Spuutr Labs

← All posts

Banks blocking AI agents was about as surprising as rain in Melbourne.

Banks are pushing back on AI agents that log in as you. The real gap is agent identity: a way for an agent to prove who it acts for and what it may do.

Black and white single panel cartoon. In a bank manager’s office, a relaxed man in a Hawaiian shirt, shorts, flip-flops and sunglasses leans back in his chair with his hands clasped behind his head, grinning. Beside him stands a humanoid robot in a dress, upright and businesslike, holding a clipboard like a personal assistant. Behind the desk, the bank manager stares with his mouth open and hands raised in shock. On the desk, a nameplate reads “Bank Manager.” Caption: “I’d love to introduce you to my partner Carla, who will be handling all my banking.”
Banks versus agents.

Banks blocking AI agents was about as surprising as rain in Melbourne. And they still didn't build for it.

For a lot of people, the payoff beats the risk. So they take the shortcut and hand over a card and a login.

Nobody actually wants to give an agent everything. But not catering for something this predictable? Ridiculous. So now, the panic.

JPMorgan blocks outside AI agents, with no timeline for a safe way in. Schwab, Morgan Stanley and Bank of America are pulling back too.

I can add my wife to my credit card with almost one click, which is a risk on its own (hope she's not reading this). So why can't I bring my agent in as a partner too?

Cards are quietly getting there. Visa, Mastercard and Amex are building agent identity into payments. But my card app has nowhere to add my agent. Bank accounts don't even have the plumbing. Just "please don't share your password."

My bet: the first big bank that lets me register my agent on my account, like a cardholder, wins. It acts alone up to an amount I set. Bigger payments or new payees? It stops and asks me. Every action pings me. Two levels of checks: the agent proves who it is, the bank verifies it.

One catch. Researchers have shown an agent holding your logins can beat its own two-factor checks. So big approvals live in a no agent zone: an Authenticator push to a separate phone the agent can't touch, plus a 2-digit code. Light on purpose. Anything more is friction nobody wants.

One tiny question left for the banks. Inside my limits, who carries the risk?

Sources

  • agent factories
  • agents
  • identity
  • banking