Major US banks restrict AI agents using customer logins

Major US banks are moving to block AI agents that access accounts with customer-provided login details, according to reporting cited by The Decoder. The clampdown matters for anyone building finance workflows around browser-based agents, because banks are signaling that agent access without explicit approval is not the same as a customer logging in personally.

Banks draw a line around credential-based agents

Several large US banks, including Morgan Stanley, JPMorgan, Bank of America and Wells Fargo, are restricting outside AI agents that use customer credentials to enter accounts, Axios reports, according to The Decoder. The issue is not simply that an automated system is involved; the banks’ policies require account holders to sign in themselves.

The Decoder reports that Morgan Stanley already blocks AI agents outright, while JPMorgan, Bank of America and Citi are taking the same approach. Morgan Stanley also said it has not detected any “rogue AI agents” on its platforms.

Banks are concerned that some agents may operate without a user giving a direct instruction each time. Another problem, according to the report, is that many banks cannot reliably distinguish between an agent acting for a customer and an agent accessing an account on its own.

For creators, freelancers and small businesses, the immediate takeaway is practical: if a finance assistant or agent depends on logging into a bank website through a browser, it may stop working or become unreliable. That is especially relevant for workflows that try to collect balances, summarize transactions or prepare finance tasks by navigating consumer banking sites.

Read-only access looks like the likely compromise

The banks reportedly want AI agents limited to viewing information, not taking action inside accounts. In other words, read-only access is emerging as the safer model: an agent could see account data, but not move money or execute tasks.

That compromise reflects a familiar tradeoff in automation. Users want assistants that can reduce admin work, but banks are responsible for limiting account risk. The report says banks acknowledge that customers want to use AI agents, while also saying the current security risks are too high.

This is where the distinction between “looking” and “doing” becomes important. A read-only finance workflow can still be useful for summarizing account activity, supporting cash-flow reviews or helping prepare reports. But workflows that require the agent to click through banking actions are likely to face more resistance.

OpenAI has launched a dedicated ChatGPT service for financial tasks in the US with read-only access to financial data, according to The Decoder. That detail points to where the market may be heading: sanctioned access paths that let assistants analyze financial information without giving them full control of an account.

Browser agents are harder to police

Blocking agent access is not straightforward. The Decoder notes that users can still give agents access through a browser, using tools such as Computer Use or open-source agent software including OpenClaw.

That creates a difficult enforcement problem for banks. If an agent behaves like a user operating a browser session with valid credentials, the bank must decide whether it can identify and stop that activity without blocking legitimate customers. The report says provider-side blocking will be hard.

This also explains why the issue is bigger than banking. Emonarc has covered similar friction as websites push back on AI agents used for booking and shopping, and as companies look for tighter ways to govern agent access. The banking response is more sensitive because the account data and possible actions are financial.

For teams experimenting with agents, this is a warning against treating browser access as a stable integration layer. If a workflow depends on an agent signing in with a human’s username and password, it may conflict with provider policies and could be blocked without the workflow itself changing.

What small businesses should do now

The safest near-term posture is to separate finance automation into two categories: information gathering and account actions. The first is more likely to fit the direction banks are describing. The second is where restrictions are most likely to bite.

A practical checklist for agentic finance workflows:

• Avoid giving an agent unrestricted bank login credentials.
• Prefer read-only data access where available.
• Keep human approval in place for any account action.
• Expect browser-based bank workflows to become less dependable.
• Review whether an assistant is acting only when directly instructed.

The story also connects with broader efforts to create safer agent login models. For example, 1Password has introduced agent logins designed to keep passwords hidden from AI, while Amex has described an intent framework for AI shopping agents. Those approaches differ from bank account access, but they share the same underlying question: how can a service know what an agent is allowed to do?

For now, the message from major banks is clear enough: customer credentials are not a blanket permission slip for AI agents. Until approved access models become more common, finance agents are more likely to be treated as viewers than operators.