Where banks are drawing access limits
The restrictions vary by institution. Axios identified Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo as banks responding to risks from outside agents. Morgan Stanley has barred them from its platforms, Reuters reported, though a person familiar with the bank said it had not seen rogue agents entering its systems.
At JPMorgan, external agents cannot act on behalf of retail customers. CNBC reported that the block covers services including Meta's Muse and Instinct, a digital concierge. Connectors such as Plaid can still provide read-only access to certain account information, including balances. JPMorgan said it has no timetable for putting safeguards in place that would let agents interact directly with accounts.
Citi also prohibits third-party agents from logging into customer accounts or conducting transactions on its digital banking platforms. It permits limited, read-only access through selected approved open-banking providers.
That distinction allows tools to help with budgeting, spending analysis and balance reviews without giving them permission to buy something or transfer money. According to Axios, many banks have adopted or are considering this type of access, comparable to the permissions used by budgeting applications such as Quicken.
Charles Schwab CEO Richard Wurster said his firm was blocking unauthorized agents so it could retain control of authentication and the customer experience. The number of agents blocked was small, he told Reuters.
JPMorgan tests its own tool as outside agents gain users
JPMorgan's restrictions on outside services do not preclude testing its own AI tool. On the bank's October 13, 2026, third-quarter earnings call, CFO Jeremy Barnum said a targeted pilot of Smart Cash had begun in the preceding weeks. The internal tool aims to forecast a user's cash flow and move funds to maximize yield.
On the same call, CEO Jamie Dimon said admitting just any outside agent would pose too much risk to clients and JPMorgan. "You don't want rogue agents, and it could be thousands of them," he said, according to CNBC.
Consumer interest in agents has already raised concerns about how they might be used in banking. CNBC reported that Meta's Muse reached the top of app download charts soon after its September 2026 unveiling, prompting fears that customers would use agents to shift money from lower-yielding accounts to higher-yielding ones. OpenAI released its agent, Dots, weeks later.
Instinct, another service blocked by JPMorgan, operates primarily through text messages. Its operator, San Francisco startup Spear Street Technology, reached a $10 billion valuation in September 2026, according to CNBC.
Shared credentials and responsibility for payments
An agent with sufficient account access and transaction permissions can make purchases or move funds for a user. Some customers reportedly supplied agents with their banking usernames and passwords, making it harder for banks to tell whether the customer or software is acting. Customer consent to use a tool does not, by itself, mean the bank permits that method of access.
Wells Fargo's updated Online Access Agreement, effective November 24, 2026, will add Section 15 covering third-party AI tools and agents. The terms clarify that these tools are not operated by Wells Fargo, that requests made through them may be treated as requests from the customer, and that the bank can restrict or block access by certain tools.
Barnum warned on JPMorgan's October 13 earnings call that customers who give agents their credentials could bear responsibility for unwanted actions. They should understand that "that's going to be on them," he said, according to Mitrade, citing BeInCrypto.
Bank of America is restricting agents' access to consumer deposits while developing protocols to establish responsibility for AI-authorized payments, The Paypers reported. In an October 14 CNBC interview, CEO Brian Moynihan said the bank was working with AI providers to ensure that a human authorizes money leaving an account. Responsibility for an unintended payment by an agent remains unresolved.
Separately, BeInCrypto's State of AI Agent Payments 2026 documented two attacks involving AI-linked crypto systems. Attackers caused the systems to send a combined $281,200 to their wallets before recoveries. In March 2025, an attack on AIXBT's dashboard triggered a $106,200 crypto transfer. In May, a malicious message processed through Grok led Bankr to transfer $175,000 in tokens; Bankr later reported recovering 80% of those funds.
Open-banking rules remain unsettled
The regulatory framework for sharing financial data is also in flux. The Consumer Financial Protection Bureau finalized its open-banking rule under Section 1033 of the Dodd-Frank Act in October 2024. The largest banks were originally due to comply by April 2026, but the compliance dates have been stayed amid litigation and reconsideration by new CFPB leadership. In August 2025, the bureau issued an advance notice of proposed rulemaking to substantially revise the rule.
According to the Congressional Research Service, the rule does not establish a new allocation of liability. Banks' liability for scams and fraud would therefore likely depend on existing standards under Regulations E and Z.
