Five major U.S. banks are restricting or blocking third-party AI agents from customer accounts after detecting automated systems operating inside those accounts, according to a report published by Axios in October 2026. If you have ever connected an AI assistant to your bank login, you may already be in violation of your bank’s terms of service, depending on how that connection was made. Governments have also moved to limit tech platform access to financial data, signaling broader institutional concern over who controls sensitive information.
What Banks Are Actually Seeing
Banks are confronting an authentication gap their systems were not built to handle.
Morgan Stanley, JPMorgan Chase, Bank of America, Wells Fargo, and Citi are all taking steps to limit third-party agent access, sources told Axios. Reuters said it could not independently verify the specific incidents described in that report, so the details should be understood as attributed rather than independently confirmed.
The core problem is that banks can confirm which credentials were used to log in. They often cannot determine whether the activity behind those credentials is human-directed or customer-authorized , activity that sometimes resembles apps secretly tracking users without explicit approval. It may also be the product of an agent interpreting a task in ways the customer never explicitly approved.
JPMorgan Chase chief executive Jamie Dimon reportedly warned that there could be thousands of rogue agents operating across financial platforms, according to CNBC’s account of JPMorgan’s third-quarter earnings call. A Morgan Stanley spokesperson, however, said the bank had not observed instances of “rogue AI agents accessing our platforms,” even as Morgan Stanley has reportedly begun blocking third-party agents as a precaution.
What You Can (and Can’t) Do Now
The line banks are drawing separates reading your financial data from acting on it.
Viewing a balance is one thing; moving money is another. JPMorgan permits limited, view-only information retrieval through intermediaries such as Plaid, but that pathway does not allow agents to transfer funds or pay bills.
Citi has stated it does not permit third-party AI agents or assistants to log into customer accounts or transact directly within its digital banking platforms, though it does allow certain read-only access through approved open-banking providers. Customers at Chase have received direct guidance: do not share your username and password with anyone , a warning that echoes security researchers’ concerns about how hackers steal password vaults , putting a broad category of AI assistant integrations in a gray zone for Chase account holders.
Read-only access is emerging as the near-term compromise. Banks already support comparable connections for budgeting services like Quicken, so the infrastructure for limited data sharing exists. Granting an AI agent permission to view your investment balances is a different technical arrangement from granting it the authority to act on what it finds.
Charles Schwab is reportedly planning connections through Model Context Protocol servers with narrowly defined permissions, according to reporting cited by The Outpost, though Schwab has not independently confirmed that plan. If accurate, it represents the direction the industry appears to be heading: scoped authorizations that let an agent see specific information without touching transaction controls.
What This Means for Your Banking Habits
The practical question is whether your AI assistant connects to your bank through credentials or through a read-only open-banking channel.
Check whether any AI assistant you use has been granted access to your bank login credentials rather than a read-only open-banking connection. Those are meaningfully different arrangements.
Banks are actively tightening controls on credential-based agent access, and the version where an AI interprets what you probably want it to do with your money is what institutions say they are working to prevent. A framework for scoped, transaction-limited agent access appears to be the industry’s intended middle ground, but it does not exist in standardized form yet.
