The agents banks can block, and the ones they cannot

Five of the largest US financial institutions restricted outside AI agents in ten days. Every one of the blocks catches the agent that announces itself. The agent that drives a customer's own browser, on the customer's own machine, announces nothing, and the control that covers it sits at the action, inside the bank.

Regulatory references verified as of October 23, 2026.

What happened

On October 13, on JPMorgan Chase's third-quarter call, Jamie Dimon said the bank will not allow outside AI agents inside the company, and warned of "rogue agents" at a scale of thousands; the bank confirmed it blocks agents that log in with customer credentials. On October 16, Charles Schwab's chief executive, Rick Wurster, told Bloomberg Television that Schwab is not allowing agents that act on a client's password to move money. On October 22, Axios reported that major US banks, including Morgan Stanley, Bank of America and Citi, are detecting unauthorized third-party agents in customer accounts, some of them acting without clear instructions from the customer, and in some cases reaching call centers. Morgan Stanley has started blocking third-party agents, while saying it has not seen rogue agents on its platforms. Most banks have allowed or are moving toward read-only access, so an agent can see a balance and cannot move it.

The same day as the JPMorgan call, Reuters reported that the Federal Reserve, the OCC and the FDIC are asking banks, in writing and in conversation, whether agent decisions can be tracked and audited, what stops an agent exceeding its authority, whether humans remain involved in key decisions, and whether an agent can be shut down.

A Chase spokesperson told Axios that customers should not give their usernames and passwords to anyone. That is the policy. The rest of this post is about what the policy can and cannot reach.

The agent on my desk

An agent handles my bank and card accounts every day. It drives my own browser on my own Mac. The bank sees a residential IP, my device fingerprint, my saved sessions and my typing cadence. When the one-time code arrives, the agent reads it from my password manager or my messages and enters it. Every signal the fraud stack scores comes back as me, because it is my machine and my credential.

This is a daily practice, on live accounts. It is also what the banks say they are detecting, apart from the agents that act on their own.

What a block catches

A block on third-party agents works on the signals an agent gives off when it comes in from outside: an API call where a browser should be, a headless browser with a known signature, a data-center IP range, a vendor's user agent string. Those signals exist, and the agents that carry them are the easy ones. A block is useful against the sloppy ones and silent against the rest.

Behavioral biometrics go further. They can flag a cursor that jumps instead of travels, a form filled with zero hesitation, a session with no scrolling. Those are agent-side settings, and they get tuned. An agent that drives a full browser at a human cadence produces the same telemetry as the human it works for.

Axios reports agents reaching call centers. That is the same point from the other direction: the agent is using the channels the customer uses, and the channel cannot tell them apart.

What a login proves

A login proves possession of a credential, from a device the bank has seen before, inside a session it issued. That is all it proves.

It says nothing about who or what is using the credential. It says nothing about what that party was authorized to do once inside: read a balance, pay a bill, move a limit, open a wire. It says nothing about whether a person approved the specific action that follows.

At the login screen, delegation and account takeover are the same event. A customer who handed credentials to an agent, and an attacker who stole them, present identically: the right credential, from the right device, with the one-time code entered on time. A control that lives at the login has no way to separate the two, because the difference is in authority, and the login never carried it.

Two populations

Agent traffic is splitting into two populations.

The first identifies itself and accepts a protocol. Sierra, with Meta, published a draft of the Personal Agent Protocol in October, designed to let businesses identify a customer's agent and set parameters for what it can do. Synchrony, Bank of America and Wells Fargo are among the design partners. On the commerce side, Google's Agent Payments Protocol carries a signed statement of what a customer asked for and what the customer approved. Both attach authority to the action, which is the right place for it.

The second population never identifies itself, and it keeps looking like a customer. Some of it is a customer's own tooling, like the agent on my desk. Some of it is the "rogue agents" Dimon described. From the bank's side, the two look the same, and both arrive whatever any protocol says.

A control that depends on the agent cooperating governs the first population only. The protocols will scale the cooperating half of the market. The bank still has to decide what to do with the other half, and that decision cannot be delegated to the agent.

Who carries the loss

Regulation E is the rule that allocates loss on consumer electronic fund transfers. Its definition of an unauthorized transfer excludes a transfer initiated by a person who was furnished the access device by the consumer, unless the consumer has told the institution that transfers by that person are no longer authorized (12 CFR 1005.2(m)(1), verified October 23, 2026).

A customer who hands credentials to an agent has furnished the access device. A transfer the agent makes is, for Regulation E purposes, the customer's transaction, and the official interpretation of the rule (comment 2(m)-2) makes the consumer fully liable when the person furnished with the device exceeds the authority given. The block protects the bank. The customer carries the loss either way, whether the agent did what was asked or something else. Approval at the action, by the person who owns the account, is what protects the customer.

The four questions

The regulators' questions, as Reuters reported them, are worth reading next to the blocks. Can agent decisions be tracked and audited? What stops an agent exceeding its authority? Do humans remain involved in key decisions? Can an agent be shut down?

A block answers none of them. It removes the agents that can be seen and leaves the questions open for the agents that cannot. Supervisory guidance on model risk, SR 26-2, places generative and agentic AI outside its own scope (footnote 3 of the attachment, April 17, 2026), so the questions are being asked directly, bank by bank, rather than through a published standard. The answers have to come from controls the bank runs, on traffic the bank sees.

The control sits at the action

The durable control sits on the bank's side, at the action, whatever presents at the login.

Authority bound to each operation. A session, however it was opened, carries a scope: what this party may read and what it may change. Reading a balance and moving money are different operations with different authority, and the control evaluates each one at the moment it is attempted, after the door has already been passed.

The accountable human approving anything that moves money. When an operation exceeds the session's authority, it pauses, and the person who owns the account decides. The customer who delegated to an agent gets the approval. The customer whose credentials were stolen gets the alarm. The same step covers both populations, because it never needed to know which one arrived.

A record of who or what asked. Every operation, approved or paused, lands in one record: the session, the authority it carried, the action, the decision and the person who made it. That record answers the regulators' first question and their third, and it is what the bank reads when a customer disputes a transfer.

Read-only access is the first version of this control. It fixes the scope at the narrowest setting. It will not be the last version, because customers will want agents that act, and read-only access will not satisfy them. Blocking is a pause.

Owned intelligence, governed from the first call

The same control applies inside the bank's walls. Banks are deploying their own agents, on their own data, with their own staff's delegated authority, and the regulators' four questions apply to those agents first. Enterprises will rent some intelligence and own more of it. The policy is written once for the whole estate, it is enforced at the control point inside the enterprise's walls, and the evidence stays with the enterprise.

The chain a bank needs for an agent at its front door is the chain it needs for the agents it runs. A verified person, the authority that person delegated, the agent that used it, the policy that applied, the decision and the record of all of it. That chain is the product. The accountable human decides.

Related: What is a hybrid AI estate?, The CISO's guide to runtime governance for AI agents and AI agent governance: MCP, A2A and the new attack surface.

Sources

• Axios, "Scoop: Unvetted AI agents are accessing U.S. bank accounts," Madison Mills, October 22, 2026: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access. Opened October 23, 2026.
• JPMorgan Chase third-quarter 2026 earnings call, October 13, 2026 (Dimon: "you don't want rogue agents, and there could be thousands of them"), and Fortune, "'You don't want rogue agents': Jamie Dimon bars outside AI agents like Meta's Muse from JPMorgan accounts," October 15, 2026: https://fortune.com/2026/10/15/jamie-dimon-ai-agents-meta-muse-jpmorgan/. Opened October 23, 2026.
• Reuters exclusive, "Banking watchdogs ramp up AI scrutiny as stability fears mount, sources say," October 13, 2026 (syndicated copy): https://www.cp24.com/news/world/2026/10/13/banking-watchdogs-ramp-up-ai-scrutiny-as-stability-fears-mount-sources-say-reuters-exclusive/. Opened October 23, 2026.
• The Next Web, "Schwab and JPMorgan are blocking AI agents from moving customer money," October 16, 2026 (Wurster on Bloomberg Television): https://thenextweb.com/news/schwab-blocks-ai-agents-meta-muse. Opened October 23, 2026.
• Sierra, "Introducing Poppy, a draft of Personal Agent Protocol," October 9, 2026 (design partners including Synchrony, Bank of America and Wells Fargo): https://sierra.ai/blog/poppy. Opened October 23, 2026.
• Google, Agent Payments Protocol (signed mandates): https://ap2-protocol.org/. Opened October 23, 2026.
• Regulation E, 12 CFR 1005.2(m)(1), definition of unauthorized electronic fund transfer, and Official Interpretation comment 2(m)-2. Verified October 23, 2026 on eCFR.
• Federal Reserve SR 26-2, April 17, 2026, attachment footnote 3 (generative and agentic AI outside scope). Verified October 14, 2026 for the APERION TPRM comment letter; re-checked October 23, 2026.