Banks Are Building a Wall Against Outside AI Agents—While Racing to Build Their Own

On JPMorgan Chase's third-quarter earnings call on October 13, Jamie Dimon drew a line that most of the bank's customers didn't know existed until he said it out loud: an outside AI agent will not be allowed to act on a JPMorgan account, full stop. "We are not going to let any outside agent into the company," Dimon said, calling the alternative "too risky for both customers and JPMorgan." A bank spokeswoman later confirmed the mechanics to reporters: third-party agents can still read some account data—balances, transaction history—through consent-based connectors like Plaid, but they cannot log in with a customer's credentials, move money, or pay a bill on anyone's behalf.

The timing was not incidental. Meta's Muse, a general-purpose personal agent that can browse, fill out forms, and complete purchases, launched in early September and quickly topped download charts, with coverage of up to $1,000 per claim for agent errors. Spear Street Technology's Instinct, a text-message-based AI concierge, had just reached a $10 billion valuation. Within weeks, Dimon was publicly worried about "rogue agents" moving customer deposits into higher-yielding accounts at scale—"it could be thousands of them," he said—and bank stocks wobbled on exactly that fear.

A defensive perimeter, not a feature decision

What's notable is that JPMorgan's block isn't a product limitation; it's a deliberate authorization boundary drawn around the same institution that is simultaneously building its own agentic tools. CFO Jeremy Barnum used the same earnings call to describe a targeted pilot of Smart Cash, an internal JPMorgan AI tool meant to predict a customer's cash flow and automatically shift funds to maximize yield—functionally similar to what an outside agent like Muse might try to do, except operated entirely inside the bank's own perimeter, with the bank bearing and controlling the risk rather than inheriting it from a third party it can't audit.

That distinction—agents we built versus agents we didn't—is becoming the organizing principle of enterprise AI governance in late 2026, and banking isn't the only industry drawing it. A federal judge temporarily banned Perplexity's Comet browser from completing purchases on Amazon in March, after Amazon argued the case wasn't about whether a shopper consented to automated help, but about the fact that Amazon itself never agreed to let unvetted third-party software operate inside its storefront. Perplexity's counterargument—that an agent acting on a user's explicit instruction should inherit that user's own permissions—is precisely the argument JPMorgan and Amazon are both now rejecting in practice, not just in terms of service.

We can't control it, the client can't control it.

The question nobody has actually answered

Underneath the blocking is a liability question that predates Muse and Comet and that the industry has quietly been unable to resolve: when an AI agent spends, moves, or mismanages a customer's money, who pays for the mistake? Federal Reserve Governor Christopher Waller put it plainly in a September 29 speech at the Sibos payments conference: "Who is on the hook if an agent makes the wrong purchase?" His tentative answer—that existing e-commerce liability frameworks could probably be adapted, with room for regulatory sandboxes to test new ones—is itself an admission that no settled answer exists yet.

Into that vacuum has stepped Lead Bank, a Kansas City, Missouri institution whose CEO, Jackie Reses, has proposed a liability "waterfall" that assigns responsibility by actor and failure mode: the consumer isn't liable if an agent exceeds the authority it was delegated; the bank is liable if it controlled that delegation and failed to enforce it; the AI provider is liable for model defects or inadequate safeguards; and a merchant is liable if it knowingly induced an agent to overstep. Reses argues the technical building blocks to enforce this—behavioral-drift monitoring, cryptographic attestations, "know-your-agent" credential refreshes, revocable transaction tokens—already exist; what's missing is bank and payments regulation that actually recognizes agentic activity as a category. A separate effort, the Agentic Financial Services Protocol from Primitive (founded by former U.S. Bank chief digital officer Derek White), is built around the same gap: logging a traceable record of every agent session specifically so it can be handed to a regulator or auditor after something goes wrong.

The stakes behind the scramble are not small. Bain has projected that agentic commerce—purchases and financial actions initiated by AI on a person's behalf—could reach $500 billion in annual U.S. spending by 2030. Card networks, e-commerce platforms, payment processors, and the FIDO Alliance are all independently developing trust and authentication standards for agent-initiated transactions, a sign that no single company expects to solve this inside its own walls.

What this means for enterprise buyers

For enterprise decision-makers outside financial services, the lesson generalizes faster than the banking specifics suggest. Any company whose systems can be queried or acted on by a customer's personal AI agent—a retailer, an airline, an insurer, a healthcare portal—now faces the same choice JPMorgan and Amazon already made: decide, explicitly and in writing, which agents are authorized to act on your platform, under what credentials, and with what liability allocation if something breaks. Doing nothing is not neutral; it defaults to whatever a plaintiff's lawyer or a regulator decides after the fact, which is exactly the ambiguity Waller flagged and Reses is trying to pre-empt with a framework of her own design.

The irony is that the same enterprises drawing these hard lines against outside agents are, almost without exception, simultaneously funding internal agent deployments of their own—Smart Cash at JPMorgan being one visible example among many. The emerging enterprise AI playbook for late 2026 isn't "adopt agents" or "resist agents"; it's "control the perimeter around which agents get to act on your infrastructure, and make sure the liability question is answered in a contract before it has to be answered in court."