JPMorgan blocks outside AI agents from moving money in Chase accounts

What did JPMorgan say about outside AI agents?

JPMorgan Chase, the largest US bank by assets, reported its third-quarter 2026 results on 13 October, with net income of $15.3 billion according to its earnings release. The first analyst question on the call was not about rates or credit. Ebrahim Poonawala of Bank of America asked about the disruption risk from agentic AI and the challenge of deploying agents inside a bank “given the emergence of all the rogue agents”.

Chairman and chief executive Jamie Dimon answered that the bank uses agents internally “to do good things” and will use them for customers, but that it is “not against agents or for agents”. “They’re tools,” he said, according to a transcript of the call. He then drew the line that made headlines: “we’re not going to allow just any outside agent to come in inside the company because that’s just too risky for clients and for JPMorgan.”

After the call, a JPMorgan spokeswoman confirmed to CNBC that the bank currently blocks external AI agents from operating on behalf of retail customers. “Because it is not safe, we do not permit third parties to access accounts by obtaining customers’ banking credentials and logging in on their behalf,” she said.

What exactly is Chase blocking?

The block is aimed at a specific technique: an agent that takes a customer’s username and password and signs in to the Chase website or app as if it were the customer. This is the same credential sharing and screen scraping that banks have fought with data aggregators for years.

CFO Jeremy Barnum described it in those terms on the call. Some services that offer agents the ability to move money “do it through credential sharing, and we have a long record of being against that way of doing things, screen scraping, et cetera,” he said. “It’s not secure. To the extent that we’re able to block those, we are blocking them to protect customers and protect ourselves.”

Not every connection is cut off. The spokeswoman said the bank supports “secure, customer-authorized data sharing through open banking providers”. In practice, CNBC reports, an agent can still see some Chase data in read-only form, such as account balances, through Plaid or another approved connector. What it cannot do is send money or pay a bill, which are the actions that make a personal finance agent useful.

• Blocked: outside agents that sign in with the customer’s Chase credentials and act in the account.
• Still allowed: read-only data, such as balances, shared through authorised open-banking connections.
• Not yet available: a sanctioned way for outside agents to move money or pay bills; the bank gave no timeline.

Why does JPMorgan call outside agents too risky?

Dimon framed the issue as a defensive one. “You don’t want rogue agents, and there could be thousands of them,” he said, adding that the bank has “always been literally on the side of the client”. JPMorgan, he said, is building tools to protect customers who use agents.

The worry is easy to picture. An agent with a customer’s full login can do anything the customer can do, and it may act on instructions hidden in a web page or email it reads along the way. That is the problem described in our explainer on prompt injection. A bank cannot easily tell a trusted assistant from a compromised one, or from a fraudster using stolen credentials, when all of them arrive with the same password.

Other payment companies are trying to solve the same problem with rules rather than blocks. American Express this week published a framework to stop agents making purchases customers did not approve, built around recording what the cardholder actually intended. JPMorgan’s position is that, until something similar exists for its accounts, the safer default is to keep agents out.

What does the liability transfer warning mean for customers?

Both executives warned customers directly. “If people are using them, they should understand the risk,” Dimon said. “They should understand there’s a liability transfer. If data is being misused, they should understand it’s being misused.”

Barnum was more explicit. “It’s important that customers understand that if they give up their credentials to the agent and the agent does something that they don’t want, that’s going to be on them, and that’s sort of not an ideal state of things,” he said. “We are working on being able to do this correctly.”

The executives did not spell out the legal basis for that view, and AI Lookout is not offering legal advice. But the practical message is clear: if you give an AI agent your banking password and it moves money you did not want moved, do not assume the bank will treat it like an unauthorised transaction by a stranger. Check your bank’s terms before connecting any agent to an account.

Is this also about deposits and competition?

Partly, yes. Barnum said a couple of personal agent releases this quarter “have really gotten a bunch of attention in the market” and that bank stocks reacted. CNBC notes that bank shares fell in September after Meta’s Muse assistant topped app download charts, on fears that consumers would let agents sweep money from low-yield accounts into higher-yield ones. OpenAI followed weeks later with Dots, its always-on agents.

Barnum argued that the threat is not new. He described personal agents as the meeting point of two old pressures: yield-seeking money that moves when rates change, and fintechs that offer better digital experiences. “That doesn’t mean that we’re complacent about it. We’re spending a lot of time on it,” he said, while pointing to the bank’s branch network, product range and customer trust as advantages.

Asked by Evercore ISI’s Glenn Schorr whether agents moving cash could make deposit runs faster, Barnum said he was “a little bit less persuaded” that the technology creates cliff effects. Dimon said the bank holds $1.5 trillion in cash and marketable securities, but that regulators should be thinking about agents: “If I was a regulator, I’d try to be prepared for that.”

CNBC also likens the stance to JPMorgan’s earlier fight with data aggregators such as Plaid, when the bank moved to charge for access to customer data. Then as now, the bank framed its position as security; critics framed it as control over customer relationships.

How is JPMorgan using AI agents itself?

JPMorgan is building its own version. Barnum said Smart Cash, a tool CNBC describes as predicting a customer’s cash flow and moving funds to maximise yield, went live “as of the last couple weeks” as “a targeted pilot type thing”. It is the bank’s own agent doing the job outside agents want to do.

On internal AI, Barnum said the benefits “aren’t observable in our current quarterly earnings”. He corrected an earlier public figure, saying the bank’s AI spending had been “something like $700 million annually” rather than $2 billion, and said he is moving away from putting a number on the benefits. He described experiments in rewriting legacy tools with AI in a couple of weeks that “didn’t work perfectly”, and said some gains will be offset by token costs.

To keep those costs down, Barnum said the bank’s strategy is “model agnosticism, harness agnosticism”, including running open-weight and open-source models, some in its own data centres. Dimon added that model-routing tools will send each query to “the best, quickest, cheapest” model rather than the most expensive one.

What are the limits and open questions?

Much is still unclear. Neither executive described how Chase detects and blocks agents, how it tells an AI agent apart from a person using a password manager or a legitimate aggregator, or whether customers will be warned when a connection is refused. The bank gave no timeline for the “agentic connections” it says it is committed to enabling.

The block applies to retail customers, according to the spokeswoman; the bank did not describe its policy for business or institutional clients. The comments came on an earnings call and in a short statement, not in a published policy, so details may change as the bank builds its own tools.

For agent makers, the message is that the biggest US bank will not be scraped. Shopify took the opposite approach this week by opening its Shop catalogue and checkout to any AI agent through a sanctioned interface. Banks may end up in the same place, but on their own terms. If you are new to how these assistants act on your behalf, our guide to AI agents covers the basics.