Reuters reported on October 22, 2026 that major U.S. banks are blocking third-party AI agents from operating inside customer accounts and making transactions. Two people familiar with the situation described the response. The story puts US banks blocking AI agents at the center of a fight that has been building since consumer assistants learned to click, type and pay.
Morgan Stanley, JPMorgan, Bank of America and Citi all appear in the reporting, while Axios named Wells Fargo as taking steps of its own. Charles Schwab’s chief executive confirmed his firm is turning agents away too. Our comparison of ChatGPT Dots, Meta Muse and Claude showed how fast these assistants are moving into everyday tasks. Money is the one errand the banks are refusing to hand over.
This analysis separates what the reporting confirms from what remains unverified, maps the position of each bank, and explains why a handful of shared passwords has turned into a liability question for the entire industry. It also looks at what happens next for AI assistant makers, fintechs and the customers caught in between.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Reuters Reported About Banks Blocking AI Agents
The core claim is narrow and specific. Banks are stopping outside AI agents from logging into customer accounts and moving money on a customer’s behalf. Reuters sourced the report to two people familiar with the situation, and added a detail from a person in the banking industry. Some customers had handed their login IDs and passwords to AI agents, and the banks typically flagged and blocked the resulting transactions.
Morgan Stanley blocked third-party agents from accessing its platforms, according to a person familiar with the matter. The same person said the bank had not seen instances of unauthorized or rogue AI agents. That detail matters. It suggests Morgan Stanley acted on principle and on risk modeling, not in response to a visible wave of misbehaving software.
JPMorgan, Bank of America and Citi were also reported as restricting third-party AI-agent access. Wells Fargo came from a separate source. Axios reported that it was taking steps to limit third-party agent access, though the specific blocking policy was not detailed.
The headline of the Reuters piece is broader than the evidence. The reporting does not establish that every U.S. bank is blocking every third-party AI agent. It names a group of large institutions and describes their stance. Smaller banks, credit unions and regional lenders have not been surveyed in any of the coverage we reviewed, so the true scale of the blocking is unknown.
Which Banks Are Blocking AI Agents: A Scorecard
Six institutions have surfaced by name in coverage from Reuters, Axios and the follow-up wire stories. Their reported postures differ in tone, even though the practical result for an AI agent trying to log in is mostly the same.
| Institution | Reported posture | Source of the report |
|---|---|---|
| Morgan Stanley | Blocked third-party agents from its platforms, has seen no rogue agents | Reuters, citing a person familiar |
| JPMorgan Chase | Limiting AI agent access to client accounts | Reuters, plus CEO Jamie Dimon’s remarks |
| Bank of America | Restricting third-party AI-agent access | Reuters |
| Citi | No agent logins or direct transactions, limited read-only access through approved providers | Citi statement |
| Wells Fargo | Steps taken to limit agent access, policy not detailed | Axios |
| Charles Schwab | Blocking unauthorized agents, including Meta Platforms’ Muse | CEO Rick Wurster |
Citi is the only institution in the group that published a clear rule with an explicit exception. Morgan Stanley and Wells Fargo remain the least documented. For product teams building agents, that gap is the practical problem. Without a published policy, nobody can tell whether a login failure is a permanent ban or a temporary fraud flag.
The Credential-Sharing Problem at the Heart of the Blocks
The trigger is not an exotic exploit. It is a customer pasting a username and password into an AI assistant and asking it to pay a bill or move cash. From the bank’s side, that session looks like a login from software the customer never registered, often from an unfamiliar network, behaving at machine speed.
Reuters flagged the legal wrinkle. Because the customer shared the credentials voluntarily, those transactions cannot automatically be classified as unauthorized. That single sentence explains much of the bank reaction. If a customer’s agent drains the wrong account, or misreads an instruction, the bank cannot cleanly treat the loss as fraud. It also cannot treat it as an ordinary authorized payment, since the bank never agreed to the arrangement.
Banks have warned customers against password sharing for years. Agents raise the stakes because they do not just read a balance. They act. A human who shares a password with a spouse or accountant creates one extra person with access. An agent product that thousands of customers connect creates a single high-value target and a single point of failure sitting outside the bank’s control.
What Citi and JPMorgan Said on the Record
Citi gave the clearest public language. In a statement carried by Yahoo Finance, the bank drew a hard line around logins and direct transactions:
To help safeguard customer accounts and information, we do not permit third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms.
Citigroup, company statement
The same statement left a door open. Citi said customers can still authorize limited, read-only access to their account information through certain Citi-approved open banking providers.
Customers can, however, continue to authorise limited, read-only access to their account information with certain Citi-approved open banking providers.
Citigroup, company statement
JPMorgan’s spokeswoman took a safety-first tone in comments CNBC published earlier in the month, ahead of the Reuters story.
Protecting our customers is our top priority. Because it is not safe, we do not permit third parties to access accounts by obtaining customers’ banking credentials and logging in on their behalf.
JPMorgan Chase spokeswoman, via CNBC
Chief executive Jamie Dimon used blunter language. He said JPMorgan would limit AI agents’ access to client accounts because the bank does not want rogue agents, and because there could be thousands of them. His point is about scale. One misbehaving script is a support ticket. Thousands of agents acting on customer accounts at once is an operational risk event.
Schwab’s Standoff With Meta’s Muse
Charles Schwab chief executive Rick Wurster named a product. He said the company was blocking unauthorized AI agents attempting to transfer clients’ money, including Meta Platforms’ Muse. It is rare for a financial executive to call out a specific consumer AI product in that way, and it moves the debate from abstract policy to a live commercial dispute.
We have followed the Muse launch closely. Our look at OpenAI Dots versus Meta Muse examined how these assistants change the way people find and use online services. A bank blocking an assistant by name shows how quickly those assistants have run into the walls of regulated industries.
Some follow-up coverage, including IBTimes UK, says Schwab is weighing controlled connections with narrowly defined permissions. Those would let an agent retrieve balances or research while preventing money movement. The Reuters report does not detail such a plan, so treat that point as reported by secondary outlets and not yet confirmed by Schwab in the sources we reviewed.
Axios Incidents: What Is Confirmed and What Is Not
The wave of coverage started with an Axios scoop titled “Unvetted AI agents are accessing U.S. bank accounts.” Axios described agents taking actions independent of user instructions. Engadget ran a version framing the problem as unauthorized access already underway.
Reuters did not independently verify those specific incidents. That distinction decides how readers should weigh the story. The block by banks is documented across several outlets. The claim that agents have gone rogue inside customer accounts rests on Axios alone, and Morgan Stanley’s own source said the bank saw nothing of the kind.
| Claim | Status | Basis |
|---|---|---|
| Major U.S. banks are blocking third-party AI agents | Confirmed | Reuters, two people familiar |
| Morgan Stanley blocked third-party agents | Confirmed | Reuters, person familiar |
| Citi bars agent logins, allows read-only open banking | Confirmed | Citi statement |
| Schwab is blocking agents including Muse | Confirmed | CEO Rick Wurster |
| Agents acted independently of user instructions | Unconfirmed | Axios, not verified by Reuters |
| All U.S. banks block all third-party agents | Not established | Not supported by cited reporting |
Why Banks Treat AI Agents as an Authentication Problem
Bank security stacks assume a login belongs to a person on a known device. Fraud models score typing cadence, IP reputation, device fingerprints and navigation patterns. An agent driving a headless browser trips nearly all of those signals. It looks identical to credential stuffing or an account takeover, even when the customer asked for the task.
That is why banks flag and block first and sort out intent later. It is also why the industry has pushed toward phishing-resistant logins. Our coverage of the passkey gap and account takeovers shows the same logic at work in gaming. Passkeys tie authentication to a device and a person. They are built so a password cannot be handed to a third party, which is exactly what agent products ask customers to do.
The identity gap for non-human actors
Today’s consumer banking logins have no clean way to say “this is Maria’s agent, limited to paying one utility bill.” The customer is either logged in with full power or not at all. Until banks and agent makers agree on a delegation layer, the safest default for a risk team is to refuse.
Liability: Who Pays When an Agent Moves Money Wrongly?
This is analysis, not reporting, but the pressure point is plain. Rules on unauthorized electronic transfers generally turn on whether the customer authorized the transaction. Password sharing blurs that line. A bank that reimburses every agent mistake invites abuse. A bank that refuses to reimburse faces angry customers and complaints to regulators.
Blocking agents sidesteps the dilemma. If no agent can transact, the bank never has to rule on whether an agent-initiated transfer counted as authorized. For general counsel offices at the large lenders, that clarity is worth more than the convenience customers lose. The cost of the policy lands on the customer, and on the AI companies that wanted to sell them an assistant that handles finances.
Agent makers face their own exposure. A product that asks for bank passwords invites the question of who is responsible when it errs. Expect their terms of service to get more cautious about financial actions, and expect banks to cite that caution as proof that the risk sits outside their walls.
Read-Only Open Banking Versus Login Delegation
Citi’s carve-out exposes the real structure of the dispute. Banks are not opposed to outside software seeing account data. They object to software logging in as the customer and holding the keys. The table below compares the three access models that appear in the reporting and the surrounding debate.
| Access model | Who holds the credential | Can it move money? | Bank stance in reporting |
|---|---|---|---|
| Password sharing with an AI agent | The agent or its operator | Yes, same power as the customer | Blocked at Morgan Stanley, JPMorgan, Citi, Schwab and others |
| Approved read-only open banking | The approved provider, with bank-issued access | No | Allowed at Citi for approved providers |
| Controlled, permission-scoped connection | A scoped token issued by the bank | Only if the bank allows it | Reported as under consideration at Schwab, not detailed elsewhere |
The third row is where the market is heading. A scoped connection lets a bank decide what an agent may do, log every action, and revoke access in one step. It converts an anonymous login into an auditable relationship. That is the kind of arrangement a risk officer can sign off on.
How Controlled Connections Could Work for Agents
The industry already has building blocks. Model Context Protocol servers, which expose a limited set of tools to an AI model, give a bank a way to publish exactly what an agent can ask for. A balance lookup is one tool. A transfer is another, and the bank can leave it out entirely. Our walkthrough of MCP authentication with OAuth 2.1 and zero-trust covers the identity side of that design.
The agent side needs discipline too. A model that holds a bank token should run in an environment where a bad prompt or a malicious web page cannot reach it. Our guide to isolating MCP servers in an agent sandbox lays out the practical steps. Banks will likely ask for that kind of isolation before they approve any agent partner.
What a bank would need to see
A credible agent connection would carry an identity for the agent product, an explicit customer grant, a narrow list of permitted actions and a way to kill access instantly. It would also leave a record the bank can hand to a regulator or a fraud investigator. None of this is exotic. It mirrors how banks already vet fintech partners for read-only data feeds.
Market Impact for AI Assistant Makers and Fintechs
The first loser is any agent product whose pitch includes “pay your bills for you.” Meta, OpenAI and Anthropic have all pushed assistants toward doing real work. Finance is the highest-value category and the one with the least tolerance for error. A blanket block from the biggest banks caps what those products can promise American consumers today.
Fintechs with existing bank agreements may gain. Companies already holding approved read-only access are better placed to become the sanctioned bridge between a bank and an agent. Large banks, by contrast, protect their own customer relationship. If an outside assistant becomes the interface for money, the bank risks turning into a pipe. Keeping agents out preserves the bank’s app as the place where customers decide.
Merchants and publishers face a version of the same shift. We looked at it in what happens when AI agents become website visitors, where agents change how traffic converts. Banks are the first sector to answer with a hard no, and retail, travel and insurance will watch closely to see whether customers push back.
Historical Context: From Screen Scraping to Agents
This fight has a precedent. Years before AI agents, budgeting apps and data aggregators logged into bank sites with customer usernames and passwords and scraped the pages. Banks objected on security and liability grounds, and the industry slowly moved toward token-based data sharing that kept passwords out of third-party hands.
Agents bring the old argument back with higher stakes. Scrapers read. Agents write. A scraper that breaks returns bad data, while an agent that breaks can send money to the wrong place. The regulatory picture for consumer data sharing has also stayed unsettled, and the sources we reviewed did not establish the current status of any specific rule, so we avoid leaning on one here.
The lesson from that earlier cycle is that banks lose the early argument and win the long one. They cannot stop customers from wanting automation. They can set the terms under which it arrives, and the first move in this round is the block.
How the Bank Positions Compare
Read side by side, the statements show three distinct styles. Citi wrote a rule and an exception. JPMorgan led with customer protection and its CEO leaned on the rogue-agent scenario. Schwab named a specific product and a business reason, control over authentication and the customer experience, according to coverage of Wurster’s remarks.
Morgan Stanley’s position is the most revealing. Its source said no rogue agents had appeared, yet the bank blocked anyway. That is a preventive stance, set before an incident, and it hints that other banks may be acting on forecasts and not on losses. If so, the blocks could harden quickly or loosen quickly, depending on how the first sanctioned partnerships look.
Five Predictions for the Next 12 Months
These are our forecasts, built on the reporting above and general industry patterns. None comes from the banks or the agent makers.
- More banks publish explicit agent policies. Citi’s wording will become a template. Expect regional lenders and credit unions to copy the structure of a ban on logins with a carve-out for approved read-only access.
- At least one large bank launches a sanctioned agent program. The commercial pull is too strong to leave unused. A pilot with scoped permissions and a small partner list is the most likely shape.
- Agent makers drop password-based finance features. Products that ask for bank credentials will quietly remove the option or limit it to read-only views. Consumer AI companies will prefer to partner than to fight.
- Regulators ask about liability. Once a customer loses money through an agent and complains, supervisors will want to know who owes what. The credential-sharing gap Reuters described is the likely entry point.
- Authentication vendors pitch agent identity. A market for verifiable non-human identities will take shape, as banks seek a way to tell a sanctioned agent from an attacker.
Anthropic’s own consumer push is one place to watch. Our report on Claude Duet and its rivalry with Muse shows how quickly the assistant market is moving. For more on the models and agents behind these products, see our AI and machine learning coverage.
What Customers Should Do Now
The advice from the banks is consistent. Do not give a username and password to any AI assistant. If a product asks for them, treat that as a warning sign. A blocked transaction is the best outcome of a bad idea, since a successful one may leave you without fraud protection because you shared the credentials yourself.
If you want an assistant to help with money, look for read-only connections that go through your bank’s approved open-banking partners, the route Citi described. Keep any agent away from payment or transfer permissions until your bank says it supports them. Turn on the strongest login protection your bank offers, and check your account activity after any session where an assistant touched your finances.
Customers who already shared credentials should change their passwords now and review recent activity. If a transaction looks wrong, contact the bank quickly and be honest about the sharing. Reuters noted that shared credentials complicate any claim that a transaction was unauthorized, so early contact and a clear account of events will matter.
Frequently Asked Questions
Are all US banks blocking AI agents?
No. The reporting names a group of large institutions, including Morgan Stanley, JPMorgan, Bank of America, Citi and Wells Fargo, plus Charles Schwab. It does not establish that every U.S. bank is blocking every third-party agent.
Which banks are blocking third-party AI agents?
Reuters named Morgan Stanley, JPMorgan, Bank of America and Citi. Axios named Wells Fargo as taking steps to limit access. Schwab’s chief executive said the firm blocks unauthorized agents, including Meta’s Muse.
Why are banks blocking AI agents?
Banks cite safety and control. Some customers shared logins and passwords with agents, which makes the resulting transactions hard to classify as unauthorized. Jamie Dimon said JPMorgan does not want rogue agents, and that there could be thousands of them.
Can I still use an AI assistant to view my bank balance?
Possibly, through an approved route. Citi said customers can authorize limited, read-only access to account information through certain Citi-approved open-banking providers. Other banks have not published the same detail in the reporting we reviewed.
Were rogue AI agents actually found inside bank accounts?
Axios described agents taking actions independent of user instructions, but Reuters could not independently verify those incidents. A person familiar with Morgan Stanley said the bank had not seen unauthorized or rogue agents.
Is it safe to give an AI agent my bank password?
Banks say no. JPMorgan’s spokeswoman said the bank does not permit third parties to log in using customers’ credentials because it is not safe. Sharing credentials can also weaken a later claim that a transaction was unauthorized.
Will banks ever allow AI agents to move money?
The reporting does not say. Some coverage points to controlled, permission-scoped connections as a possible path, but no bank has detailed a launch. Our view is that a sanctioned pilot is likely within the next year.
