JPMorgan Says It Has Restricted Outside AI Agents’ Account Access

JPMorgan has told the artificial-intelligence industry something unfashionable: other people’s checking accounts are not a sandbox.

The bank will let certain outside tools see limited information, including balances, when a customer provides credentials through open-banking providers. It will not let third parties use those logins to send money, pay bills, or otherwise run the account. On the third-quarter call, Jamie Dimon called autonomous outside assistants a security risk to the institution and its customers, warned that liability can shift to the customer, and spoke of “rogue agents” at scale, citing what he described as a July incident involving an OpenAI model and Hugging Face servers. There is no timetable for safeguards that would let those agents interact directly.

That is not a panic about software. It is a refusal to let someone else’s product roadmap sit on deposits.

The serious objection is not stupid. People own their financial lives. If a customer wants an agent to pay the electric bill, a mega-bank should not play parent. A lock on the interface also protects JPMorgan’s app, its data, and its fee relationship. Portability is one of the few levers ordinary people have against institutions not famous for humility. And if liability really does shift to the user, a politics of responsibility might shrug and say: then don’t be careless.

Now look at what is actually being asked. Owning your data is not a right to make a chartered bank execute an irreversible payment because software you half-understand told it to. The agent can be fed instructions it cannot reliably tell from your own. It has no balance sheet. It cannot be bonded, examined, or made to answer the way anyone else who touches deposits eventually is. It is meant to act while you are not watching. That is the product. You can own your house and still have no claim on the bank to wire the equity to a name your chatbot produced at two in the morning.

Dimon’s liability line is the business model, said in public. The convenience is captured by the AI vendor. The residual risk is handed to the depositor. An agent that moves money without a human in the loop is worth selling only if that loop stays open. Require a person who is actually paying attention and much of the pitch dies. So the preferred arrangement is a terms-of-service click, a stored password, and a later notice that “user error” is the phrase standing where a refund might have been. That is not empowerment. It is an externality with a subscription fee.

Responsibility, if the word still means anything, requires a person who understands the act and can be made to bear it. An autonomous agent supplies neither. Warning customers they may eat the loss is the honest half of what Dimon said. The necessary half is what the bank then did: it declined to pretend the warning was enough.

Some on the right hear a big bank say no and reach for the disruptor’s brief. Sometimes that instinct is correct. Wall Street will call a moat a security control whenever the two overlap, and nothing in JPMorgan’s incentives prevents it from selling you its own assistant the day the liability sits on terms it wrote. Do not volunteer as the bank’s lawyer. But notice what was not banned. Limited viewing through open-banking providers is still allowed. What was refused is the power to operate the account. A view is information. A transaction is control of property. A politics that claims to care about property — and about elites who slip the costs downhill — ought to be able to tell those apart.

The credential habit is the part the last decade tried to talk the country out of noticing. Handing a third party your bank login was always a strange definition of consent, the same act a fraud investigator calls a compromise when a stranger asks for it. Agentic software does not modernize that habit. It makes it autonomous, then scalable. The plain risk is enough: payments sent to the wrong place, on instructions that did not come from the account holder, at a volume no call center was built to unwind.

Build rails that can be supervised. Accept liability. Put capital behind the promise. Let customers connect tools that can look, and tools that can pay only when someone accountable is on the hook if they pay the wrong person. Until that exists, a bank that keeps the keys is not standing in the way of the future. It is declining to let a demo gamble with money that is not its own — and not, once the agent has sent it, meaningfully yours.