Schwab and JPMorgan Block Outside AI Agents From Moving Customer Money

TL;DR

Charles Schwab and JPMorgan Chase said last week that they block outside AI agents, Meta's Muse among them, from logging in to customer accounts and moving money. Both keep a narrower lane open: JPMorgan lets agents read balances through connectors such as Plaid, Schwab plans read-only MCP servers, and some LLM connections already place trades at Schwab. The same week, reporting from The Verge and TechCrunch added Amazon, Yelp and Delta to the list of companies that turn personal agents away or admit only the ones that pay. If you build agents that act for consumers, plan for scoped, authenticated and sometimes metered access, because scraping a logged-in website on the user's behalf is getting shut down.

What the banks said

JPMorgan went first. On the bank's third-quarter earnings call on Tuesday, October 13, CEO Jamie Dimon said the bank is "not going to allow just any outside agent to come inside the company." He added: "You don't want rogue agents, and there could be thousands of them." He framed the problem as a question of who eats the loss, telling customers who use outside agents to understand the "liability transfer," PYMNTS reported.

A JPMorgan spokesperson told Fortune that the bank supports "secure, customer-authorized data sharing through open banking providers." In practice an agent can see balances if the customer links the account through a connector such as Plaid. It cannot send money or pay bills, and the bank gave no timeline for changing that.

Schwab CEO Rick Wurster said the same about his firm on Bloomberg Television on Friday, October 16, naming Meta's Muse as one of the agents being stopped. "We can't control it, the client can't control it, something could go wrong and who's liable?" he said, according to The Next Web. He gets a weekly report on the blocks, and the big agents are stopped "in the tens and twenties" each week. He read that low count as a sign that clients are not yet handing their accounts to AI.

American Banker spelled out what Schwab blocks: agents that log in with a client's credentials and agents that drive the site with browser automation. "We are not going to allow that," Wurster said. Some traders already connect certain LLMs to Schwab to complete trades, and he plans to let more clients and models trade, but not move money. The Next Web's account of the Bloomberg interview adds that Schwab plans to stand up Model Context Protocol servers so outside tools can check balances and do research under Schwab's rules.

Follow the cash

Security is the stated reason, and credential-sharing agents are a real risk. The business reason sits in Schwab's third-quarter filing. Clients had $492.8 billion in transactional sweep cash at the end of September, and net interest revenue was $3.48 billion of the quarter's $7.17 billion in net revenue.

A sweep account parks a client's uninvested cash at a bank, and the brokerage keeps much of the spread between what that cash earns and what the client gets. Letting an outside agent into that account is a bit like a casino letting you bring your own card counter: the agent's first job would be to find the idle cash and move it somewhere that pays more. Tim Welsh of Nexus Strategies told American Banker exactly that, and summed it up as: "An outside agent works for the client. Charley works for Schwab."

Wurster disputes the premise. He told American Banker that clients who use AI for trades hold more cash at Schwab, not less. Schwab also has its own agent ready: Charley, announced September 30, is rolling out in phases from October to eligible US retail clients. It is built on outside LLMs and Schwab's data. At launch it answers questions, looks up balances and positions, and handles a few account actions such as adding beneficiaries or updating contact details.

JPMorgan already charges for its read lane. The bank said in July 2025 that it would charge data aggregators for access to customer account data, and its renewed agreement with Plaid in September 2025 included pricing for the first time. Neither company disclosed the amounts, Bloomberg Law reported. So when Muse users link a bank through Plaid to share balances and transactions, the connection runs over a lane JPMorgan has already priced.

The rest of the web is doing the same

The banks are the newest names on a list that started forming in September. Amazon began blocking Muse around September 20, showing users a popup that read: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." Amazon's complaints were that Meta never told it Muse would visit, that the agent does not identify itself while shopping, and that it handles customer credentials in ways Amazon never agreed to.

TechCrunch asked around and got a mix of answers:

• Yelp does not allow non-human traffic unless the agent's operator pays through its data licensing program. A site built on strangers' opinions of restaurants now has a firm opinion about strangers' bots.
• Delta said it has no partnership that lets a third-party agent shop for or book its flights, and that it is still evaluating how agents could fit.
• United pointed to terms of use that bar any "robot, spider, other automatic device, or manual process" from monitoring or copying its site.
• Walmart, a Muse partner, said the failed purchases users hit were not intentional. The usual culprit was a human-verification button that ejects an agent when it gets interrupted.

The Verge added user reports of blocks against xAI's Grok, OpenAI's Dots and Instinct, plus sites such as Cars.com and Amtrak that used to work with agents and stopped. Anti-bot systems catch a lot of agents that no one meant to block, which makes deliberate policy and collateral damage hard to tell apart from the user's side.

Meta's counteroffer is a protocol

Meta's public line is that "turning away a personal agent means turning away the customer behind it." Its practical answer is the Personal Agent Protocol, previewed with Sierra on October 6. An agent finds a company's offerings through its website and can start a guest session. For account work, the customer signs in or uses credentials stored with the agent and chooses read-only or write access. Sessions run on OAuth, and the agent can connect through the website, the company's APIs (MCP and OpenAPI) or the company's own agent.

Genesys, Instinct, Rocket, Shopify, Stripe and Walmart are named partners. Sierra said a v0.1 specification would follow later in October. Payments that do not expose card details are on the list of future extensions, so the protocol does not yet cover the step the banks refuse to hand over.

The protocol and the banks want roughly the same arrangement: the agent identifies itself, the customer grants a scope, and the business decides what each scope can touch. The open question is who writes the rules for each scope, and whether access costs money.

What to do if you build agents

• Design for read first. Balance checks, research and comparison are the lanes banks keep open. Treat money movement as something you negotiate with each institution.
• Identify your agent. Amazon's first complaint was that Muse browsed without saying what it was. An agent that announces itself has something to negotiate with.
• Stop holding passwords. Schwab and JPMorgan both draw the line at agents logging in with customer credentials. OAuth scopes and aggregator connections are the routes they accept.
• Budget for access. Yelp charges agent operators, and JPMorgan charges the aggregators your agent may sit behind.
• Expect liability questions. Congress is still debating who pays when an agent gets it wrong, and until it decides, banks will keep that risk off their own books.

Key Takeaways

• JPMorgan (October 13) and Schwab (October 16) block outside AI agents, including Meta's Muse, from logging in to customer accounts and moving money.
• Both leave read access open: JPMorgan through connectors such as Plaid, Schwab through planned MCP servers and some LLM trading connections.
• Schwab held $492.8 billion in sweep cash at the end of Q3 and earned $3.48 billion of its $7.17 billion in net revenue from interest, much of it on cash an outside agent would try to move.
• Amazon blocks Muse outright, Yelp admits only agents whose operators pay, and Delta has no third-party booking partner yet.
• Meta and Sierra's Personal Agent Protocol proposes OAuth sessions with read-only or write scopes, with a v0.1 spec due later in October.

Sources: The Next Web, American Banker, Fortune, PYMNTS, Schwab Q3 2026 earnings release (SEC 8-K), Schwab: Meet Charley, Bloomberg Law, TechCrunch, The Verge, Gizmodo, Sierra: Introducing Personal Agent Protocol, Meta: Introducing Muse