Banks Are Blocking AI Agents Until Someone Owns the Liability

Major US banks are detecting and deleting unauthorized AI agents that take actions inside customer accounts, and some of those agents appear to have attempted things their users never asked for, according to a Reuters report on Oct 22 that cited Axios. JPMorganChase, Citigroup, Bank of America and Charles Schwab have each drawn the same line: an AI agent may read your balance, and it may not move your money. Banks blocking AI agents has become weekly work, ahead of any law that settles who pays when an agent gets something wrong.

Charles Schwab CEO Rick Wurster put a number on it. Speaking to Bloomberg Television on Oct 16, he said Schwab blocks unauthorized outside agents in the tens each week, Meta's Muse among them, a personal agent that can book, buy and negotiate for its user. The mechanism, he said, is clients handing their login credentials to the agent. Then he asked the industry's question.

"We can't control it, the client can't control it, something could go wrong and who's liable?" Rick Wurster, CEO, Charles Schwab

Banks are writing the agent rule one block at a time

Side by side, the month's statements add up to a policy that no single document contains.

Reading is allowed, and moving money requires a person. Schwab's planned model context protocol (MCP) servers would give agents a sanctioned, read-only entrance in place of the borrowed key. Taken together, that is a rule with a boundary and a way to enforce it, written by risk teams and engineers at the speed the agents arrived.

Account rules were built around one question

The protections around a bank account were built to answer a single question: did the customer authorize this? There were two answers. Either you did it, or someone acting against you did, and a long body of law and practice says what happens next in each case.

An agent holding your credentials fits neither answer. You authorized the agent. You may never have authorized the specific thing it tried while you sat in a meeting, and to the bank that attempt looks exactly like you, because it logged in as you. I have written before about what an agent does when nobody is watching it, and courts are working through a related question, what authorization means when software does the logging in, in the Amazon and Perplexity case before the Ninth Circuit.

If you have ever typed your bank password into something other than your bank's own app, you know the small pause before you press enter. That pause is your own risk assessment, finished in about a second. Handing the password to an agent removes that pause from every transaction that follows.

Liability is the open question in every account

PNC Chairman and CEO William Demchak has been the most direct. Speaking with Fox Business's Liz Claman at Money20/20 in Las Vegas on Oct 19, he said:

"No [bank] is going to let people transact inside of accounts without a human in the loop." William Demchak, Chairman and CEO, PNC

He described the change that would be required as a "massive liability shift," one in which technology firms say they will own the liability for any customer their products harm.

Liability for AI agents is unresolved in the United States and under debate in Congress, and US and European regulators are already asking banks about AI agents and cyber risk. That deliberation is how durable rules earn legitimacy, and it runs on a calendar of sessions and hearings. Agent releases run on a calendar of weeks. I call this pattern rules written for a slower world: two clocks, each doing the job it was built for. It is the thread in everything I write on AI governance.

Meanwhile the banks picked the conservative default and enforced it themselves. A block list is a liability rule written in code.

I watched this pattern at Napster

Early in my career I worked at Napster, where software copied a song in seconds while the rules around music had been written for plastic discs moving through stores. The formal answer took years of courtrooms and licensing deals. What I took from those years: the first working rule usually comes from whoever has to keep the service running on Monday morning, and the formal rule that follows inherits much of its shape.

The read-only door is a draft the law can use

My own read is that the blocking is the headline and the read-only door is the story. A sanctioned entrance gives the agent an identity of its own, separate from yours. Once an agent shows up as itself, the bank can see what it does, and a future liability rule has something to attach to. This is the human-plus-agents stack arriving at the most personal place it could, the account that pays the rent.

When Congress and regulators settle who pays, they will be working from evidence that exists because banks counted these agents and logged what they tried. That record deserves a seat at the table, and so do the engineers who built it.

Two questions I am carrying into my own conversations; borrow them. If your company is putting agents in front of customers, where is your read-only door, and who signs for what happens behind it? If you are the customer, ask Wurster's question before you hand a password to anything: if this goes wrong, who is liable?

If you work on this in a bank, an agency or a legislature, I would welcome the conversation; I'm easy to find. Until the law decides who pays, keep the pause before you press enter. It is the oldest consumer protection you own.

Here is what makes Alex a credible voice on this topic: Alex worked at Napster when software first outran rules written for music on plastic discs, spent 20 years at Cisco shaping a $1.1 billion innovation portfolio, and now advises the California State University system on AI governance, so he has watched the first working rules for a new technology get written from inside both a startup and a global enterprise.

Bring Alex in to brief your leadership team on AI agents, liability and governance →