JPMorgan Draws the Liability Line on AI Agent Account Access

On Tuesday, Jamie Dimon told analysts on JPMorgan Chase's third-quarter earnings call that the largest bank in the United States will not let outside AI agents touch customer accounts. The statement, later confirmed by a bank spokeswoman, is the sharpest public boundary any major financial institution has drawn since personal agents like Meta's Muse and OpenAI's Dots turned autonomous assistants into a consumer phenomenon. It also reframes the agentic-commerce conversation. The hard question is no longer whether agents can pay, but who is responsible when they do.

What JPMorgan Actually Blocks

Dimon was blunt: "We're not going to allow just any outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan." He added a line that captures the operational fear, "You don't want rogue agents, and it could be thousands of them."

A bank spokeswoman confirmed the policy to CNBC and explained the reasoning: because it is not safe, third parties are not permitted to obtain customers' banking credentials and log in on their behalf. Data sharing is still supported, but only through open-banking connectors such as Plaid, and only in read-only form. That means an agent can pull a balance or check a transaction, but it cannot send money or pay a bill, the very actions that make an agent useful. JPMorgan offered no timeline for when safeguards might change that.

The precedent matters as much as the policy. JPMorgan fought a nearly identical battle with fintech data aggregators over screen-scraping and API access, and later moved to charge middlemen such as Plaid for that access. The bank is treating agents as a new class of unvetted client, and it is using the same playbook.

The Liability Line Is the Real Story

Buried under the access question is the sentence that should worry every company building on agents: "If people are using them, they should understand the risk. They should understand there's a liability transfer."

That is the whole argument in one phrase. When a human logs in and clicks a button, the bank owns the transaction rails and most of the fraud risk. When a customer hands an autonomous agent that customer's credentials, the bank loses its ability to tell intent from compromise. If the agent is tricked by a prompt injection, overshoots a budget, or is simply wrong, the loss lands on the customer, not the institution. For banks, that is an unacceptable black box.

There is a commercial motive too. In September, bank stocks wobbled after Meta's Muse agent topped the app download charts, because analysts including Apollo's Torsten Slok warned that agents could quietly move cheap deposits into higher-yielding accounts, squeezing funding costs. JPMorgan's own answer is instructive: it is piloting an internal tool, Smart Cash, that predicts a customer's cash flow and moves funds to maximize yield. The bank would rather be the agent than let someone else's agent pull the levers. Refusing outside agents protects both the balance sheet and the franchise.

Everyone Is Building the Missing Trust Layer

JPMorgan's refusal is not isolationism. It is a signal that the authorization layer agents need does not exist yet, and that several competing attempts to build it are now racing.

American Express published its Intent Intelligence Framework the same day. It captures a customer's purchase instructions through a Create Intent API, mints an Intent ID plus a Proof of Intent Token that carries the user's constraints, and then issues a scoped digital payment credential the agent uses at checkout instead of the real card number. Intent is bound to a transaction before it happens. This is exactly the primitive banks say they are missing, and it comes from the card network rather than the account side.

On the identity side, Sierra and Meta published the Personal Agent Protocol on October 6 with partners including Shopify, Stripe and Walmart. It gives a personal agent an OAuth-based session on a company's site, lets the customer choose read-only or write access, and lets the business decide what it exposes, whether that is its website, its APIs through standards such as MCP and OpenAPI, or its own agent. The v0.1 specification and a reference implementation are promised later this month. Meanwhile Anthropic donated MCP to the Linux Foundation and joined OpenAI, Google, Microsoft and others in the Agentic AI Foundation, explicitly to make authentication and trusted payments someone else's shared problem.

The security research explains the urgency. Ars Technica reported a class of attack called protocol pivoting, in which a malicious prompt enters one agent and is forwarded to another that trusts it, crossing from MCP into A2A or the Agent Network Protocol and exhausting authorization along the way. Tested against agents at organizations including Google and JPMorgan itself, the technique worked because internal agents assume their peers are safe. An agent that can read a balance is a data risk. An agent that can move money with credentials it holds on someone else's behalf is a systemic one.

What This Means for Builders

If you are shipping agents that touch money, accounts, or another company's systems, the JPMorgan decision is a product requirement, not a headline.

• Treat credentials as scoped and short-lived. The winning pattern, visible in both the Amex framework and the Personal Agent Protocol, is a token that encodes what the agent may do, not a login that encodes who it is.
• Bind authorization to intent. An approval for "renew this subscription up to 30 dollars" is not the same as permission to charge a card. Capture the constraint at authorization time and carry it into execution so downstream systems can enforce it.
• Assume read-only and denial. Banks and enterprises will expose data before they expose actions, so design for a ladder of permissions and degrade gracefully when a write is refused.
• Log everything as agent-attributable. Google's coworker agents write an audit trail attributed to the agent rather than a person; regulators and counterparties will expect the same. If your agent acts, you should be able to reconstruct why.
• Do not trust a peer agent by default. The protocol-pivoting findings are a direct warning: anything an agent sends your tool is untrusted input, even when it arrives from inside your own network.

What to Watch

The v0.1 Personal Agent Protocol specification and reference implementation, promised later this month, will show whether authentication is genuinely interoperable or just a press release. Whether OpenAI and Anthropic join the protocol matters, since their agents reach the most consumers. And watch whether banks converge on a single open-banking agent standard or fragment into proprietary rails, which would leave builders integrating the same authorization logic a dozen times over. Until that layer exists, every agent that touches a bank account is a liability experiment, and JPMorgan has made clear it will not be the test subject.