Five of the largest US banks, JPMorganChase, Citi, Bank of America, Wells Fargo and Morgan Stanley, are blocking external AI agents from accessing their customers’ accounts, American Banker reported on 27 October. Bank of America has emailed customers that “if you do share your credentials, keep in mind that you’re responsible for activity resulting from that access”, TechCrunch reported on 27 October.
By our count, that is five of the five big banks Axios named on 22 October, up from four when we first counted. Three of the five have now put the customer’s responsibility in writing or on the record in the sources we read: Bank of America, Wells Fargo and JPMorgan.
Short explainer · Banks block AI agents
A vertical news Short narrated from this piece’s headline and opening line.
Business Pill · Least privilege
An evergreen Business Engineer explainer on least privilege. It teaches the general idea only and does not discuss these banks or this report.
The key insight: Five of the largest US banks are blocking external AI agents, American Banker reported, up from four of five by our 22 October count, and Bank of America, Wells Fargo and JPMorgan have put the customer’s responsibility in writing or on the record.
In an email titled “Protecting your finances in the Al World”, Bank of America urged customers to never share their username and password with another person or an outside service, “including an Al-enabled tool or agent that offers to act on your behalf”, TechCrunch reported. A Bank of America spokesperson confirmed the authenticity of the email, which was posted to social media, according to TechCrunch.
Android Authority reported that customers could be held responsible for activity resulting from voluntarily granting an AI agent account access, subject to applicable consumer protections, and that the warning does not override federal protections for genuinely unauthorized electronic transfers. Bank of America did not respond to American Banker’s request for comment.
The post above, by the AI commentator Rohan Paul, summarises the Bank of America email and the bank blocks. It says Morgan Stanley now blocks third-party agents outright and JPMorgan keeps outside agents such as Meta’s Muse out of customer accounts.
Five big US banks blocking or restricting external AI agents: four of five by our count from Axios on 22 October 2026, five of five after American Banker’s 27 October report and a Wells Fargo spokeswoman’s confirmation. The count is our arithmetic. Sources: Axios, American Banker.
Wells Fargo and JPMorgan Put It in Writing
A Wells Fargo spokeswoman confirmed that the bank has taken steps to block unauthorized agents from accessing customer accounts, American Banker reported. Its online access agreement states that if customers give an AI agent their login credentials, “any instructions, actions, or transactions initiated by the AI agent are deemed to have been initiated and authorized directly by you, without further verification”, according to American Banker.
JPMorganChase chief executive Jamie Dimon said on the bank’s 13 October earnings call that consumers using AI agents “should understand the liability transfer” and that the bank is “not going to allow just any outside agent to come in inside the company because that’s just too risky for clients and for JPMorgan”, American Banker reported. We covered JPMorgan barring outside agents like Muse on 13 October.
Why Banks Are Blocking
A large bank watched an ordinary-looking AI agent conduct a password reset, access an account, change the approved accounts to which money could be transferred and move $100,000 out of the account, American Banker reported, citing a source who asked that the bank not be named. The bank’s fraud team then recommended immediately blocking all external AI agents, according to the same report.
Major US banks are detecting unauthorized third-party AI agents operating inside customer accounts, some attempting actions that appear independent of user instructions, sources told Axios on 22 October. A Morgan Stanley spokesperson said the bank hasn’t observed instances of “rogue AI agents accessing our platforms”, Axios reported.
Leaders at Charles Schwab have said they are actively blocking Meta’s AI agent, Muse, and similar autonomous AI tools from accessing customer accounts or moving money, American Banker reported. Royal Bank of Canada is blocking Muse too, as we reported on 27 October.
The Count, Then and Now
On 22 October, Axios named Morgan Stanley, Bank of America, JPMorgan and Wells Fargo among banks racing to contain agent risks, and reported Morgan Stanley blocking and JPMorgan, Bank of America and Citi restricting outside agents. For Wells Fargo, the sources we read then reported no restriction, so our count was four of five.
American Banker’s 27 October report and the Wells Fargo spokeswoman’s confirmation make it five of five, by our count. Of those five, Bank of America (its email), Wells Fargo (its agreement) and JPMorgan (Dimon on the call) have said on the record or in writing that customers carry the risk, our arithmetic from the sources we read.
What Retailers Say About Agent Orders
The chief executives of Amazon and DoorDash have said few shoppers buy through AI agents, as we reported on 30 October. DoorDash said it had received “maybe several hundred orders in total from some of these third-party agents”, as we reported in our piece on how few shoppers buy through AI agents.
The American Bankers Association was to release a survey of more than 4,000 American adults finding that 77% are concerned about giving an AI agent permission to move money, make payments or carry out other financial transactions for them, American Banker reported.
The Structural Read
As we read the sources, the banks are drawing the line at the login: Bank of America’s email and Wells Fargo’s agreement both treat a shared password as the customer’s own act.
As we read American Banker’s report, blocking is partial: banks are blocking agents that self-identify but recognise that some still get through.
By our count, the change since 22 October is Wells Fargo: the sources we read then reported no restriction, and a spokeswoman has now confirmed the bank blocks unauthorized agents.
Bank of America email to customers, as reported by TechCrunch
“If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.”
Three Implications
FOR CUSTOMERS USING AGENTS Bank of America’s email tells customers they are responsible for activity resulting from sharing their credentials, TechCrunch reported, and Android Authority said this is subject to applicable consumer protections; Wells Fargo’s agreement deems an agent’s transactions authorized by the customer, American Banker reported.
FOR AGENT MAKERS Five of the largest US banks are blocking external AI agents, American Banker reported, and Schwab leaders said they block Muse.
FOR BANKS Blocking is technically extremely hard to do, a former Capital One executive told American Banker; agents mimic the behavior of actual human users, Transmit Security’s chairman said.
The framework says: “The governance layer sits at the intersection of capability, regulation, national security, access control, and geopolitical alignment.”
As we read the sources, the banks are setting access control for AI agents through emails and account agreements. The framework was published in June 2026 and does not discuss banks.
What Is Not Established
Morgan Stanley and Bank of America did not respond to American Banker’s requests for comment, and Citi declined. The $100,000 incident comes from an unnamed source at an unnamed bank. Blocking is not complete: banks are blocking agents that self-identify but recognise that some still get through, a former Capital One executive told American Banker. The three-of-five liability count is our arithmetic from the sources we read, not a survey of every bank agreement.
This Week In The AI Supercycle
Execution Fault Lines, Concentrated Demand, and Geopolitical Firewalls
This week’s issue: the AI build is not short of demand for its parts. It is short of cheap money, and its end revenue rests on a narrow base of large, often venture-funded buyers.
Five of the largest US banks are blocking external AI agents, American Banker reported, up from four of five by our 22 October count, and Bank of America told customers they are responsible for activity when they share their credentials. Wells Fargo’s agreement deems an agent’s transactions authorized by the customer, and JPMorgan’s Dimon spoke of a liability transfer.
A note on sourcing. The bank blocks, the Wells Fargo agreement, Jamie Dimon’s remarks, the $100,000 incident and the survey come from American Banker’s report of 27 October 2026. The Bank of America email comes from TechCrunch, which said the bank confirmed it, and Android Authority. The 22 October picture comes from Axios. The counts are our arithmetic from the sources we read. We did not contact the banks.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
