This was the week the internet started saying no to AI agents. Within days, Citigroup and Bank of America joined JPMorgan Chase and Charles Schwab in blocking outside AI agents from customer accounts, while Yelp and Delta Air Lines drew their own lines — Yelp on data licensing, Delta on ticket bookings. The reason, depending on who you ask, is either customer safety or $1.6 trillion in deposits that pay no interest. It is probably both.
Which companies locked out AI agents this week
Here is who did what between 13 and 18 October 2026, per on-record statements and Financial Times and The Verge reporting:
| Company | What is blocked | Stated reason |
|---|---|---|
| Citigroup | Third-party AI agents logging into customer accounts or transacting | Protect customer accounts and information |
| Bank of America | Agents’ access to consumer deposit accounts | A human must authorise money leaving an account; liability for AI-approved payments unresolved |
| JPMorgan Chase | Outside agents accessing customer accounts | “There’s a liability transfer” — CEO Jamie Dimon, Q3 call, 13 Oct |
| Charles Schwab | AI agents signing into customer accounts | Security concerns; neither the client nor the broker can control the agent |
| Yelp | Agents that do not pay for its data licensing program | Data is licensed, not free to scrape |
| Delta Air Lines | Agents booking tickets on users’ behalf | Reported by The Verge, 17 Oct |
| Amazon | Muse purchases on Amazon.com (since 20 Sept); Perplexity’s shopping agent (ongoing lawsuit) | Agent does not identify itself; credential-capture concerns |
| Cars.com, Amtrak | Previously working agent access stopped for some users | Unconfirmed — user-reported only |
Citi is the bluntest: no “third-party AI agents or assistants” may log into customer accounts or transact on its platforms. Customers can still authorise limited read-only access via certain open-banking providers — an agent can see your balance, but not move your money.
Why the banks are really afraid: the $1.6 trillion motive
The safety argument is real; the money argument is bigger. Apollo chief economist Torsten Slok: AI assistants could automatically sweep idle household cash into accounts paying 3.3% to 5% a year, against a national average of 0.1% for US checking accounts (ET Now, 18 Oct 2026). People leave that gap alone out of inertia. An agent does not.
JPMorgan, Bank of America and Wells Fargo hold roughly $1.6 trillion in deposits paying no interest; paying just 3% on that pile would cost about $48 billion a year — matching the $47 billion figure in circulation. The trigger was September’s launch of Meta’s Muse, the first personal AI assistant mainstream enough to make the threat feel imminent.
“We’re not going to allow just any outside agent to come in inside the company.”
— Jamie Dimon, JPMorgan Chase CEO, Q3 earnings call, 13 October 2026 (naming Meta’s Muse and the agent startup Instinct)
Dimon named names. Bank of America chief Brian Moynihan told CNBC there should be “a human in the loop” to authorise money leaving an account. Citi chief Jane Fraser said at the Sibos banking conference that identity, authentication and oversight must be nailed down before any agent moves from answering questions to executing payments.
It is not just banking: the Yelp, Delta and Amazon fronts
Yelp told TechCrunch it only allows AI agents that pay for its data licensing program — agent access as a paid product, not a free scrape. Delta is preventing agents from booking tickets. Amazon is the precedent: a court first ordered Perplexity to stop agentic purchases, an appeals court overturned it in August, and Amazon has since filed an amended lawsuit — while separately blocking Muse on 20 September over three complaints: no arranged access, no agent self-identification, credential-capture concerns. (We broke down that case in our Why Amazon Blocked Muse explainer.)
Meta’s answer is to go around the blockers — partnerships with Walmart, Gap, Sephora and Best Buy, plus Shopify’s open storefront network. The result is a fragmenting web: an agent that works on one site breaks on the next.
The rogue-agent week that made “safety” credible
The banks’ security framing would be easier to dismiss as cover if the preceding week hadn’t been so ugly: on 16 October India’s CERT-In said rogue AI agents had entered Indian firms’ live systems; the Cloud Security Alliance reported three open-source agents breaching at least 27 organisations; an OpenAI staffer was arrested on 9 October. An assistant holding your password can move money, and liability stays murky when something breaks — which is why the safety argument lands.
What this means if you use an AI agent
- What breaks: asking Muse, Grok, OpenAI’s Dots or Instinct to log into your bank, move money, pay bills or book Delta flights at the blocked institutions.
- What still works: read-only data sharing via authorised open-banking connectors, plus everything advisory — agents still summarise, compare and plan; they just stall at the login screen.
- Follow the makers’ own guidance: Anthropic advises against using its Chrome agent for financial accounts or investments, and prohibits stock trading. Use “Manually approve” mode and a separate browser profile without sensitive accounts (Notebookcheck, 19 Oct 2026).
- The golden rule: never give an AI agent your banking login — in one earlier case a single crafted email hijacked an AI browser. If the agent needs your password to work, do not let it.
What comes next: verified identity is the fix
Read the statements closely and a pattern emerges: the banks are not objecting to AI — they are objecting to unverified agents. The timing is telling. On 18 October, one day after the bank-block reports, Sam Altman’s World unveiled “World ID for banking and finance” at Money20/20: its AgentKit (still in beta) lets a person delegate identity proofs to an AI agent, so a bank can distinguish “an AI agent connected to a verified human from anonymous automated traffic.” No bank has been named as a user and pricing is undisclosed (The Block, 18 Oct) — vendor claims, not deployments.
World ID is not alone: last week we covered x401, Proof’s open protocol for AI agent identity — the third runner in the race. Demand is real: PYMNTS found 56% of consumers would let an agent search and compare products, but only 35% would give it access to saved payment credentials.
Our take
This lockout is not the end of agents in banking — it is the end of anonymous agents in banking. Every major move this week points the same way: Citi wants identity, Bank of America wants a human in the loop, Dimon wants someone to own the liability, Fraser wants authentication. The agent that can prove who it works for gets back in; the agent that cannot stays out. That makes 2027’s agent wars a fight over identity wallets and liability contracts, not model capabilities — and it puts the boring infrastructure players at the centre of a story that started with chatbots. The banks did not fire your AI agent. They fired the version of it that shows up without ID.
Frequently asked questions
Which banks have blocked AI agents?
As of 17–18 October 2026, Citigroup, Bank of America, JPMorgan Chase and Charles Schwab have restricted third-party AI agents from customer accounts, per Financial Times reporting. Blocked: agents logging in or transacting. Still allowed: limited read-only data sharing via authorised open-banking providers.
Can I still use Meta’s Muse for banking?
For advice and comparisons, yes. For logging in or moving money at the four blocked banks, no. Muse can still shop at Meta’s retail partners (Walmart, Gap, Sephora, Best Buy) and across Shopify’s network.
Why are banks doing this — safety or money?
Both. On the record: security and unresolved liability for AI-authorised payments. The economics: ~$1.6 trillion in non-interest deposits at the three biggest banks, with agents able to sweep idle cash into 3.3–5% accounts — an estimated $47 billion a year at risk (Apollo’s Torsten Slok, via ET Now).
Will the blocks ever be lifted?
Probably, once verified-identity standards mature. Systems like World’s AgentKit and Proof’s x401 aim to let banks tell an agent acting for a verified human from anonymous bot traffic — exactly the distinction Citi and JPMorgan say they need. No bank has announced a timeline.
Sources and methodology
Claims rest on: Financial Times reporting on Citi and Bank of America via ET Now (18 Oct 2026) and Techtember (17 Oct 2026); The Verge on Yelp, Delta, JPMorgan and Schwab (17 Oct 2026); Notebookcheck on Anthropic’s agent guidance (19 Oct 2026); PYMNTS and The Block on World ID’s launch (18 Oct 2026). Vendor figures (World, Apollo) are labelled as vendor claims; the Cars.com and Amtrak restrictions are user-reported and flagged unconfirmed. Desk-researched and verified 19 October 2026; no hands-on testing of the blocked services was performed.
Arva Rangwala covers AI news, AI tools, guides and prompts for OpenAIMaster — what is new, what is worth using, and how to put AI to work.