Why Banks Are Blocking AI Agents, and What It Means for Agentic Commerce

Major US banks are blocking or restricting third-party AI agents inside customer accounts. Many of these agents log in with customers' own passwords, which breaks bank rules, and banks can't reliably tell user-directed actions from unauthorized ones. Morgan Stanley is blocking agents. JPMorgan, Bank of America and Citi are restricting them. The industry is settling on read-only access while liability for agent payments gets worked out.

What did Axios report about AI agents in bank accounts?

Axios reported that major US banks are finding unauthorized third-party AI agents inside customer accounts, sometimes taking actions the customer never directed. Its Oct 22 scoop, based on unnamed sources, reported the following:

• Morgan Stanley has begun blocking third-party agents from its platforms.
• JPMorgan, Bank of America and Citi are restricting agent access.
• Wells Fargo is among the banks working to contain the risk, though Axios gave no specifics.
• Some banks have tracked agents contacting call centers or taking steps the user did not request.
• Banks are rewriting terms of service and doing day after planning, meaning contingency plans to quickly secure or restore a customer's access.

Executives called the situation "horrifying," according to Axios. Several also said customers will want these tools, so a middle ground is needed.

Why are banks worried about agents using customer credentials?

An agent that logs in with a customer's password looks exactly like the customer. Most banks require account holders to log in themselves, so sharing credentials with an agent breaks bank rules even when the customer approves it. A Chase spokesperson said customers should not share their usernames and passwords with anyone, CBS News reported.

The bigger fear is agents that can make purchases or transfers. Bank of America CEO Brian Moynihan said "there should be a human in the loop" before money leaves an account, according to Retail Banker International, which cited the Financial Times. The same report said Bank of America is building protocols to assign liability for AI-authorized payments. It also said regulators have privately backed the blocks, a claim that comes secondhand from the FT.

How much rogue agent activity is actually happening?

Less than the headlines suggest, so far. CBS said the agents were not hacking accounts or draining funds and were mostly following user instructions. IBTimes UK said the reports do not establish widespread unauthorized transfers or losses.

Morgan Stanley's spokesperson told Axios the firm has not observed rogue agents on its platforms. Schwab's figures are inconsistent across reports. American Banker reported that CEO Rick Wurster described blocked-agent alerts as rare, while coverage of his Bloomberg interview put blocks at tens to twenties a week.

What are JPMorgan, Citi, Bank of America and Schwab doing?

Each firm separates letting an agent read data from letting it act:

1. JPMorgan: CEO Jamie Dimon said on the Oct 13 earnings call that the bank won't let just any outside agent into its systems. Reports say some third-party tools can already view data but not move money.
2. Citi: Does not allow third-party AI agents to log in or transact, but customers can grant read-only access through approved open banking providers.
3. Bank of America: Is limiting agents' access to consumer deposits while it works on liability rules.
4. Schwab: Blocks outside agents that try to move client money, including Meta's Muse, and steers clients to its own assistant, Charley.

Who argues banks are going too far?

Critics say blanket blocks punish customers for a credential problem that better access rails could solve. White House AI czar David Sacks told CBS that user-authorized agents "are in no way cyberattacks," even when they break bank login terms. He suggested read-only access as a middle ground.

Others point to incentives:

• Consultant Tim Welsh told American Banker that "Charley works for Schwab." He argued an independent agent could move idle cash out of low-yield sweep accounts. Wurster disputed that.
• Analyst Alex Johnson argued in Fintech Takes (sponsored by MX) that agents will reach customer data either way. He said banks should offer permissioned APIs so customers stop handing over passwords.

Where does the CFPB open banking rule stand?

The CFPB's Section 1033 open banking rule is not in force. Finalized in October 2024, it gives consumers the right to share their financial data with authorized third parties, but a federal court in Kentucky has barred enforcement while the CFPB rewrites it. According to PYMNTS, the CFPB sent a proposed reconsideration to White House review in August 2026. The text has not been released, and data-access fees are a central dispute. Until a rule is final, banks are setting agent policy themselves.

Are there safer ways for agents to log in?

Yes, credential-free options are emerging. On Oct 22, 1Password launched 1Password for Agents. The user approves an agent's login request and 1Password fills in the credentials, so the agent never sees the password. Partners include Meta's Muse and Grok Bot. It is not yet clear whether banks will accept brokered logins.

Payment networks are building agent rails too. Visa's Intelligent Commerce adds tokenized credentials, spending limits and human approval, and Mastercard has extended Agent Pay, Digital Commerce 360 reported.

What does this mean for agentic commerce and brands?

AI agents will reach customers only through the gates businesses choose to open. Retail is already split: on Oct 21, Walmart launched an Agent Gateway with spending limits and per-purchase approval, while Amazon began blocking agents, TechCrunch reported. We covered that in Walmart's agent gateway vs. Amazon's blocks.

Banks are choosing read-before-act, and retailers are choosing sanctioned gateways. Either way, agents will favor brands whose information is accurate, structured and trustworthy:

• Audit how AI assistants describe your products, prices and policies. Tools like MarkGrid's Model Share track how models mention your brand.
• Publish machine-readable product, pricing and policy data so agents don't have to scrape or guess.
• Plan for read-only agents first. Agents that compare and recommend will arrive before agents that pay.
• Make trust signals explicit, such as returns, guarantees and human-approval paths.

For background, see what AI agents in marketing are and our GEO guide.

FAQ

Which banks are blocking AI agents?

According to Axios, Morgan Stanley is blocking third-party agents, and JPMorgan, Bank of America and Citi are restricting them. Charles Schwab says it blocks outside agents that try to move client money.

Is it against bank rules to give an AI agent my bank password?

Generally, yes. Most banks require account holders to log in themselves, and Chase says customers should not share credentials with anyone.

Have AI agents stolen money from bank accounts?

No widespread losses have been reported. CBS News said agents were mostly following user instructions, though some took unrequested steps such as calling customer service.

What is read-only access for AI agents?

It lets an agent view balances and transactions without moving money. Budgeting apps like Quicken already get this kind of access, and most banks are moving toward it for agents.

Does the CFPB open banking rule protect AI agent access?

Not currently. The Section 1033 rule is enjoined by a federal court and is being rewritten. As of Oct 24, the proposed revision had not been published.

Last updated October 24, 2026.