Two of the largest names in American finance have drawn the same line in the same week: AI agents that log in with a customer’s credentials and act for them are not welcome. Charles Schwab chief executive Rick Wurster said Schwab blocks unauthorized outside agents from moving client money, and JPMorgan Chase boss Jamie Dimon said on the bank’s third-quarter earnings call on October 13 that the bank will not let outside agents operate inside its systems. The reporting comes from The Next Web, American Banker and Cybernews, which in turn draw on Wurster’s remarks to Bloomberg Television and on the JPMorgan call.

This is a business and policy story more than a gadget story, and it lands just as consumer AI agents are moving from demos to products people can buy. Meta’s Muse, which the coverage describes as a personal agent that can browse, fill in forms and make purchases, was named as an example of the kind of tool Schwab turns away.

What Schwab and JPMorgan actually said

According to The Next Web, Wurster told Bloomberg Television that his worry is credential sharing: a client hands a login to an agent, the agent acts, and nobody is sure who is liable if something goes wrong. He receives a report of blocked attempts, and The Next Web quotes the frequency as “tens and twenties” per week. American Banker, which reported the same policy, gave no count and said Wurster describes the notices as infrequent. The two accounts do not line up, so treat any specific number as unsettled.

American Banker says Schwab blocks outside agents that sign in with client credentials or drive the website through browser automation. It does not stop clients from using outside language models through approved connections. Schwab plans to run model context protocol (MCP) servers, a standard that lets a client’s chosen AI model connect to a company’s systems under the company’s rules. Through those links, outside tools could check balances and do research, but not move money.

JPMorgan’s position, as Cybernews summarizes the earnings call, is similar. Dimon warned of “rogue agents” and said there could be thousands of them. The bank already lets some third-party tools view account data in read-only form, but it does not let them send money or pay bills. A bank spokesperson said customer protection is the top priority.

A laptop and smartphone on a dark wooden desk at night with a brass padlock beside them

Why banks are drawing the line at login

There is a difference between an agent that reads and one that acts. Both banks still allow read-only access in some form. What they refuse is the pattern where a customer gives away a username and password and an automated system uses it however it sees fit. Wurster called that unsafe, and American Banker notes the concern extends past stolen funds: an agent with access to many online accounts could put client data at risk even without authority to move a dollar.

Regulators are watching too. The Next Web reports that US and European supervisors are questioning banks about their own use of AI agents and the cyber risk that comes with them, and that liability for agent mistakes is still being debated in Congress. It also notes that Google and JPMorgan have each fixed a security flaw in MCP, a reminder that the connection standard Schwab is leaning on is young.

Banks are not alone. Cybernews reports that Amazon bars unauthorized AI agents from shopping or browsing on a user’s behalf, saying that access violates its conditions of use. The shared logic is that the company, not the agent’s maker, is the one holding the customer relationship when something breaks.

The money question

Not everyone reads the policy as purely about safety. American Banker quotes consultant Tim Welsh arguing that Schwab also has a financial reason to keep agents away from clients’ idle cash. Schwab reported about $3.48 billion in third-quarter net interest revenue, much of it from roughly $493 billion in cash-sweep accounts, and an agent that shuffles cash toward higher yields could pressure that income. Wurster disputes the idea, saying clients who use AI for trading hold more cash at Schwab, not less. Both views are on the record; the data in the coverage does not settle which is right.

Long rows of server racks in a data center aisle lit by cool blue indicator lights

Schwab’s own assistant

Schwab wants clients to use Charley, its own AI assistant announced on September 30. Per American Banker, Charley is built on outside language models plus Schwab’s own data, is used mostly for information and summaries today, and starts with a handful of account actions such as changing an address or naming a trusted contact. Schwab plans to widen it to most functions on its site, by text or voice. Some trading ability may come later, but moving money is excluded for now.

What this means for people who use AI tools

  • Check before you hand over a login. If an AI service asks for your bank or brokerage username and password, find out whether your institution allows it. Several of the largest do not, and your terms of service may place the risk on you.
  • Expect read-only first. The likely path is approved connections that show balances and transactions but cannot send funds, with the bank’s own assistant handling anything that changes an account.
  • Watch the liability language. Who pays when an agent errs is unresolved in law, which is part of why banks are cautious. Read the fine print on any agent that offers purchase protection.
  • Expect friction elsewhere. Retailers and banks both treat unauthorized agents as terms-of-service violations, so agent products may work on some sites and break on others.

For builders of agent products, the message is practical: sanctioned APIs and standards such as MCP are where banks are willing to meet you, and screen-scraping a customer’s session is where they are not. x9m8 covered the security side of this problem in AI Agent Containment After Anthropic’s October 9 Report, which looks at failure patterns and the controls that match them.

An empty modern glass and limestone office tower at golden hour with a quiet stone plaza

What to watch next

Three things are worth tracking. Whether other large banks publish similar rules, whether regulators issue guidance on agent access, and whether Schwab’s MCP servers launch with the read-only limits described. This is a fast-moving story and the details above reflect reporting from October 14 through 16; the numbers on blocked attempts in particular may be revised. This article is general information about technology and business news, not financial or legal advice.

Sources