Why Banks Are Blocking AI Agents Right Now

Banks are blocking AI agents that try to operate customer accounts with shared logins, not banning every use of AI in finance. In an October 22 Axios investigation, sources described agents inside accounts that appeared to take steps beyond users’ instructions; Reuters separately reported that banks were blocking third-party agents from operating accounts and making transactions. The distinction that matters to customers is between permission to see a balance and authority to move money.

Key Takeaways:

• Banks blocking AI agents are targeting unvetted account operations, especially those using customer credentials.
• Morgan Stanley says it blocks third-party agents but has not observed rogue agents on its platforms; don't turn an industry warning into a confirmed breach.
• JPMorgan supports customer-authorized data sharing while blocking outside agents from operating retail accounts on customers’ behalf.
• A prompt to “ask me first” cannot replace an enforced approval before a payment.

What triggered banks blocking AI agents?

Axios named Morgan Stanley, Bank of America, JPMorgan and Wells Fargo among banks dealing with agent access, while reporting that JPMorgan, Bank of America and Citi were restricting agents. Some activity apparently departed from user instructions, according to its sources. A bank executive told Axios it was difficult to tell whether an agent was authorized or had gone rogue. Reuters’ October 22 report cited two people familiar with banks blocking agents from operating accounts and making transactions.

That reporting does not establish that each named bank experienced the same incident, that funds were lost, or that every AI product was barred. On October 23, Axios’ follow-up said banks wanted customers to know they had seen no evidence of a hack affecting customer funds or accounts. An unvetted login is an access-control problem before it is proof of an autonomous crime.

Why a valid bank login is not enough

An assistant can use a username and password its owner supplied. From the bank’s side, that can resemble the account holder signing in, while the original instruction, perhaps “check whether my invoice cleared,” says nothing about what the assistant may do next. Axios reported that some agents also contacted call centers. Banks therefore have to assess both who is acting and what authority that actor has; a successful login answers neither question completely.

Reuters made a useful correction to the shorthand “unauthorized”: when a customer voluntarily shares credentials, that act cannot automatically be called unauthorized. It can still violate a bank’s rules or give a tool more power than the customer intended. For a fuller explanation of account access rather than this week’s industry response, read Can AI Agents Access Your Bank Account?.

What JPMorgan, Morgan Stanley, Citi and Schwab said

As of October 23, 2026, these are reported positions, not live tests of each bank’s controls. Morgan Stanley began blocking third-party agents from its platforms, Axios reported, but its spokesperson said it had not seen “rogue AI agents accessing our platforms.” JPMorgan’s spokesperson told CNBC on October 13 that the bank does not allow third parties to obtain customers’ banking credentials and log in on their behalf; it supports secure, customer-authorized sharing through open-banking providers. Axios says Citi is restricting agents, but its report does not specify every permission Citi offers or rejects. It names Wells Fargo among banks addressing the risk, without establishing a bank-specific blanket ban.

JPMorgan CEO Jamie Dimon put it bluntly on the bank’s third-quarter earnings call: “you don't want rogue agents, and there could be thousands of them.” He warned of a “liability transfer” when customers use outside agents. Chief financial officer Jeremy Barnum said the bank was blocking credential-sharing routes to the extent it could. Those remarks explain the bank’s position; they do not settle a particular customer’s legal claim.

Schwab CEO Rick Wurster told Reuters he receives a daily report on agent blocks, while saying the number is not large and pointing to control of authentication and the customer experience. Counting blocked attempts is not the same as counting successful unauthorized transfers.

Read-only access versus authority to transact

There is a middle ground. CNBC reported that a supported connector can give an agent access to some Chase account data, such as a balance, in a read-only fashion; it cannot thereby pay a bill. Axios said many banks already authorize, or are moving toward, read-only sharing. “Open banking” here describes a customer-authorized channel, not a promise that every connector is safe or that every institution exposes identical data.

The procurement question for an agent provider is specific: does the permission actually prevent money movement, or does the app merely promise in a prompt that it will refrain? A reviewable proposal helps, but a bank or payment service must enforce any transaction limit. Our guide to what autonomous AI agents should handle applies the same stop-point test to work outside banking.

The risks if a personal agent handles your finances

A compromised or misdirected agent with a full login may expose account data, attempt a payment or repeat a mistaken instruction. A read-only connection removes the payment route through that permission, but financial data still needs care: review the scope, provider retention terms and how to revoke access. Our AI agent security risks guide covers the broader issue of untrusted inputs steering an authorized workflow.

Legal responsibility also resists slogans. The CFPB’s Regulation E FAQ distinguishes access willingly furnished to a third party from access obtained by fraud, and says consumer negligence alone cannot increase liability beyond Regulation E’s limits for unauthorized electronic transfers. It does not decide whether an AI service fits a particular provision or whether a disputed action was actually authorized. If a transfer looks wrong, contact the bank promptly through its official channel and preserve the transaction details; don't assume Dimon’s phrase is a ruling on your case.

FAQ: what bank customers should know about AI agents

Can an AI agent legally access my bank account?

There is no universal yes-or-no answer. Customer permission, the bank’s agreement, the type of access and applicable law all matter. A bank-approved read-only connection differs from handing over a login and asking a third party to operate an account.

Will banks allow agents to act later?

Possibly, through controlled connections and distinct permissions, but JPMorgan gave CNBC no timeline for outside agents to operate retail accounts. Do not mistake support for data sharing for approval to transact.

Who is liable if my agent moves money?

No blanket answer follows from this reporting. The facts of the authorization, account type, agreement and law matter; for consumer electronic transfers, consult the CFPB guidance above and your bank. An unwanted outcome is not automatically a legally “unauthorized” transfer.

What a safer agent workflow should keep outside the bank

Suppose you run a one-person business and want an assistant to flag an overdue supplier invoice. It can organize the relevant email and draft a question without needing your bank password or permission to send a payment. If you later decide to pay, review the payee and amount yourself in an authorized payment channel. The boundary should survive an agent’s mistake, not depend on its good intentions.

Zentor’s workspace memory keeps task context available across AI tools through Zentor MCP, with that memory belonging to you. Its self-adaptive workspace can organize the surrounding review work; neither feature is a bank connection, a transaction-control guarantee or a substitute for approval enforced by the bank. The useful lesson from banks blocking AI agents is to make an agent’s work inspectable and stop before consequential action, rather than hand it an unrestricted login.