Whose Login Is It?

In October the big banks gave their customers' AI agents a house rule: no borrowed passwords, and hands off the money.

On 15 October Schwab's CEO, Rick Wurster, opened with it on his earnings call: "we are blocking unauthorized agents who try to log in on behalf of clients." Pressed later on the AI models Schwab does let in, he drew the line at money. "We do not allow them to move money because we think there is too much risk there to the client and to the firm." Two days earlier, on JPMorgan's call, Jamie Dimon said, "you don't want rogue agents, and there could be thousands of them." On 28 October RBC told its staff it would "block third-party personal AI agents from direct access to authenticated RBC digital properties", which Bloomberg reported covers agents such as Meta's Muse.

The rule is narrower than the headlines. Schwab has started a pilot for traders to connect their own AI model, beginning with Claude. What Schwab and JPMorgan stopped is one method: software typing in the customer's password and acting as the customer. Citi kept only its read-only open banking, and RBC's memo, as reported, names no new door.

I think they're right, because I have made this mistake myself. I learned the hard way to create dedicated service accounts when a cleanup script I tested using our lead developer's inherited API token accidentally archived dozens of active tickets under her name. Nothing in the system could tell the script's actions from hers.

Any business with a customer login now owes an answer to the same question: whose login is it?

What an outside AI agent can do at five banks in October, in the banks' own words or as reported. The column that matters is the second one.

The Decoder

An agent can get into an account through two doors. The first is the customer's own password, and once the agent signs in with it, the bank's systems see only the customer. JPMorgan's CFO called this credential sharing, and the bank is blocking it.

The second door is built for the job. An approved connector such as Plaid can, PYMNTS reports, show an agent the balances, but it cannot send money or pay bills. Schwab's version is an MCP server, a standard way for AI models to plug into other systems, and even there no agent moves money. Here the agent brings its own key, and the firm decides what it opens.

The first door can't be scoped. A bank can only spot an agent and block it, and one that gets in can do whatever the customer can.

The Steelman

The case against the banks runs like this. The customer chose the agent and handed over the password on purpose. The door the bank offers instead is one the bank scopes and can charge for: JPMorgan moved in 2025 to charge data aggregators for access, and Plaid agreed that September to pay it. Blocking the agent also keeps the customer in the bank's own app, where the bank does its selling. An adult deciding which software may act on their own money has a fair claim to make that call.

A password tells the system who you are. It says nothing about what the software holding it is allowed to do, and that gap now sits behind every login page.

The steelman is right that customers should get to use their agents, and right to distrust a door only the bank controls. A borrowed password can't fix that, because nobody can scope or audit it. Published terms can: what the agent may do, what it costs, and how the customer revokes it.

Before you write your own rule, read my executive guide on the line between software that answers and software that acts: An Agent Acts. A Chatbot Answers. Executives Need the Difference.

The Playbook

Count the agents already logging in. Ask your security team how many sessions on your customer login were flagged as automated after a successful sign-in. Treat the count as a floor, since it covers only the agents you caught.

Decide read and act separately. Write down what an outside agent may see, then what it may change: a payment, a booking, a refund, a deletion. None of the five banks lets an outside agent move money on its own. Your line can sit elsewhere, as long as someone drew it on purpose.

Give agents a door of their own. That can be a scoped key, an API or an MCP server, as long as it names the agent, carries the customer's consent and lets the customer revoke it. Open this door before you shut the password one. Indoors, every script and internal agent gets its own service account, never a colleague's token.

Settle who pays before the first mistake. Bank of America's CEO has said, PYMNTS reports, that a person should approve any money leaving an account, and the bank is working out who is liable for a payment an AI authorises. Name the owner of a wrong action by an outside agent now, and tell customers who it is before they connect one.

Publish the rule. Put it on one page that says what agents can do here, how they connect and what you block.

New on the site

A plain answer to "what is AI governance?", written for leaders. It starts from ISACA's 2026 poll: 38 percent of organisations have a formal AI policy and 30 percent a limited one, but only 12 percent have a tested process for shutting a system down. It follows one bought-in CV screening tool through policy, process and control, and ends with a test you can run this week: can a named person pause one AI system, and has anyone practised? Read the explainer.

The Signal

The banks have settled whose login it is for their customers' agents, and most firms haven't settled it for their own. In a Nylas survey of 1,030 US professionals, published on 20 October, 26% said their agents sign in with a dedicated identity of their own. Where agents had one, 66% of teams reported full audit capability, against 51% where agents act through an employee's account.

Nylas sells identity for agents, so read these as a vendor's numbers. Those archived tickets point the same way: when software runs on a colleague's login, the record carries the colleague's name.