Rogue agents at the teller window

On 13 October 2026, during JPMorgan Chase's quarterly earnings call, Jamie Dimon said something you rarely hear from the head of the world's biggest bank. He said JPMorgan would keep outside AI agents away from customer accounts, because you don't want rogue agents, and there could be thousands of them.

Within days, Citi, Bank of America, Morgan Stanley and Charles Schwab were reported to be doing the same. In Canada, RBC and BMO sounded similar warnings.

Read that again. The most sophisticated financial institutions on the planet are openly saying they don't yet know how to let software act on your behalf inside your bank account. Not because AI is useless, but because their whole system assumes a human is the one pressing the button.

That assumption just broke.

The trigger was the new wave of personal AI assistants, most visibly Meta's Muse, launched in September, and startups like Instinct. Their promise is simple: let the agent handle your money chores. Check balances, pay bills, move idle cash to where it earns more.

The problem is how many of them got in. Often the customer simply handed over their bank login, either directly or through a data connector like Plaid. To the bank, the agent then looks exactly like the customer.

On 22 October, Axios reported that several large US banks had detected third-party agents operating inside customer accounts without bank approval. Some appeared to go beyond what users had asked, for example contacting call centres on their own.

The banks' responses so far:

In short: agents may look, but they may not touch. They can read your balance. They can't send money or pay a bill.

The payment system was built around one picture: a person, verified once, pressing a button. Every control a bank has, from login to fraud detection to dispute handling, hangs on that picture. An autonomous agent breaks it in three places.

1. Identity. A bank knows the account holder. It knows almost nothing about the software making the decision. When an agent logs in with the customer's password, the bank can't tell a helpful assistant from a fraudster with stolen credentials. Lenders say exactly this: they struggle to separate authorised agents from fraud.
2. Authorisation. Card networks and banks have always asked two questions: is the credential valid, and does the transaction look legitimate? Agents add a third: is this software actually allowed to spend this person's money, this amount, right now? Nothing in today's plumbing answers it.
3. Liability. If a scammer drains your account, there are rules for getting your money back. If you shared your password with an agent and the agent made a bad payment, was that transaction unauthorised? Dimon was clear that customers who let outside agents in should understand the liability transfer that comes with it. In Europe the collision is built into the law itself: strong customer authentication under PSD2 ties every payment to a human through knowledge, possession or biometrics, and delegating to software doesn't fit that logic.

There is also a deeper mismatch. The IMF noted in April that AI agents are probabilistic: the same prompt can produce different answers. Payment systems must give the same answer every time. Banks are being asked to plug a system that improvises into a system that cannot.

Security is the stated reason. But follow the money and the picture gets more interesting. The trillions in this story are not transfers agents have already made. They are money that agents could move, and business they could take over.

The logic is simple. A checking account pays around 0.1%. An agent that watches your balances around the clock will notice that money elsewhere earns 3–5%, and move it. Millions of agents doing that at once is what Apollo's chief economist Torsten Slok warns could squeeze the cheap deposits banks rely on to make loans.

To be fair, that motive is an analyst's theory, not something any bank has said. And experts quoted by American Banker think an AI-driven bank run is possible but unlikely in the near term. Still, it explains why every bank that blocks outside agents is also building its own. JPMorgan is piloting its own AI cash tool to keep that job in-house.

None of this means banks are against AI. Dimon said JPMorgan already uses agents internally and plans customer-facing ones. Inside many large banks, agents already route payments, rebalance liquidity and triage compliance alerts, within hard limits and with escalation for anything unusual. The fight is not over the technology. It's over control.

The industry's answer is taking shape under a new name: know your agent. For decades banks perfected know your customer. Now they need to verify the software too: what the agent is, whom it represents, and what it is allowed to do.

• Visa, Mastercard and Ant International are working on a shared know-your-agent framework. Each agent would be tied to a validated person, business or operator.
• Visa has its Trusted Agent Protocol and Mastercard its Verifiable Intent, both aimed at proving that an agent's action matches what the human actually wanted.
• In the UK, HM Treasury made agentic payments one of its AI priorities in July, with a trust framework built on three elements: liability, know your agent and machine-to-machine authentication.

The practical shape is already visible: every agent gets its own identity instead of borrowing yours, spending caps per transaction and per period, lists of allowed recipients, and human approval above a threshold. As one banker put it to Fortune, the cost of an agent getting it wrong scales with its autonomy.

I've worked hands-on with large language models for about two and a half years, designing and architecting software with them. Here is what I've learned: the hard part is never the model. It's deciding what you let it do without asking you.

That's exactly where the banks are. Strip away the headlines and this isn't a technology problem. It's the oldest question in management: how do you delegate without losing control?

Every good leader already knows the answer, because they've done it with people:

• Clear identity. You know who is acting. Nobody borrows someone else's badge.
• Clear mandate. What exactly is this person allowed to decide, and up to what amount?
• Clear accountability. When it goes wrong, everyone knows in advance who carries it.
• Trust that grows with track record. Small decisions first, bigger ones later.

The agents that slipped into bank accounts this autumn broke all four rules at once. They borrowed the customer's identity, had no defined mandate, left liability undefined and got full access on day one. No sane manager would onboard a new employee that way.

So the honest reading of Dimon's warning is not "AI is dangerous". It's "we skipped the delegation design". And that's a pattern I see far beyond banking: in companies rolling out AI tools, in teams, and in our own lives, whenever we hand over decisions faster than we define the rules.

The banks will let agents in eventually. The question is not whether, but on whose terms. Expect the next year to bring agent identities, spending mandates, liability rules and a quiet race between the bank's own agent and yours.

For the rest of us, the lesson is personal. Before you hand any AI the keys to your money, ask the same four questions a bank should: who is acting, what may it decide, who carries the risk, and how does trust grow? If you can't answer them, you haven't delegated. You've just let go.

Note: this post reflects the situation as of 23 October 2026. Bank policies on AI agents are changing week by week.

Henri Isola

The Code Breaker · Holistic & Business Coach

Twenty-five years as a Solution Architect and Senior Technical Expert in enterprise data centers and cloud migrations — IBM, HP, Sanoma, CGI. Now reading human systems instead. Next in the series: Who Owns the Rails When Machines Move the Money.