JPMorgan Says It Is Blocking Outside AI Agents From Directly Accessing Chase Accounts

• JPMorgan executives said the bank will not allow arbitrary outside agents to come inside its systems because of risks to customers and the firm. ^[1]
• The restriction concerns agents that receive customer credentials or otherwise access accounts to perform tasks, including money movement; JPMorgan did not disclose a product-by-product block list. ^[1]^[2]
• The bank did not say whether customer-authorized API or open-banking connections are being disabled, nor did it announce a replacement authorization process. ^[1]^[2]
• JPMorgan says it uses agents internally, plans to use them for customers and is building defensive tools to detect or contain rogue activity. ^[1]^[3]

JPMorgan Chase says it is blocking outside artificial-intelligence agents from directly accessing customer accounts, drawing a line between bank-controlled tools and agents that enter its systems on a customer’s behalf.

Chief Executive Jamie Dimon said during JPMorgan’s third-quarter earnings call on October 13, 2026, that the bank would not allow “just any” outside agent to come inside the company because it was too risky for customers and JPMorgan. Chief Financial Officer Jeremy Barnum said the bank was blocking such access where it could. [1]

What JPMorgan has confirmed #

The bank’s comments concern external agents that access customer accounts and potentially perform actions such as moving money. Barnum said customers who give an agent their credentials could face the consequences if it takes an action they did not want. [1]

The reported examples are Meta’s Muse and Instinct, two personal-agent products designed to complete tasks across websites and services. But JPMorgan has not released a public list of blocked agents, technical indicators or affected account categories. [2]

That makes the exact enforcement mechanism unclear. The public record supports a restriction on credential sharing, direct login and screen-scraping-style access; it does not establish that every form of customer-authorized financial-data connection has been shut off. [1][2]

A restriction, not a published open-banking policy #

JPMorgan did not say whether existing connections through open-banking providers remain available, whether they are limited to read-only data or whether any provider-specific permissions have changed. It also did not announce a new process through which an outside agent could receive narrowly scoped authority to initiate transactions. [1][2]

That distinction is important. An agent that logs in with a customer’s password creates a different security and liability model from one that receives a time-limited authorization, accesses defined data or submits a transaction subject to bank controls.

The Financial Data and Technology Association, a trade group representing financial-data access companies, has called for scoped authorizations, audit records and clearer liability rules for agent-initiated transactions. Those are industry recommendations, not a JPMorgan commitment. [4]

JPMorgan is building its own controls #

Dimon said JPMorgan already uses agents internally and expects to use them for customers. He also said the bank is building tools to protect customers from rogue agents and to address the risks created when people delegate access to them. [1]

JPMorgan has separately described an approach based on runtime governance, identity and access controls, monitoring and containment. Its payments division has said high-risk agent actions should be subject to enforceable controls, including pre-execution blocking, task termination and human alerts. [3][5]

The bank’s position is therefore not a rejection of agentic software. It is a preference for agents operating inside an environment JPMorgan controls, where the bank can determine what the tool may see and do. That conclusion follows from management’s stated distinction between internal use and outside agents, rather than from a published product roadmap. [1][3]

Why access method matters #

Security researchers say the problem extends beyond whether an agent can authenticate. Zibi Braniecki, a Perplexity researcher quoted by Axios, said securing agents requires conventional zero-trust practices alongside controls designed for systems that can act flexibly and autonomously. [6]

The International Monetary Fund has identified authorization traceability, opaque decisions, correlated agent behavior, cybersecurity and unresolved liability as risks in agentic payment systems. [7]

For Chase customers, the immediate confirmed impact is limited to the access method JPMorgan described: outside agents are not being welcomed into the bank’s systems as unrestricted delegates, and customers are warned that handing over credentials can shift risk onto them. The bank has not said when, or under what technical standard, it might permit broader third-party agent access. [1][2]

Companies mentioned #

Further sources #

The stories that matter, in one email. Free — unsubscribe anytime.