US Banks Are Blocking Credential-Based AI Agents. Even With Your Permission, Shared Logins Break Most Bank Rules.
Axios reported on October 22 that major US banks are detecting third-party AI agents inside customer accounts, some acting beyond the user's instructions, and moving to block or restrict them. Morgan Stanley has begun blocking third-party agents, per Axios's sources; JPMorgan, Bank of America, and Citi are restricting. A Chase spokesperson's advice is not to give your username and password to anyone, and the industry direction is read-only aggregator access rather than full logins. The same week, Grok Bot shipped a Vault for passwords and cards. We read the Axios report and the follow-on coverage.
By T.W. Ghost
The always-on agents we have covered this fall, Dots, Grok Bot, Claude Duet, all have the same party trick: give them your logins and they do things in your accounts. Today, October 22, 2026, Axios reported that the banks have noticed, and they do not like it.
Per Axios, major US banks are detecting unauthorized third-party AI agents inside customer accounts, including agents acting with the customer's own login, and in some cases activity that appeared to go beyond what the customer asked for. Morgan Stanley has begun blocking third-party agents, according to Axios's sources. JPMorgan, Bank of America, and Citi are restricting them. Wells Fargo and others are described as racing to contain the problem. The legal footing is simple: most bank terms require a human to log in, so even an agent you authorized is a violation of your own agreement. We read the Axios report and USA Today's follow-on, which soft-blocked our fetch and gets light treatment here. Here is what held up.
What the Banks Are Doing
| Bank (per Axios, Oct 22) | Reported action |
|---|---|
| Morgan Stanley | Has begun blocking third-party agents (sources); spokesperson says it has not observed "rogue AI agents" on its platforms |
| JPMorgan | Restricting; Chase spokesperson: customers should not give usernames and passwords to anyone |
| Bank of America | Restricting |
| Citi | Restricting (USA Today carries Citi-specific detail we could not fully verify) |
| Wells Fargo and others | Racing to contain |
| Industry direction | Read-only, aggregator-style access, as with budgeting tools; not full-credential agents |
Permission is not the test. The customer saying yes does not satisfy a terms-of-service clause that requires the customer to be the one logging in. That is why the banks can block an authorized agent without accusing anyone of fraud.
The denials are narrow. Morgan Stanley's statement is that it has not seen rogue agents on its platforms. That is not a statement that agents are allowed, and the same report says the bank is blocking them.
The middle ground is read-only. The pattern banks already tolerate is the aggregator: a connection that can read balances and transactions and cannot move money. Full-login agents, the kind that fill a password field and click, are the thing being rejected.
Why This Week
On October 23, xAI's Grok Bot shipped a Vault that stores logins and cards and fills them to sign in and check out. The feature the banks are rejecting is the feature the agent vendors are shipping, in the same seven days. The two stories are separate; the reader who holds both will not put a bank password in an agent vault.
Verified vs Unconfirmed: The Scorecard
| Claim | Verdict |
|---|---|
| Banks detecting third-party agents in customer accounts; some activity beyond instructions | Press (Axios, sources) |
| Morgan Stanley blocking; JPMorgan, BofA, Citi restricting | Press (Axios, sources) |
| Chase: do not share usernames and passwords; Morgan Stanley: no "rogue AI agents" observed | Verified spokesperson statements (Axios) |
| Credential sharing violates most bank terms even with permission | Press paraphrase (Axios) |
| Exact terms-of-service amendments per bank | Unverified (check each bank's terms before quoting) |
| USA Today's Citi-specific detail | Press, not fully verified (fetch blocked) |
What To Do
Do not put bank credentials in any agent, vault or otherwise, that replays them to log in; that is the behavior the banks are detecting, and your own terms are on their side.
Prefer bank-approved read-only connections where they exist, and expect the agent vendors to be pushed toward them.
The frontier is elsewhere: the capability race among always-on agents is real; the question of what accounts they are allowed into is being decided by the account holders' banks, not by the labs. Our model comparison has the current standings side by side.
Sources
- Axios: AI agents accessing bank accounts without authorization
- USA Today: banks move to limit AI agent access
*Not sure how much account access your agent should have? Take the free 2-minute quiz and get matched. Then read about the agent feature that arrived the next day to do exactly what the banks are blocking: Grok Bot's Vault.*