Banks Are Blocking AI Agents. What Builders Should Do Now

Major US banks have found third-party AI agents logging into customer accounts, and they are shutting the door. According to an Axios scoop on October 22, Morgan Stanley is blocking outside agents entirely, while JPMorgan Chase, Bank of America and Citi are restricting them. If you build agents that touch money, this is the clearest signal yet: agents that log in with a customer's password are on borrowed time, and agents that use proper, scoped access are the future.

What actually happened

Here is what has been reported, without the hype (Engadget's summary of the Axios report):

• In most cases the agent logs in with the customer's own username and password, with the customer's permission. That breaks bank rules that say customers must log in themselves.
• Some agents reportedly went beyond what users asked for, including contacting bank call centers.
• No account takeovers, fraud losses or specific agent products have been reported.
• Citi said it does not permit third-party agents to log in or transact on its digital banking platforms. A Chase spokesperson said customers should not give their usernames and passwords to anyone, including AI agents. Morgan Stanley disputed that rogue agents had accessed its platforms.
• Wells Fargo says it has taken steps to block unauthorized agents, and its updated customer agreement, effective November 24, 2026, says customers may be responsible for transactions started by agents they authorize, including actions that go beyond their instructions.

That last point matters most for anyone shipping a consumer agent. If your agent overreaches, your user may be the one who pays.

Watch ModelOp find shadow AI live in Episode 55 (starts at 06:25) · Episode 55 notes and transcript

This is the "shadow AI" problem, now at your bank

We saw this coming on Episode 55 with Jim Olsen, co-founder and CTO of ModelOp, whose company helps large enterprises govern AI. A lot of his customers are exactly the institutions in this story:

Many of our customers are banks, you know, financial institutions, healthcare institutions, you better have some idea of the potential risks to your business, to your patients, to your customers, etcetera, out there.

— Jim Olsen, ModelOp, Episode 55

In the demo, Jim ran ModelOp's discovery scan across enterprise platforms to find AI nobody had registered, what he called shadow AI. It turned up a long list on the spot: Copilots, agent cores and other tools sitting outside any approval process. The banks are now finding the consumer version of the same thing, except the unregistered agents belong to their customers.

His approach was not to ban everything. ModelOp's process brings each discovered tool into an inventory, collects documentation, checks it against policies like the EU AI Act, and keeps a human in the loop for approval. That is roughly the shape the banks are moving toward too: most are settling on read-only access as an interim step, so agents can see account information but not move money.

What we learned giving a bot real money

We have built agents that trade. On Episode 26, Jordan built a prediction market trading bot and let it place real bets. It won about 66% of its trades and still lost money, because fees ate the thin margins and because, as he put it:

These are bots trading on bots trading on bots.

— Jordan Metzner, Episode 26

The lesson carries over to banking. An agent can do exactly what you told it and still produce a result you did not want. That is why the guardrails matter more than the model. Jordan also built a trading bot on Public's official brokerage API in Episode 8, and the difference between an official API and an agent poking at a login screen is the whole story here.

How to build agents banks will allow

If you are building anything that touches financial accounts, here is our checklist:

1. Never ask for passwords. Use official APIs and the bank's own authorization flows. Credential sharing is exactly what the banks are blocking, and Chase is telling customers not to do it.
2. Start read-only. Read access is where most banks are landing for now. Design your agent to be useful with visibility alone, then earn write access.
3. Ask before consequential actions. Anthropic built Claude Duet to request approval before major actions and stresses human oversight for financial and legal decisions. Copy that pattern.
4. Keep the agent inside its instructions. Overreach is the reported problem, and under terms like Wells Fargo's, your user may carry the cost.
5. Log everything. If a bank or a user asks what the agent did, you need an answer. This is the inventory and monitoring discipline Jim described.
6. Price in the tokens. Always-on agents use far more compute than chat. Jim's other warning on the show was about token usage: "It really stacks up."

Where this goes next

Personal agents like Meta Muse, Claude Duet and Grok Bot are going mainstream fast, and banking is one of the first places they run into the real world. We expect banks to open official, permissioned agent access rather than fight agents forever, the same way they eventually opened up to fintech apps. The builders who win will be the ones already doing it the right way.

For more on how AI is changing financial services, see our AI in finance page and our episode on AI cybersecurity. We cover agents every week on the show.