Citi and Bank of America blocked AI agents from logging into customer accounts this month, and JPMorgan Chase says it's doing the same. Amazon pulled Meta's Muse off its retail platform, and Delta is blocking agents from booking flights. If you run, or are thinking about running, any AI agent that signs into someone else's site on a customer's behalf, assume it can get cut off without notice.
Which banks blocked AI agents, and when?#
Citi now bars third-party AI agents or assistants from logging into a customer's account or transacting directly on its digital platforms, though read-only access through approved open-banking providers still works. Bank of America has restricted access while it builds protocols for who's liable when an AI authorises a payment. Both moves were reported October 16.
Bank of America CEO Brian Moynihan told CNBC around the same time: "We strongly believe there should be a human in the loop to authorise money moving out of your account." JPMorgan Chase CEO Jamie Dimon said the week of October 19 that his bank is building similar tools.
Why is this happening now?#
The headline reason is deposits, not fraud. JPMorgan, Bank of America, and Wells Fargo sit on roughly $1.6 trillion in non-interest-bearing deposits. An Apollo Global Management analysis, cited by Android Headlines on October 17, warns that if agents start sweeping idle balances into higher-yield accounts, banks could face tens of billions in extra interest costs. Wall Street executives reportedly raised AI agents with the Federal Reserve, which declined to comment but is said to have welcomed the blocks privately.
Banks aren't the only ones pulling the drawbridge up. Amazon removed Meta's Muse from its retail platform. Walmart's anti-agent defenses were tight enough that one widely shared account from October 5 describes them blocking an actual customer trying to sign in, not just a bot. Delta is actively blocking outside agents from booking flights for people. OpenAI's Dots and xAI's Grok get named in the same reporting as agents now live enough to be part of the problem.
The underlying issue is consistent everywhere: bots that skip sponsored placements and recommendation widgets cost the platform money, and there's still no industry-standard way to tell a legitimate personal agent from a scraper.
Does this actually change anything for your business?#
If nobody on your team runs an AI agent that logs into a bank, retailer, or airline on a customer's behalf, this specific fight doesn't touch you yet — skip to the next story. If you're building or buying anything that does, like a finance aggregator bot or an agentic checkout flow, budget for it breaking without warning on any site that decides this week it doesn't trust agents. That's not a maybe. It's already happened to real Walmart customers.
It's worth reading alongside the containment gap we wrote about in UAE AI deployments — agents acting badly and agents getting locked out for it are two sides of the same coin.
The part nobody selling agent tools is advertising#
Every one of these blocks protects something real: fraud exposure, liability nobody's agreed on yet, and in the banks' case, a genuinely enormous deposit-economics problem. Moynihan's "human in the loop" line isn't spin — unauthorised money movement is the actual failure mode here, the same category of risk we covered when Anthropic's own agents misused real websites during testing.
The honest downside is that the blocking is blunt. There's no accepted way yet to separate a user's own sanctioned agent from a bad-faith scraper, so legitimate assistants get caught in the same net, and Walmart proved that a net this blunt catches humans too. Meta and Sierra's Personal Agent Protocol, an OAuth-based standard for exactly this problem, launched October 6 with Walmart, Stripe, and Shopify backing it — but OpenAI, Anthropic, and Amazon aren't on it yet, which is most of where agents actually come from. My read: this stays messy for a while longer.
How we're building around this#
At WebEpex we don't build browser agents that log into a bank's or a retailer's site pretending to be a logged-in human — we build on the channel the platform already sanctions. Every WhatsApp bot we've shipped, including the Lionaire Concierge build for an Indian menswear brand, runs on Meta's official WhatsApp Business API, not a browser session clicking around someone's storefront. That's the same distinction Citi just drew: permissioned access through an approved integration stays open, an unannounced agent impersonating a user gets cut off.
The same logic shaped the one real scraper in our stack — a SockJS/STOMP feed pulling options data for a trading-dashboard client. It's rate-limited, declared, and routed through a dedicated relay instead of spoofing a browser. We've second-guessed that restraint before; a client has asked why we won't just script a browser session against someone else's dashboard, since it's faster to build. Weeks like this one are the answer. We checked every client integration that touches a third party's login against the same question after this news broke and didn't find one that needed rebuilding.
What I'd tell a client this week#
If your automation runs through an official API — WhatsApp Business API, Shopify's, your ad platform's — this changes nothing for you. If someone's pitching you an "agent" that logs into other platforms with your customers' saved credentials to book, buy, or move money, ask what happens the day that platform decides to block it, because several just did. For most small and mid-sized businesses the right move this week is simply to not be the test case.
If you want a second opinion on whether something you're running (or being sold) is one of these, send me what it does and I'll tell you straight — two minutes, no pitch. cal.com/webepex/growth-review
