by commission

The big US banks are blocking AI agents that log in with their customers’ passwords. They say they can’t tell an agent the customer sent from one that has wandered off. They’re right that they can’t, and Thomas Hobbes explained why in 1651.

For about forty years a password has meant two things at once. This is me, and I meant to do this. Nobody had to separate them, because the only thing that could type your password was you.

That stopped being true this year, and last week the banks noticed.

what happened

On 22 October Axios reported that AI agents were logging into customer accounts at the largest US banks with the customers’ own credentials. Some of them called the bank’s call centers on the customer’s behalf. Some tried actions that appeared independent of what the customer had asked for. JPMorgan, Bank of America and Citi restrict these agents. Morgan Stanley is blocking third-party agents from its platforms outright, though its spokesperson told Axios the bank hasn’t seen any “rogue AI agents accessing our platforms.”

Hold on to that detail. Nobody has shown a loss. No count of affected accounts has been published. This is not a breach in the usual sense, because the customers handed over their passwords themselves. The banks call it unauthorized anyway, because their terms say a human logs in, not software.

The positions came out over a fortnight. On JPMorgan’s earnings call on 13 October, CFO Jeremy Barnum said credential sharing is insecure, that the bank blocks those services where it can, and that customers who give an agent their login are responsible if it does something they didn’t want. Bank of America’s warning to customers is shorter: if you share your credentials, you’re responsible for the activity. On 16 October Schwab’s CEO, Rick Wurster, told Bloomberg Television that Schwab blocks big outside agents, Meta’s Muse among them, “in the tens and twenties” every week. Schwab plans to let outside models check balances and do research through its own MCP servers. They won’t be able to move money.

The proper fix already exists on paper. The CFPB’s open-banking rule, Section 1033, would have made banks offer API access, so nobody needs to scrape a login page with your password. A federal court in Kentucky enjoined it. A revised version went to White House review in August and still hasn’t been published. So the agents use the only door there is, which is the one marked humans.

the mask

Here is the problem as I see it. A password proves you have the key. It says nothing about what you meant. As long as only you held the key, that gap didn’t matter. An agent with your password holds the key and none of your intent, and the bank, looking at the session, sees you.

Hobbes worked this out in chapter 16 of Leviathan, the chapter on persons. The word person, he notes, comes from the Latin for a stage mask. To act in someone’s name is to wear their mask. He splits the wearer from the owner: the one who acts is the actor, the one who owns the actions is the author, and the actor acts “by Authority”, which he defines as “done by Commission, or Licence from him whose right it is.”

Then come two sentences that could have been written for a bank’s fraud team. First, the actor binds the author only “so far-forth as is in their Commission, but no farther.” Second:

And therefore he that maketh a Covenant with the Actor, or Representer, not knowing the Authority he hath, doth it at his own perill.

That is exactly where the banks are standing. The agent wears the customer’s mask, a perfect copy that fits anyone holding the password. The bank is making covenants with it (transfers, trades, a call to customer service) without any way to see the commission. Under Hobbes’s rule, anything the agent does past its brief doesn’t bind the customer, so the risk falls on the bank. Blocking the agents is the bank declining to make covenants it can’t price.

Barnum’s line is an attempt to rewrite the rule. You gave it your password, so everything it does is yours. That makes the author own the actor’s every act, commission or not. It’s a convenient rule for a bank, and the market strategist Jim Bianco asked the obvious question: are you protecting me, or your own profits? I’d guess both. But the point stands either way. Somebody has to answer for the gap between the mask and the commission. Right now the banks are fighting over who it will be.

reading is cheap, covenants aren’t

Look at where every bank is landing: read-only. Plaid-style connections may keep viewing balances. Schwab’s MCP servers will answer questions but won’t move money.

That line fits Hobbes too. Reading a balance makes no covenant, so it doesn’t matter much who the reader is or how far their commission runs. A transfer is a covenant. It needs the counterparty to see the commission, not just the mask. That’s what a scoped API token is: a commission written down where the bank can read it. This agent may see balances. It may not pay anyone. It expires Friday. Section 1033 was, among other things, a law to make banks accept written commissions. Without it, the password does the job, and the password is a mask that fits anyone.

your login at work

Here is the part that comes home.

You’re going to run agents under your own identity at work, if you don’t already. They’ll use your SSO session, your API keys, your GitHub token. And your employer is going to adopt Barnum’s rule, because it’s the easy one: whatever your login did, you did.

Now think about how you’re measured. The audit log records the mask. It doesn’t record the commission. The incident review will read that log. So will whoever asks why a branch got force-pushed, why a customer got an email you never wrote, or why a spend limit got raised at 2 a.m. Under your name, they’ll find an act you didn’t perform, inside a session you did open. I didn’t tell it to do that is the customer’s defense to the bank, and you’ve just watched how far it gets.

So do what the banks are doing, before someone does it to you:

• Give the agent its own identity. A service account or a scoped token, never your session. Then the log reads the agent, for me, instead of me.
• Write the commission down. The task, the limits, what it may touch. Keep it where the review can find it. A prompt in a chat window that scrolled away is not a commission.
• Default to read-only. Let it read freely. Anything that makes a covenant waits for you: sends, merges, payments, deletes.

None of this is exotic. It’s what the banks will make Muse do eventually, once the API rule is unstuck. It’s just cheaper to do it for yourself first, while it’s still your choice.

A password says who. It never said how far. Write down how far.

Sources: Axios via Dealroom: agents in bank accounts, Morgan Stanley’s statement ↗ · AI News: Barnum, Bank of America, Schwab, Bianco and the 1033 rule ↗ · Yahoo Finance: terms require a human login, no confirmed losses ↗ · BERI: Schwab’s MCP servers, Wurster on Bloomberg TV ↗ · Hobbes, Leviathan, ch. 16 (Project Gutenberg) ↗