JPMorgan bans outside AI agents from acting on customer accounts

JPMorgan Chase, the largest U.S. bank, will not let artificial intelligence (AI) agents from third-party companies act inside its customers' accounts. CEO Jamie Dimon announced this on October 13, 2026, during the bank's quarterly earnings presentation. In his view, the practice would be too risky for both customers and the bank. According to CNBC, consumer agents such as Meta's Muse or Instinct are affected.

Read-only, no transfers

A bank spokesperson told CNBC that JPMorgan does not allow third parties to collect its customers' banking credentials in order to log in on their behalf. The bank says it supports customer-authorized data sharing through open banking providers. In practice, according to reports from CNBC and Briefs, an agent can view information on a read-only basis (such as the balance) through a connector like Plaid. It cannot, however, move money or pay bills. The bank did not say when it might relax its position.

Jamie Dimon warned about “rogue agents,” agents behaving in an uncontrolled way that could number “in the thousands.” He says he is neither for nor against agents, and notes that the bank uses them internally and is developing its own tools. According to the Seoul Economic Daily, citing Forbes, he also stressed one point: customers must understand who becomes liable when they give an AI access to their information.

A commercial decision too

The decision comes as agents able to act on a user's behalf are multiplying. On September 20, Amazon had already blocked Muse on its shopping site, criticizing it in particular for not identifying itself and for appearing to store customers' credentials. Meta says Muse does not have access to their passwords. For banks, the issue goes beyond security. An agent that automatically moved savings to wherever they earn the most would threaten their low-interest deposits, a concern echoed by several economists. JPMorgan, for its part, is testing its own automated cash-placement tool.

Good practices

In Europe, third-party access to a payment account is governed by the second Payment Services Directive (PSD2). It requires using authorized providers and applying strong customer authentication. Handing your banking credentials to an AI assistant is still a bad idea: in the event of a fraudulent transaction, the bank could blame the customer for negligence. Before connecting an agent to a bank account, personal or business:

• favor read-only access through an authorized provider;
• never share your password or your authentication codes;
• check the agent's terms of use to see who is liable in case of error.