Schwab, JPMorgan and Citi Block AI Agents That Log In With Your Password

Charles Schwab, JPMorgan, Citigroup and Bank of America have moved to block AI agents that log into customer accounts using shared passwords, while keeping customer-authorized open banking access open. Schwab CEO Rick Wurster said the firm rejects agents like Meta's Muse because "we can't control it, the client can't control it," and JPMorgan's Jamie Dimon warned of a "liability transfer" when customers hand credentials to an agent. Sierra has published a draft Personal Agent Protocol (Poppy) that lets agents identify themselves to companies via a discovery file and short-lived OAuth tokens, a route the banks have not closed.

Every week, Charles Schwab's CEO gets a report on AI agents his firm turned away. According to Forkast https://forkast.news/schwab-and-jpmorgan-block-unauthorized-ai-agents-from-moving-money-as-private-ordering-reaches-financial-core/ , that report shows Schwab blocking "tens and twenties" of attempts by major AI agents to get at client funds. On October 16, CEO Rick Wurster named one of those agents on Bloomberg Television: Meta's Muse The Next Web https://thenextweb.com/news/schwab-blocks-ai-agents-meta-muse . Muse is the personal agent Meta launched in September. It runs in its own secure VM with its own browser, and it can fill out forms and negotiate for the person who set it up Meta https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/ . Wurster's objection was short: "We don't want someone just giving their password to Muse" Oninvest https://en.oninvest.com/article/citi-and-bofa-block-ai-agents-from-client-accounts-amid-fears-of-deposit-outflows . Schwab wasn't alone. Between October 13 and October 17, JPMorgan said much the same thing on its earnings call, and reports described similar limits at Citigroup and Bank of America. If you build agents that act for users, the banks have now told you which door is shut and which ones are still open. Read those statements side by side and a pattern shows up. None of the banks shut off customer-authorized data sharing through open banking. JPMorgan told Fortune: "We support secure, customer-authorized data sharing through open banking providers" Fortune https://fortune.com/2026/10/15/jamie-dimon-ai-agents-meta-muse-jpmorgan/ . Citi still allows read-only access through open banking. Schwab is building a read-only MCP route. What's shut is an agent that holds the customer's password and drives the bank's website, and anything that moves money. Barnum was specific about the first part: "some of the services that offer that do it through credential sharing," and "we have a long record of being against that way of doing things—screen scraping, et cetera" transcript https://www.webull.com/news/15741198075913216 . The second part is liability. Barnum said that if customers "give up their credentials to the agent and the agent does something that they don't want," then "that's going to be on them" transcript https://www.webull.com/news/15741198075913216 . Dimon put it this way: "There's a liability transfer. They should understand the liability transfer" Banking Dive https://www.bankingdive.com/news/jpmorgan-dimon-ai-agents-bank-customers-liability-transfer/832870/ . That is the sentence to show your product and legal people before you ship a feature that logs into a bank. Be fair to Muse here. Meta built it with guardrails: shared credentials sit in secure storage that Muse can use without seeing, a separate Sentinel agent must approve anything Muse sends to the internet, and Muse asks for approval before a purchase Meta https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/ . Wurster's point was control: "We can't control it, the client can't control it, something could go wrong and who's liable?" The Next Web https://thenextweb.com/news/schwab-blocks-ai-agents-meta-muse . There are three routes that none of these banks closed. Part of the control problem Wurster describes is that a bank can't tell an agent from the customer whose password it holds. On October 9, Sierra published a draft protocol, announced with Meta, aimed at exactly that: the Personal Agent Protocol, or Poppy Sierra https://sierra.ai/blog/poppy . In Sierra's words: "The personal agent identifies itself, so the company always knows when an agent is acting for a customer" Sierra https://sierra.ai/blog/poppy . The mechanics are familiar web plumbing. A company publishes a discovery file at /.well-known/poppy.json , the customer signs in with OAuth, and the agent gets a short-lived session token that carries only the access the customer approved Sierra https://sierra.ai/blog/poppy , spec site https://personalagentprotocol.org . The draft's example discovery file has this shape. The field names come from the draft; the values here are placeholders: { "protocol version": "0.1", "organization": { "name": "Example Bank", "domain": "bank.example.com" }, "auth": { "issuer": "https://auth.bank.example.com", "direct": { "scopes": "poppy:read" } }, "agent": { "protocols": { "type": "poppy", "endpoint": "https://bank.example.com/poppy" } } } The draft's example uses two scopes, poppy:read and poppy:write . The company decides which scopes a sign-in allows, and the customer picks on the company's own sign-in page whether the agent can view, make changes, or both spec site https://personalagentprotocol.org . Your agent can check whether a site supports Poppy with one request: curl -fsS https://bank.example.com/.well-known/poppy.json Keep expectations in check. The spec is a 0.1 draft heading toward 1.0 spec site https://personalagentprotocol.org , and Sierra says it will publish a reference implementation within a month of its October 9 announcement Sierra https://sierra.ai/blog/poppy . Bank of America, Wells Fargo, Visa, Mastercard, PayPal and OpenAI are among the design partners Sierra https://sierra.ai/blog/poppy . So one of the banks restricting agents this week is also helping design the identity layer. Being a design partner isn't a commitment to adopt, and as of this writing none of the four banks has said it will turn Poppy on. If your agent touches anyone's money, five changes follow from what the banks said. This is engineering guidance, not legal advice: talk to counsel before you write liability terms for anything that moves money. Would you let an agent move money from your account if the bank could see it was an agent? Or does a human tap on every transfer stay non-negotiable for you? Tell me in the comments. The banks drew their line around three things agent builders deal with every day: what an agent is allowed to touch, when a human has to approve, and what happens when a call gets refused. The AI Agents Pocket Guide https://www.amazon.com/dp/B0GYJZ2XJD is about those patterns: agent loops and the guardrails you put around them. I also build Hermes IDE https://hermes-ide.com/download , a free, source-available IDE for running Claude Code, Codex and other coding agents on macOS, Windows and Linux. It's on GitHub https://github.com/hermes-hq/hermes-ide , and it isn't affiliated with any agent vendor.