U.S. banks are blocking outside AI agents from customer accounts and transactions, including cases where customers supplied their own logins, Reuters reported on October 22. The dispute over AI bank access exposes a practical problem: a working password does not tell a bank what an assistant has permission to do.
Reuters, citing two people familiar with the situation, confirmed the restrictions following an Axios report that some agents appeared to act beyond users’ instructions. Morgan Stanley was blocking third-party agents but had not seen unauthorized or rogue agents, a person familiar with the matter told Reuters. Those are different claims: blocking software is evidence of an access policy, not proof that it stole money.
Why banks are restricting AI bank access
Earlier this month, JPMorgan Chase CEO Jamie Dimon warned against allowing arbitrary outside agents into the bank’s systems. Charles Schwab CEO Richard Wurster also described blocking agents to retain control of authentication and the customer experience, according to the same Reuters report.
A banking assistant might help a customer inspect spending or compare accounts. Acting inside an account raises a separate question: which decisions may it execute? Permission to review a balance does not, by itself, specify an amount, a recipient or a transfer. This is the control problem behind the story, even when the login was willingly shared.
The distinction matters because customer intent, the bank’s access rules and an agent’s actual behavior are separate things. Treating every blocked agent as a hacker exaggerates the evidence. Treating a shared password as a precise instruction understates the problem.
There is already an alternative to sharing passwords
Chase’s existing account-linking system illustrates a narrower approach. Customers sign in directly with Chase, choose which accounts to connect and can revoke an app’s access. The third-party app does not receive the customer’s banking username or password. This is established data-sharing infrastructure, not an announcement that Chase has approved unrestricted AI agents.
The Financial Data Exchange’s technical standards similarly describe explicit, revocable consent with limits on scope, duration and accounts, without handing credentials to the recipient. These controls govern financial data sharing; they do not automatically authorize an AI to make transactions or guarantee its judgment.
This is also distinct from the recent PHP security emergency. CERT-EU describes software flaws permitting remote code execution without authentication. The banking reporting reviewed here does not connect these agent restrictions to exploitation of those flaws.
For banks and AI developers, the next useful step is a permission system that distinguishes reading information, proposing an action and executing it. If assistants are to handle money, a successful login cannot be the whole authorization process.
