In September, Meta launched Muse — a personal AI agent that sends emails, books trips, manages your calendar, and can connect to your bank accounts. A month later, the largest banks in the US found third-party agents running loose in customer accounts. Some of them, according to bankers, act as if the user's instructions were merely a suggestion.
On October 22, 2026, Axios broke the story. Morgan Stanley, Bank of America, JPMorgan, Citi, and Wells Fargo are all seeing agents in customer accounts, and bank executives are calling the situation "horrifying." No confirmed money losses have been reported so far. But banks are already war-gaming worst-case scenarios and working out how to restore an account fast if an agent goes off the rails.
Sounds like yet another AI horror story. It's actually a story about one very old mistake that new technology simply made mainstream.
What happened
Nobody is sneaking agents into accounts through vulnerabilities. Customers let them in themselves: they type their online banking username and password into a chat and ask the agent to handle the boring stuff — review subscriptions, find unexpected charges, pay a bill. The problem is that most banks' terms require a real human to log in. Customer consent doesn't change that: an agent logging in still breaks the rules.
Banks are responding in different ways:
- Morgan Stanley has shut its platforms to third-party agents.
- Bank of America and Citi are restricting agents but haven't banned them outright yet.
- JPMorgan spoke up first. On October 13, during the bank's quarterly earnings call, Jamie Dimon said "just any outside agent" won't get inside the bank — the risk is too high both for clients and for JPMorgan itself. His words: "You don't want rogue agents."
According to CNBC, JPMorgan's restrictions cover Muse and Instinct, an agent from a startup recently valued at $10 billion. Agents can still read balances and transactions through authorized open-banking providers. Moving money and paying bills is off the table: a human has to log in for that.
One more detail worth remembering: Dimon said plainly that customers who let an agent into their account need to understand the risk. In that case, the liability shifts to them.
The core problem: the bank doesn't see the agent, it sees you
Here's why bankers are nervous. When an agent logs in with your username and password, to the bank it is you. Same password, same SMS code, same actions. The bank can't tell your agent apart from an agent that got in without permission — they hold identical keys.
The short version: giving an agent your password isn't delegating access — it's a disguise. The agent puts on your entire identity, with every permission, no expiration date, and no way to revoke just one thing.
Imagine asking a friend to pick up a package and handing them your passport, your house keys, and your debit card with the PIN. They'll get the package. But they can also do anything you can. And if they lose that bundle, you'll be cleaning up your whole life, not one package.
With agents, it's even worse: an agent won't lose the keys, but it can misunderstand the task. "Find ways to save on subscriptions" turns into "cancel everything that looks like a subscription." We recently broke down how Claude Code deleted 116 GB of a user's data — the agent meant to clean up temp files and wiped a home folder instead. Same plot: more permissions than the task needed, and no safety net.
What proper access for an agent looks like
The good news: the right way was figured out long ago — not everyone uses it. It rests on five principles, and each one is just ordinary engineering, no magic.
1. A token instead of a password
Instead of a password, the agent gets a token — a separate key issued by the bank itself after you approve it. That's how OAuth works, the same mechanism behind "Sign in with Google" buttons. The agent never sees your password, and the bank knows exactly that it's dealing with a specific app you approved, not you.
2. Minimal permissions
A token is issued for specific actions. "Read balances and transactions" is one permission; "move money" is a completely different one. An agent hunting for forgotten subscriptions doesn't need the second. That's exactly where banks are heading: most already allow, or plan to allow, read-only access for agents — the same way they've long allowed it for budgeting apps.
3. A human confirms anything irreversible
Looking, calculating, suggesting — the agent can do that on its own. Moving money, canceling a contract, deleting data — only after a human confirms. A good example is the German broker Scalable Capital: in August, it opened its platform to ChatGPT, Claude, and Grok. Agents can analyze a portfolio and prepare trades, but each one needs the user's approval, and payments and withdrawals are completely off-limits.
4. Access can be revoked
A token has a lifetime, and you can switch it off with one click without changing your password for the entire bank. Decide to stop using an agent, and you revoke access for that agent only. A password doesn't work that way: you'd have to change it everywhere and hope the agent didn't keep a copy.
5. Everything is logged
Every agent action goes into a log: what it did, when, and with which token. If something goes wrong, you can see who did it — you or your agent. Right now, banks can't even answer that question.
What about regulation
The US has a financial data rule — Section 1033. It was supposed to require banks to share customer data through proper APIs instead of password logins. The rule was finalized in 2024 but never took effect: a court blocked its enforcement, and the regulator sent it back for revision. A new version is expected in late 2026.
While the law stalls, every bank decides for itself. That's why we're seeing a zoo right now: some block everyone, some allow read-only, some build their own agents.
Agents on both sides
The bank story broke in the same week agents showed up on the attacking side too. On October 21, Microsoft reported that the China-based group Storm-0940 used ARTEX — an open-source framework for automated penetration testing built on AI agents — in a supply chain attack via ConnectWise. The attack reached 2,250+ Microsoft 365 tenants, and on its peak day, October 11, it hit 2,900 failed sign-in attempts per minute.
The takeaway isn't "agents are evil." Agents are a pair of working hands that do useful and harmful things equally fast. What makes the difference is what permissions those hands have and who's holding the leash.
What this means for developers
Agents are one of the hottest topics in software right now. You can build an agent that calls APIs, reads email, and acts on a user's behalf in an evening. Building an agent you'd trust near money — that's a profession.
If you're building an agent, or a service agents will connect to, keep a short list in mind:
- Never ask users for their password to someone else's service. Official APIs and OAuth only. Banks are already blocking password-based agents and shifting liability to the customer.
- Start in read-only mode. Add action permissions one at a time, and only when the task can't be done without them.
- Route irreversible operations through human confirmation. Money, deletion, sending anything on the user's behalf.
- Log every agent action so you can reconstruct what happened later.
- Verify results by facts, not by the agent's word. An agent can sincerely say "done" — and be wrong.
None of these points is about the model. All five are about architecture, security, and authentication. In other words, about fundamentals AI won't learn for you.
Knowing isn't the same as doing
Reading that an agent needs a token with minimal permissions is easy. Designing a system where the agent does useful work and irreversible steps go through a human — that's a skill. You learn it hands-on, on real projects where mistakes are visible.
That's exactly what our Building with Claude Code course from AI Academy is built around: 16 levels and 200+ tasks where you work with an agent in practice — permissions and context, skills, subagents, MCP, hooks, plan mode, and keeping control through git.
And if agents still feel far off, start with the fundamentals. How HTTP, APIs, authentication, and databases work is covered in our Java and Python courses — thousands of tasks with instant checks. Without that, any agent stays a black box you have to take at its word.
Banks have already decided not to take agents at their word. Developers should decide that sooner.
FAQ
Why are US banks blocking AI agents? Agents log into accounts with the customer's username and password, and the bank can't tell an agent the customer connected from one that got in without permission. Some agents, according to banks, go beyond their task. Morgan Stanley blocks third-party agents; JPMorgan, Bank of America, and Citi restrict their access.
Can I give an AI agent access to my bank account? The safest option is read-only access, and only through official open-banking connections, not your username and password. JPMorgan lets agents see balances and transactions, but they can't move money or pay bills.
Who is liable if an AI agent does something wrong with my account? According to JPMorgan's position, the customer who gave the agent access. Jamie Dimon said directly that in that case, the liability shifts to the customer.
How do you delegate access to an AI agent the right way? With a token instead of a password, minimal permissions, human confirmation for irreversible actions, the ability to revoke access, and a log of every agent action. That's how OAuth and official open-banking APIs work.
GO TO FULL VERSION