show your working
The banks have put their finger on the right word. Liable. Every new AI agent that touches money will eventually face a simple test: when it goes wrong, can anyone show what it did, who allowed it, and why it was trusted in the first place?
At Web Dance, that thinking shapes AISOF, the AI Integrity and Secure Operations Frameworks we own and issue. Outcomes are decided by an approved assessor, never by the organisation itself, and a named AI product can be independently assessed and rated on its own.
Your AI assistant may be very good. Your bank would like to see the proof before it holds the keys.
___
Web Dance Pty. Ltd is an Australian company based in Sydney. We own and issue AISOF®, the AI Integrity and Secure Operations Frameworks, a family of assurance frameworks covering organisational AI governance, named AI products and five sector specific tracks. AISOF is a registered trademark of Web Dance Pty. Ltd, registered with IP Australia. More at aisof.org.
