# Schwab, JPMorgan and Citi Block AI Agents That Log In With Your Password > Source: > Published: 2026-10-18 19:06:03+00:00 Every week, Charles Schwab's CEO gets a report on AI agents his firm turned away. According to [Forkast](https://forkast.news/schwab-and-jpmorgan-block-unauthorized-ai-agents-from-moving-money-as-private-ordering-reaches-financial-core/), that report shows Schwab blocking "tens and twenties" of attempts by major AI agents to get at client funds. On October 16, CEO Rick Wurster named one of those agents on Bloomberg Television: Meta's Muse ([The Next Web](https://thenextweb.com/news/schwab-blocks-ai-agents-meta-muse)). Muse is the personal agent Meta launched in September. It runs in its own secure VM with its own browser, and it can fill out forms and negotiate for the person who set it up ([Meta](https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/)). Wurster's objection was short: "We don't want someone just giving their password to Muse" ([Oninvest](https://en.oninvest.com/article/citi-and-bofa-block-ai-agents-from-client-accounts-amid-fears-of-deposit-outflows)). Schwab wasn't alone. Between October 13 and October 17, JPMorgan said much the same thing on its earnings call, and reports described similar limits at Citigroup and Bank of America. If you build agents that act for users, the banks have now told you which door is shut and which ones are still open. Read those statements side by side and a pattern shows up. None of the banks shut off customer-authorized data sharing through open banking. JPMorgan told Fortune: "We support secure, customer-authorized data sharing through open banking providers" ([Fortune](https://fortune.com/2026/10/15/jamie-dimon-ai-agents-meta-muse-jpmorgan/)). Citi still allows read-only access through open banking. Schwab is building a read-only MCP route. What's shut is an agent that holds the customer's password and drives the bank's website, and anything that moves money. Barnum was specific about the first part: "some of the services that offer that do it through credential sharing," and "we have a long record of being against that way of doing things—screen scraping, et cetera" ([transcript](https://www.webull.com/news/15741198075913216)). The second part is liability. Barnum said that if customers "give up their credentials to the agent and the agent does something that they don't want," then "that's going to be on them" ([transcript](https://www.webull.com/news/15741198075913216)). Dimon put it this way: "There's a liability transfer. They should understand the liability transfer" ([Banking Dive](https://www.bankingdive.com/news/jpmorgan-dimon-ai-agents-bank-customers-liability-transfer/832870/)). That is the sentence to show your product and legal people before you ship a feature that logs into a bank. Be fair to Muse here. Meta built it with guardrails: shared credentials sit in secure storage that Muse can use without seeing, a separate Sentinel agent must approve anything Muse sends to the internet, and Muse asks for approval before a purchase ([Meta](https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/)). Wurster's point was control: "We can't control it, the client can't control it, something could go wrong and who's liable?" ([The Next Web](https://thenextweb.com/news/schwab-blocks-ai-agents-meta-muse)). There are three routes that none of these banks closed. Part of the control problem Wurster describes is that a bank can't tell an agent from the customer whose password it holds. On October 9, Sierra published a draft protocol, announced with Meta, aimed at exactly that: the Personal Agent Protocol, or Poppy ([Sierra](https://sierra.ai/blog/poppy)). In Sierra's words: "The personal agent identifies itself, so the company always knows when an agent is acting for a customer" ([Sierra](https://sierra.ai/blog/poppy)). The mechanics are familiar web plumbing. A company publishes a discovery file at `/.well-known/poppy.json`, the customer signs in with OAuth, and the agent gets a short-lived session token that carries only the access the customer approved ([Sierra](https://sierra.ai/blog/poppy), [spec site](https://personalagentprotocol.org)). The draft's example discovery file has this shape. The field names come from the draft; the values here are placeholders: ``` { "protocol_version": "0.1", "organization": { "name": "Example Bank", "domain": "bank.example.com" }, "auth": { "issuer": "https://auth.bank.example.com", "direct": { "scopes": ["poppy:read"] } }, "agent": { "protocols": [ { "type": "poppy", "endpoint": "https://bank.example.com/poppy" } ] } } ``` The draft's example uses two scopes, `poppy:read` and `poppy:write`. The company decides which scopes a sign-in allows, and the customer picks on the company's own sign-in page whether the agent can view, make changes, or both ([spec site](https://personalagentprotocol.org)). Your agent can check whether a site supports Poppy with one request: ``` curl -fsS https://bank.example.com/.well-known/poppy.json ``` Keep expectations in check. The spec is a 0.1 draft heading toward 1.0 ([spec site](https://personalagentprotocol.org)), and Sierra says it will publish a reference implementation within a month of its October 9 announcement ([Sierra](https://sierra.ai/blog/poppy)). Bank of America, Wells Fargo, Visa, Mastercard, PayPal and OpenAI are among the design partners ([Sierra](https://sierra.ai/blog/poppy)). So one of the banks restricting agents this week is also helping design the identity layer. Being a design partner isn't a commitment to adopt, and as of this writing none of the four banks has said it will turn Poppy on. If your agent touches anyone's money, five changes follow from what the banks said. This is engineering guidance, not legal advice: talk to counsel before you write liability terms for anything that moves money. Would you let an agent move money from your account if the bank could see it was an agent? Or does a human tap on every transfer stay non-negotiable for you? Tell me in the comments. The banks drew their line around three things agent builders deal with every day: what an agent is allowed to touch, when a human has to approve, and what happens when a call gets refused. The [AI Agents Pocket Guide](https://www.amazon.com/dp/B0GYJZ2XJD) is about those patterns: agent loops and the guardrails you put around them. I also build [Hermes IDE](https://hermes-ide.com/download), a free, source-available IDE for running Claude Code, Codex and other coding agents on macOS, Windows and Linux. It's [on GitHub](https://github.com/hermes-hq/hermes-ide), and it isn't affiliated with any agent vendor.