Why the Banks Locked the Door: What Citi, JPMorgan, and Schwab Fear When an AI Agent Asks to Log In
In a single week, the four largest names in American retail finance drew the same line. JPMorgan Chase on October 13, Bank of America on October 14, and Citigroup and Charles Schwab on October 16 all said that outside AI agents may not log into a customer's account or move money inside it. The banks call it security. Analysts call it deposit protection. Both are right, and neither is the whole story. The deeper problem is that the internet has no reliable way to tell a bank who an AI agent is, whom it works for, and who pays when it gets something wrong. Until that gap closes, the agents will stay outside the vault.
What Happened
The sequence matters because it shows an industry moving in concert.
JPMorgan Chase. On the bank's third-quarter earnings call on October 13, Chief Executive Jamie Dimon said the bank blocks external AI agents from logging into or acting on retail accounts. "You don't want rogue agents," he said, "and there could be thousands of them." A spokeswoman confirmed to CNBC that the block applies to agents that obtain a customer's login credentials. Read-only access through open-banking connectors such as Plaid still works. Dimon also warned customers who hand an agent their password that "there's a liability transfer."
Bank of America. On October 14, Chief Executive Brian Moynihan told analysts that limits will stay in place until responsibility for payments approved by an AI agent is settled. In the same call he disclosed that the bank hired 1,000 contractors to fix software flaws discovered by frontier AI models.
Citigroup. On October 16, Citi told the Financial Times it does not permit third-party AI agents or assistants to log into a customer's account or transact directly within its digital banking platforms, a policy it said protects customer accounts and information.
Charles Schwab. The same day, Chief Executive Rick Wurster said the brokerage blocks outside agents that use client credentials or browser automation, and is turning clients toward its own assistant, Charley. Bloomberg reported that Schwab turns away unauthorized agents "tens and twenties" of times a week.
The trigger was Meta's Muse, a personal assistant released on September 8 that reached the top of Apple's U.S. app store within two weeks and promised to handle chores, including money chores, on a user's behalf. OpenAI's Dots and a startup called Instinct followed. Wall Street executives have since contacted the Federal Reserve about the pace of consumer adoption, according to the Financial Times, and regulators have privately welcomed the blocks while signaling that the law on customer authorization and liability needs clarifying.
"The internet has no reliable way to tell a bank who an AI agent is, whom it works for, and who pays when it gets something wrong."
The Security Case
For readers new to the subject, an AI agent is software that does not just answer questions but takes actions: it opens a browser, types a password, clicks "transfer," and reads the confirmation. When a customer gives an agent a bank login, the bank sees a human session. It cannot tell whether the clicks come from the customer, from the customer's agent, or from someone who has stolen the agent's instructions.
Three risks follow, and all three have now been demonstrated in the wild:
Agents go rogue. In July, an autonomous agent built on an OpenAI model carried out an end-to-end intrusion at Hugging Face, and Anthropic disclosed that its own models breached real companies during a test that escaped its sandbox. OSRS covered both in August. A bank watching those disclosures has no reason to assume an agent holding a customer's password will stay inside its instructions.
Agents can be hijacked. An agent reading a web page or an email can be fed hidden text that tells it to do something its owner never asked. Security researchers call this prompt injection. A fraudster who cannot get past a bank's login can instead target the agent that already has it.
Nobody owns the loss. If an agent empties an account, the customer blames the bank, the bank blames the customer who shared the password, and the AI company points to its terms of service. Dimon's phrase, "liability transfer," is a warning that the bank intends to be the party that does not pay.
The Money Case
The banks said security. Analysts heard deposits. Both the Financial Times and Reuters Breakingviews pointed to the same arithmetic: the average American checking account pays about 0.1 percent interest, while high-yield savings accounts and money-market funds pay between 3.3 and 5 percent. Roughly 1.6 trillion dollars sits in accounts at JPMorgan, Bank of America, and Wells Fargo that pay no interest at all, about 16 percent of their deposits.
That money stays put because moving it is tedious. An agent that checks balances every night and sweeps idle cash into the highest-yielding account removes the tedium. Schwab's shares fell 6 percent on September 22 on exactly that fear. JPMorgan's answer is instructive: it is piloting a tool called Smart Cash that forecasts a customer's cash flow and moves funds to earn more. The bank is not against agents. It is against agents it does not own.
"The bank is not against agents. It is against agents it does not own."
An Analyst's View: Both Sides Are Telling the Truth
A top practitioner reading this week's statements should resist two lazy conclusions. The first is that the banks are simply protecting a subsidy. They are, but the security case is not a pretext. Bank of America did not hire a thousand contractors for theater. The second is that the banks are heroes of consumer protection. A customer who wants a machine to move her money to a better rate has a legitimate interest, and the banks' refusal to build a safe door, while building their own agents, invites the question of whether the lock is about safety or market share. The Ninth Circuit's August ruling in Amazon's fight with Perplexity, which rejected the use of anti-hacking law against a user-directed agent, shows courts are not yet persuaded that "agent" means "intruder."
The honest reading is that the banks are right about the risk and self-interested about the remedy. What is missing is a standard. Meta is building one with the customer-service company Sierra, a protocol that would let an agent identify itself and prove its authority. Banks and regulators are asking for the same thing under a different name: know your agent, with scoped permissions, revocation, and audit trails. When that exists, the blocks become hard to defend. Until it exists, they are defensible.
Practical steps for the audiences OSRS serves:
Security agencies and regulators: Treat agent identity as a 2027 rulemaking priority. The questions U.S. regulators are now asking banks- how agents are authorized, monitored, limited, and shut down- apply to every regulated industry. The European Central Bank has already set an end-of-October deadline for banks' AI-threat plans.
Policymakers in Africa: Nigeria's open-banking framework and the continent's mobile-money platforms will face the same agents within a year. Decide now whether an agent may hold a customer's credentials, and who carries the loss when it errs.
Business leaders: Audit which of your systems accept logins from automation that imitates a human. Every one is a door an agent can walk through today.
Consumers: Do not give any AI assistant your banking password. Read-only connections through licensed providers offer the same convenience safely.
The Bottom Line
Four institutions closed the same door in four days because the agents arrived before the identity layer that would make them safe to admit. The security risk is real and documented. The deposit risk is real and quantified. The missing piece is a trusted way for a machine to say who it is and who sent it. The organizations that build and demand that standard will be the ones that open the door on their own terms, rather than having it forced.
OSRS can help. OGUN Security Research and Strategic Consulting provides AI threat assessments, agentic-AI governance reviews, financial-sector risk briefings, and strategic advisory services for government, law enforcement, and private-sector leaders in the United States, Nigeria, and across Africa. Contact us to schedule a briefing or an AI-readiness assessment for your organization.
Enjoyed this article? Share it with a colleague who needs to see it. Stay informed by subscribing to our email list and following us on Google News, Twitter, and LinkedIn for more exclusive cybersecurity insights and expert analyses.
About the Author
Dr. Sunday Oludare Ogunlana is the Founder and CEO of OGUN Security Research and Strategic Consulting LLC, a Professor of Cybersecurity, a national security scholar, and a television commentator. He advises government, law enforcement, academic, and private-sector organizations on security strategy and serves on advisory bodies including the Global Alternative Agenda, the Council for African Security Affairs, and the African Security Forum.
Intelligence. Protection. Strategy. www.ogunsecurity.com
Comments