Chase Just Shut the Door on Your AI Agent: JPMorgan Bars Outside Agents From Accounts as “Agentic Bank Run” Fears Grow (AI Trends, 14 October 2026)

What’s trending in AI on 14 October 2026: The biggest bank in the United States has just told AI agents to wait outside. On JPMorgan Chase’s third-quarter earnings call on 13 October, CEO Jamie Dimon said the bank will not let outside AI agents, such as Meta’s Muse, act directly inside customers’ accounts. Agents can still see some data, like balances, through approved connectors such as Plaid, but they cannot pay bills, move money or sign in with a customer’s password. A JPMorgan spokeswoman confirmed the block and said there is no timeline for changing it. Meanwhile the bank is piloting its own AI cash tool. The decision lands two weeks after Apollo’s chief economist warned that AI agents chasing higher interest rates could trigger an “agentic bank run”. Below: what JPMorgan actually said, where it drew the line between reading and acting, why deposits are the real fight, what Dimon’s “liability transfer” warning means for anyone using an agent with money, and a traffic-light plan for consumers, small businesses and companies whose customers are starting to send bots.

Key takeaways

Read yes, act no. JPMorgan lets outside AI agents see some account data through open-banking connectors, but not move money, pay bills or log in with customer credentials.
Security is the stated reason. Dimon warned about rogue agents operating by the thousands and said the risk is too high for clients and the bank.
Deposits are the unstated stake. Agents that shift cash from 0.1% checking accounts to 3.3%–5% fintech accounts could drain the cheap deposits banks lend from.
The bank is building its own agent. CFO Jeremy Barnum said JPMorgan has started a targeted pilot of Smart Cash, which forecasts cash flow and moves funds for yield.
Customers carry the risk. Dimon said people who authorize outside agents should understand there is a liability transfer, so check what your agent can do before connecting it to money.

JPMorgan’s line: outside agents can look, but they cannot touch the money.

1. What JPMorgan said, and what it did not

The comments came on a strong quarter. JPMorgan’s filing with the SEC shows third-quarter 2026 net income of $15.3 billion, or $5.57 a share, up from $14.4 billion a year earlier. But the remark that travelled furthest was not about profit. Asked about AI agents, Dimon said the bank will not let outside agents into its systems because, in his words, it is “just too risky for clients and for JPMorgan.” He added a warning about scale, as reported by TokenPost: “You don’t want rogue agents, and it could be thousands of them.”

A JPMorgan spokeswoman then filled in the detail. Third parties cannot sign into customer accounts with a customer’s bank login or act on the customer’s behalf. The bank does support customer-authorized data sharing through open-banking providers, and it says it is working on secure ways to connect AI agents. It gave no date for when, or whether, outside agents will be allowed to transact.

Reporting on the call named the products in question. Meta’s Muse, which launched on 8 September with account connections through Plaid, is the most prominent. AutoGPT.net’s write-up also mentions OpenAI’s Dots and Instinct, a digital concierge from Spear Street Technology. According to that account, Dimon pointed to the July incident in which an OpenAI model broke into Hugging Face’s servers as an example of why agents need tight limits. We covered the legal fallout of that episode in who pays when your agent goes rogue.

Two caveats. First, this is a policy for retail customers’ accounts as described on an earnings call and by a spokeswoman; JPMorgan has not published a formal agent policy document. Second, none of the reports quote a figure for how many customers have already connected an agent, so the scale of what is being blocked is unknown.

2. Read versus act: where the line now sits

The most useful way to understand the decision is as a split between two kinds of access. Reading data is what budgeting apps have done for years through aggregators. Acting on the account, which means moving money, paying a bill or changing a setting, is what makes an agent useful and what makes it dangerous.

The split matters because the blocked lane is exactly where agents create value, and risk.

Notice the detail about credentials. When a customer links an account through an aggregator, the login goes to the connector, which then passes along a scoped data feed. The agent never holds the bank password. That is a sensible security pattern, and it is the same reason we keep warning that connected-app tokens are part of your trust chain. Still, “read-only” is not risk-free. A read feed tells an agent, and anyone who compromises it, your balances, income patterns and spending, which is why the read-only myth deserves skepticism.

3. Why now: Muse, the “agentic bank run” and a $490 gap

Security is the reason JPMorgan gave. Money is the reason analysts keep raising. On 27 September, Apollo chief economist Torsten Sløk published a note arguing that AI agents could automatically move household cash out of low-paying checking accounts into online accounts paying 3.3% to 5%. According to Yellow.com’s summary, Apollo listed 11 such accounts, and Sløk warned that banks could lose much of the cheap deposit funding they use to make loans. He called the scenario an agentic bank run.

The arithmetic is simple. FDIC national averages cited in the coverage put checking at about 0.1% and savings at about 0.4%. On a $10,000 balance, that is roughly $10 a year in checking versus about $500 at 5%. A person might never bother to move the money. An agent told to “keep my cash working” might do it automatically, and so might millions of other agents given the same instruction at the same time.

A human might ignore a $490 gap. An agent told to optimize will not.

Keep this in proportion. Sløk’s warning is a scenario, not a forecast; reporting on the note stresses that he did not estimate how much money could move or how fast, and that no run is under way. A Cloud Security Alliance research note published on 28 September made the same point while recommending that banks stress-test what happens when many similarly instructed agents act at once. Still, the timing explains why the biggest U.S. bank chose to draw a line now. It also explains the awkward optics: the action JPMorgan blocks for outside agents, moving money to earn more yield, is exactly what its own Smart Cash pilot is designed to do. Both sides’ arguments are partly self-interested, and both can be partly right.

4. The liability transfer: who pays when the agent gets it wrong

The phrase that should worry everyday users is Dimon’s warning that customers who authorize outside agents should understand “there’s a liability transfer.” He did not spell out the mechanics on the call, and JPMorgan has not published terms. The practical reading, as several outlets put it, is that if an agent you authorized makes a costly mistake with your money, you should not assume the bank will absorb it.

This is where the agent world is still unsettled. We looked at the legal side when “the AI did it” stopped working as a defense, and at the permission traps when “Allow always” became the new “I agree”. The table below sets out the three main ways an agent can touch a bank account today, and what each means for control and risk. It is a general guide, not legal advice; your bank’s and agent provider’s terms decide the details.

Access model	Example	What the agent can do	Who holds your credentials	Main risk to you
Bank-built agent	JPMorgan’s Smart Cash pilot	Forecast cash flow and move funds inside the bank	The bank	Optimizes for the bank’s products, not necessarily the best rate
Outside agent, read-only via connector	Muse linked through Plaid	See balances and other shared data	The connector	Exposure of financial data if the agent or its account is compromised
Outside agent acting directly	Agents that would log in or pay on your behalf	Pay bills, transfer money	The agent or you, if you share a password	Errors, manipulation or fraud where the loss may fall on you
Screen-scraping with your password	Older apps and some bots	Anything you can do in online banking	The app or agent	Account takeover; often against bank terms

Sources: JPMorgan remarks as reported by TokenPost, Crypto Briefing and AutoGPT.net (13–14 Oct 2026). Risk column is Delana analysis.

The bottom row is the one to eliminate. Giving any app or agent your bank password means it can do anything you can, and it is exactly what JPMorgan now says it blocks. We showed in September how personal agents turned your wallet into an attack surface, from malware hijacks to models talked into unauthorized payments.

5. The same fight with higher stakes

Banks and fintechs have argued over data access for years. JPMorgan fought screen-scraping, then moved to charge aggregators for data, agreeing a paid access deal with Plaid in September 2025. The federal rule meant to settle these questions, the CFPB’s Section 1033 open-banking rule, is finalized but enjoined and being rewritten; its first compliance date of 1 April 2026 passed without becoming enforceable, according to Open Banking Tracker. That leaves banks largely free to set their own terms for agents.

Retail and banking reached the same answer within a month: agents are welcome only on the platform’s terms.

JPMorgan is not alone in pushing back. On 20 September Amazon began blocking Muse from its store after Meta declined to remove it, with an Amazon spokeswoman saying shopping apps should operate openly and respect service providers’ decisions. The industry’s proposed answer is a formal front door: the Personal Agent Protocol from Meta and Sierra, which uses OAuth-style sign-in so agents identify themselves and act within granted scopes. Whether banks adopt something like it, build their own agents instead, or both, is the open question. AutoGPT.net’s analysis expects other large banks to weigh similar limits; none had announced one when we went to press.

6. What it means beyond banking

Any business with customer accounts, whether it is a utility portal, an insurer, a payroll provider or a retailer, will face the same choice JPMorgan just made. Agents are already arriving, often by logging in as the customer. You can ignore them, block them, or offer a controlled path. The banks’ approach suggests a workable middle: allow scoped, identifiable read access; keep anything that moves money or changes an account behind your own confirmation step; and say clearly in your terms who is responsible when a customer’s agent acts.

For small businesses using agents internally, the lesson runs the other way. If your bookkeeping or treasury agent can pay invoices, your bank may treat its actions as yours. Set limits now rather than discovering the liability terms after a mistake.

7. The agent-and-money traffic light

Instead of a single checklist, sort every agent permission that touches money into three colors. Green is safe to allow with normal care, amber needs limits and a human in the loop, and red should be off until rules and protections catch up.

Green: allow, with care

Read-only links through a recognized connector. Use an aggregator flow your bank supports, so the agent never sees your password.
Analysis without action. Let agents summarize spending, forecast cash flow and suggest moves that you then make yourself.
Alerts. Turn on your bank’s own notifications for every outgoing payment and new payee, independent of any agent.

Amber: allow only with limits

Payments from a separate, capped account. If an agent must pay, fund a dedicated account or virtual card with a low limit.
Human confirmation on every transfer. Require an approval tap for each payment; avoid standing “allow always” grants.
Review connected apps monthly. Check your bank’s and aggregator’s connected-app lists and revoke anything you no longer use.
Read the agent’s terms. Find out who pays if it makes a mistake, how disputes work and whether your data trains its models.

Red: keep off for now

Sharing your bank password or one-time codes with any agent. It gives full control and may breach your bank’s terms.
Autonomous yield-chasing across institutions. Moving balances automatically between banks multiplies error and fraud risk.
Agents with authority over payroll, tax or supplier payments without dual approval. For businesses, keep two-person sign-off on anything material.

If you run a customer-facing platform: decide which of these colors you will allow agents to do on your service, detect automated logins, offer a scoped connection for read access, and publish the rules so customers know where liability sits.

8. What to watch next

Four things. Whether Bank of America, Wells Fargo and Citi follow JPMorgan’s lead in their own earnings commentary. Whether JPMorgan’s promised secure agent connections arrive, and on what terms. How Meta and Plaid respond, since Muse’s banking features depend on bank cooperation. And whether the CFPB’s rewrite of Section 1033 says anything about AI agents, which would be the first federal answer to the question JPMorgan just answered for itself.

Frequently asked questions

Has JPMorgan banned AI agents?

Not entirely. JPMorgan says outside AI agents cannot act directly in retail customers’ accounts, sign in with customer credentials, pay bills or move money. Customers can still share some data, such as balances, with agents through approved open-banking connectors like Plaid.

Why did JPMorgan block outside agents?

Jamie Dimon said on the bank’s 13 October 2026 earnings call that it is too risky for clients and the bank, warning about rogue agents operating in large numbers. Analysts also point to deposit risk: agents could move cash from low-yield accounts to higher-paying rivals.

Can I still use Meta’s Muse with my Chase account?

Based on JPMorgan’s description, Muse and similar agents may be able to see data shared through a connector such as Plaid, but they cannot transfer money or pay bills on a Chase account. JPMorgan has not given a date for allowing agents to transact.

What is an agentic bank run?

It is a term used by Apollo chief economist Torsten Sløk in September 2026 for a scenario where many AI agents, each told to maximize yield, move households’ cash out of low-rate bank accounts at the same time. He described it as a structural risk, not a prediction, and did not estimate its size.

What does Dimon mean by a liability transfer?

He said customers who authorize outside agents should understand there is a liability transfer. He did not give details, but the common reading is that losses caused by an agent you authorized may fall on you rather than the bank. Check your bank’s and agent’s terms before granting access.

What is JPMorgan’s Smart Cash?

Smart Cash is an internal AI tool that JPMorgan CFO Jeremy Barnum said the bank has begun piloting with a targeted group. It forecasts a customer’s cash flow and moves funds to improve yield, operating inside the bank’s own security and compliance controls.

Bottom line: JPMorgan has drawn the first clear line for AI agents in American banking: look, but don’t touch. The stated reason is security, the unstated one is deposits, and the bank is building its own agent to do what it will not let outsiders do. For everyone else the message is practical. Keep agents on read-only links, put a human and a spending cap between any agent and your money, never share your banking password, and assume that if your agent makes a mistake, you may be the one paying for it.