JPMorgan Chase CEO Jamie Dimon has said the bank will not let just any outside AI agent inside its systems because the access is too risky for clients and for JPMorgan. Large American banks are now detecting and blocking agents that customers let into their accounts by handing over their own passwords, and the argument over whether that protects depositors or revenue reached a public fight in the last week of October 2026.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
What JPMorgan and Bank of America have said
Dimon made his remarks on JPMorgan’s third-quarter earnings call, as Fortune reported. He said the bank would not allow just any outside agent to come inside the company, warned against rogue agents that could number in the thousands, and said JPMorgan is building tools to protect customers. A JPMorgan spokesperson added that the bank stops third-party agents that try to log in with customers’ banking credentials, while supporting customer-authorized data sharing through open banking providers.
Cybernews reported that agents can still view some account data at JPMorgan in read-only form, but cannot send money or pay bills. The wider picture comes from Malwarebytes, which says large American banks are detecting and blocking agents operating with customer-supplied logins, and which cites an Axios report that unnamed major banks were finding third-party agents inside customer accounts.
Bank of America took a different route and wrote to customers. TechCrunch reported an email blast, confirmed as authentic by a spokesperson, urging customers never to share a username and password with another person or outside service, including an AI-enabled tool or agent offering to act on their behalf. The bank’s stated position is that a customer who shares credentials is responsible for activity resulting from that access.
Liability and lockouts when an agent logs in
TechCrunch lists three risks. An assistant could act on finances without the owner’s knowledge, the bank could read the activity as an account takeover and lock the customer out, and a flaw in the assistant could leak credentials to attackers. Most account agreements already make customers liable for anyone they give login details to, and TechCrunch links U.S. Bank’s digital services agreement as an example.
Malwarebytes frames the credential handover as adding a third-party service to the security chain. Even the read-only access that Axios says many banks allow, or are moving toward, still exposes confidential information. Its recommendations stay narrow: do not give banking passwords or security codes to general-purpose AI assistants, use bank-approved connections, limit the data an agent can see, and review any consequential action personally. Bank of America’s statement is its own stated position, and the Malwarebytes report notes it is not a universal ruling on consumers’ legal rights.
The lockout risk TechCrunch describes is the practical edge for anyone who has already connected an agent: a bank that reads automated logins as an account takeover can restrict the account, and its stated liability position leaves the customer holding the loss.
Banks are not the only companies drawing a line. Cybernews reports that Amazon blocks unauthorized AI agents from shopping or browsing on behalf of users and warns that continued access violates its Conditions of Use. Meanwhile Meta launched a personal agent in early September that can browse, fill out forms and make purchases, with coverage of up to $1,000 per claim. Fortune adds that Meta’s Muse connects to financial accounts through Plaid, which complicates its finance features if banks restrict agent access, and that Meta declined to say how it would respond.
Jim Bianco and the question of profits
The sharpest challenge came from Jim Bianco, president of Bianco Research, on the Unchained livestream Bits + Bips on October 26. He asked whether banks are protecting customers or protecting their own profits, and said that now that customers can do this, banks fear losing a revenue stream. In a follow-up Unchained piece, his position is summarized as saying the restriction is really about $4 trillion in zero-yield accounts that an agent could sweep into a money market fund.
Malwarebytes argues that security and revenue motives can both be true at once, and the evidence in the public record supports that reading. Dimon cites rogue agents and risk to clients, and Fortune notes the move followed security incidents, including a Cloud Security Alliance note describing three open-source agents that allegedly breached at least 27 organizations and took more than 600,000 credit card records from two of them.
What no one has published is a count of blocked customers or the share of detected agents that were malicious. Axios, per Malwarebytes, reports that banks are still working out how to let customers use AI tools with their accounts at all, so the policy may change quickly. Without those numbers, Dimon’s claim of risk and Bianco’s claim about deposit yields can each be argued from the same quotes, and customers who linked an agent last month cannot tell from any bank’s statement which kind of access is being cut off.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
