Six weeks after Meta launched Muse as an agent that books, buys and pays, the institutions on the other side of those transactions have answered. The answer, from banks and brokers at least, is no.
The banks
On Schwab's third-quarter call on October 15, CEO Rick Wurster said: "there's one way we think is not safe, and that's just an agent coming to our site and trying to log in on behalf of a client. We are not going to allow that." Financial Planning reports that Schwab is "specifically preventing AI agents from using clients' login credentials or browser automation to access its systems." To Bloomberg Television the next day he named Muse and framed the problem as control: "We don't want someone just giving their password to Muse, and letting Muse come in and take action on that client's behalf. We can't control it, the client can't control it, something could go wrong and who's liable?" The Next Web summarised his count: Schwab "stops outside agents tens of times a week and will offer read-only AI access instead", through MCP servers that can view balances but not move money, alongside its own assistant, Charley. JPMorgan's Jamie Dimon told his bank's earnings call that "you don't want rogue agents and there could be thousands of them." The Financial Times, as relayed by Oninvest, reports that Citigroup "has barred third-party AI agents from logging into client accounts and conducting transactions directly through its digital banking platforms" while allowing read-only access via open-banking providers, and that Bank of America has restricted access while it writes liability rules. Its CEO Brian Moynihan told CNBC: "We strongly believe there should be a human in the loop to authorise money moving out of your account."
The FT also names the money at stake. Apollo's Torsten Slok, who warned Bloomberg on September 28 of an "agentic bank run", says agents could sweep household cash into accounts paying 3.3% to 5.0% against an average checking rate of 0.1%. JPMorgan, BofA and Wells Fargo hold $1.6 trillion in non-interest-bearing deposits, 16% of their liabilities, and paying 3% on it would cost about $47 billion a year, close to half their combined earnings. Bank executives have raised the issue with the Federal Reserve, and regulators have privately supported the restrictions. Schwab's own numbers show the same incentive: $3.48 billion of third-quarter net interest revenue, much of it on roughly $493 billion in cash sweeps. "An outside agent works for the client. Charley works for Schwab," consultant Tim Welsh told Financial Planning.
The web
The Verge's Emma Roth, writing on October 17, finds users of Muse, xAI's Grok, OpenAI's Dots and Instinct "reported blocks preventing their AI agents from performing tasks across top websites." Yelp allows only agents that pay for its data licensing programme, Delta Air Lines stops them booking tickets, and users report Cars.com and Amtrak no longer working. Amazon, whose court order against Perplexity's shopping agent was overturned on appeal in August, now tells Muse users its "continued access" violates site policies. Meta's reply, from a post earlier this month: "Turning away a personal agent means turning away the customer behind it." Meta has instead signed Walmart, Gap, Sephora and Best Buy, and Shopify has opened its storefronts. Even partners misfire: anti-bot checks that need a human click log agents out. "These AI agents trigger those same safeguards," EquiStamp CEO Chris Canal told The Verge, adding that the blocks shrink what agents can do: "Does this impact the perceived value of the Anthropics and the OpenAIs? I would say absolutely."
I think the pattern is clearer than the headlines. Every institution here draws the same line: an agent that reads through a sanctioned channel is a customer, and an agent that logs in with the customer's password and clicks is an intruder. Banks drew it fastest because the deposit math gives them a reason beyond security. Retailers and airlines are drawing it for ads, fees and fraud controls. What all of them are really refusing is unattributed, unaccountable write access, and the first protocol that carries a verifiable operator identity and a scoped, revocable grant of authority will get through doors that passwords never will.
What remains uncertain. The deposit figures are FT estimates and the regulators' views come from unnamed sources. "Tens of times a week" is one firm's count. Amazon's case against Perplexity continues under an amended complaint. Several retail blocks may be anti-bot side effects rather than policy.
Analysis: For anyone building agents that touch money or commerce: design for read-only first and treat write access as something granted per institution, through OAuth scopes or MCP tools the institution publishes, never through stored credentials or browser automation. Log the operator identity on every request so a site can admit you by name. And budget for a world of per-site deals, because that is the one the banks have just chosen.
Schwab, JPMorgan, Citi and Bank of America all said this week that third-party AI agents may not log in or move money, offering read-only access through MCP servers or open-banking APIs instead; Schwab's CEO says it blocks agents including Meta's Muse 'tens of times a week', the FT puts $1.6 trillion of non-interest-bearing deposits at stake, and The Verge finds Yelp, Delta, Amtrak, Cars.com and Amazon turning agents away, leaving liability for agent actions the unsettled question.
Sources
- Websites are closing their doors to AI agents (The Verge, October 17)
- Schwab blocks unauthorized AI agents, points clients to 'Charley' (Financial Planning, October 15)
- Schwab and JPMorgan are blocking AI agents from moving customer money (The Next Web, October 16)
- US Banks Block AI Agents From Moving Customer Funds, Schwab CEO Says (Bloomberg, October 16)
- Citi and BofA block AI agents from client accounts amid fears of deposit outflows (Oninvest, relaying the Financial Times, October 17)
- Meta's Muse Raises Risk of 'Agentic Bank Run,' Apollo Economist Says (Bloomberg, September 28)