JPMorgan and Schwab Are Locking AI Agents Out of Accounts

The agent economy has spent a year promising that software will click, book and buy on your behalf. This week it met its first regulated wall: the bank.

According to The Verge, JPMorgan Chase and Charles Schwab have both confirmed they are blocking AI agents from reaching customer accounts, citing security concerns. They are not alone. Yelp says it only admits agents that pay for its data licensing programme. Delta Air Lines blocks agents from booking tickets on a customer's behalf. Users of Meta's Muse, xAI's Grok, OpenAI's Dots and Instinct report the same wall on an expanding list of sites, and some say Cars.com and Amtrak worked a few weeks ago and do not work now.

Why the banks moved first

Finance is where an agent stops being a convenience and becomes a liability question. When a browsing agent holds a customer's session and moves money, the institution cannot easily tell an authorised assistant from account takeover, and the customer cannot see what the agent did inside a page it drove itself. Blocking is the cheapest defensible answer until someone can prove identity, scope and consent at the moment of the transaction.

The commercial layer is splitting along the same fault line. Amazon cut off Meta's Muse in September, saying the agent never identified itself and appeared to capture customer credentials, and it has fought Perplexity's shopping agent in court. Meta responded by signing retailers - Walmart, Gap, Sephora, Best Buy - while Shopify opened its storefront network to agents directly. Access is being granted by contract now, not by default.

What it means for builders

For anyone shipping agents, the constraint has moved. It is no longer whether the model can complete a multi-step task in a demo; it is whether the target site will accept the request at all. Detection, consent flows and hard stops are production features, not clean-up work.

That points to three practical shifts. Prefer sanctioned interfaces - API, MCP-style tool servers, partner endpoints - over browser automation for anything involving money or identity, and treat scraping as a fallback with a written risk note. Design agents to detect refusal and escalate to a human instead of retrying through a CAPTCHA, which is both fragile and reputationally expensive. And instrument what your agent actually did: request logs, consent records and per-action scopes are what an enterprise buyer will demand before letting an agent touch a real account.

What to look for next

Watch whether banks follow up with narrow, read-only interfaces for outside models rather than blanket bans - that is the difference between agents being locked out and agents being licensed in. Watch the stalled US bills on agent liability, because until they move, every institution writes its own rules. And watch the collateral damage: the more agents are blocked, the more verification screens ordinary customers will have to clear.