Can an AI agent move money out of your brokerage account? Not at Charles Schwab or JPMorgan Chase, which are blocking outside agents that log in with customer credentials and offering MCP-based access that covers balances and research but stops short of moving money. The stance, first reported October 16, 2026, is the clearest sign yet that large financial institutions will treat agent permissions as a security boundary.
What happened and when
Schwab CEO Rick Wurster told Bloomberg Television on Friday, October 16, that his firm is blocking unauthorized agents, including Meta's Muse, which The Next Web describes as a personal agent that can book, buy and negotiate on a user's behalf. The core complaint is simple. A client hands an agent their password, and the agent starts operating inside Schwab's systems without the controls Schwab imposes. "We can't control it, the client can't control it, something could go wrong and who's liable?" Wurster said, according to that report. He also said the big agents are stopped in the tens and twenties each week, which is a useful reminder that this is happening constantly, not hypothetically.
Wurster repeated the position on Schwab's third-quarter earnings call on October 14, telling analysts, "We are blocking unauthorized agents who try to log in on behalf of clients," according to The Epoch Times. JPMorgan is moving in the same direction. Jamie Dimon warned on the bank's October 13 earnings call, "You don't want rogue agents, and there could be thousands of them," and added that there is a liability transfer that people need to understand. Cybernews, as cited by The Next Web, reports that JPMorgan already lets some third-party tools view account data but does not let them send money or pay bills.
The alternative Schwab is building runs through MCP servers. Outside AI tools can retrieve balances and do research, but they cannot move money. Schwab is also steering clients toward its own assistant, Charley, which it announced on September 30 and which The Epoch Times describes as able to answer questions and perform certain administrative tasks on customers' behalf. Neither report includes pricing for the MCP access or for Charley, so there is nothing to quote as of October 18, 2026.
Why the permission model matters
The interesting part is the architecture, not the headline. Schwab is drawing a line between reading and writing. An agent that can check your balance is an assistant. An agent that can wire money is a liability, and nobody wants to be the party that explains the difference to a regulator. The Epoch Times also points to the bipartisan AI Agent Accountability Act from Senators Josh Hawley and Chris Murphy, which it says would cover AI-agent hacking, a sign that the policy conversation is heading the same way.
What it means for solo operators and marketers
If you run a one-person operation, you probably have more agent-reachable access than you think. Banking, payments, accounting and ad platforms can all be reached through a stored login or an OAuth grant. The practical rule is the one the banks are applying: read access first, write access only after a workflow has survived a few dozen real runs. Put any payment or outbound money step behind a human confirmation, give agents their own credentials wherever the platform allows it, and keep your bank profile separate from anything experimental.
Our take
Schwab and JPMorgan are right, and this is the most sensible thing Wall Street has said about AI agents all year. Anyone who has cleaned up after an automation rule that overspent overnight already knows the dangerous part is rarely the reading. It is the writing. The moment a bot can move money with your password, you have handed it your judgment along with your login.
Our prediction is that the banks' read-only, MCP-style model becomes the template for serious business tools over the next year. The weak link will be the "allow for all" button that someone clicks at 11 p.m. because the agent asked nicely. Copy the bank playbook in your own business. Let your agents see everything, touch nothing that moves money without your sign-off, and remember that the most dangerous employee is the one in a hurry with your password.