Bank of America says don’t give AI agents your password. What’s safe instead

What Bank of America told customers

Bank of America has emailed customers under the subject “Protecting your finances in the AI World.” It asks them not to share their username and password with anyone else or with an outside service, “including an AI-enabled tool or agent that offers to act on your behalf.” It then puts the risk on the customer: “If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.”

Bryan Toporek posted the email on Bluesky on October 27, and a bank spokesperson confirmed to TechCrunch that it’s genuine. TechCrunch lists what can go wrong: an agent could act in your accounts without your knowledge, the bank could mistake its activity for an account takeover and lock you out, and a security flaw in the agent could leak your login to thieves.

Why banks are pushing back now

Agents that work on the web for you are now ordinary consumer products. ChatGPT and Claude can work on sites while signed in as you, Meta’s Muse links to bank accounts, and banks say agents are turning up inside customer accounts. On October 22, Axios reported, in Decrypt’s summary, that large US banks were finding third-party agents inside customer accounts, sometimes signed in with the customer’s own username and password, and that some tried steps that appeared independent of their users’ instructions. Executives called it “horrifying.” None of the reports we read describes a customer losing money.

The banks’ answer, so far, is to shut the door:

Bank	What it says	When
Bank of America	Don’t share your login with an AI agent; if you do, you’re responsible. Reuters reported it blocks customers’ external agents.	Email confirmed October 27
JPMorgan Chase	“If they give up their credentials to the agent, and the agent does something that they don’t want, that’s going to be on them,” its CFO said. It is blocking services that rely on shared logins.	October 13 earnings call
Citi	Has “blocked anything that is trying to access our walls agentically,” and allows only “open banking read-only access.”	At Money20/20, reported October 23
Wells Fargo	Requests through an AI tool “may be treated as if they came directly from you,” and it may “restrict or block access from certain third-party AI tools.”	Agreement effective November 24

The JPMorgan quotes are from American Banker, Citi’s from Banking Dive, which also cites Reuters on Bank of America, JPMorgan, Morgan Stanley and Schwab blocking external agents. Wells Fargo’s are from its own summary of the update: “If you continue using these services after November 24, 2026, the updated Agreement applies.”

Who’s responsible if an agent moves money

You are, by the account of every bank that has addressed it. Wells Fargo’s new agreement goes furthest, with a section on “Your responsibilities for artificial intelligence agents, if and when we permit the use of such agents.”

Federal rules lean the same way. Regulation E, which sets consumers’ protections against unauthorized electronic transfers, defines an access device as “a card, code, or other means of access to a consumer’s account,” and doesn’t count a transfer as unauthorized when it’s made “by a person who was furnished the access device to the consumer’s account by the consumer, unless the consumer has notified the financial institution that transfers by that person are no longer authorized.” We haven’t found a regulator or bank saying how that applies to an AI agent. But the safe assumption is that a transfer made with a login you handed over is yours, until you tell the bank otherwise.

How AI agents sign in to your bank

The popular agents handle your login in different ways, and they aren’t the same thing to your bank.

Agent	How it signs in	What it says about money
ChatGPT agent	Pauses and asks you to take over its browser; “screenshots are not captured” while you do. “Cookies persist across sessions.”	Asks for confirmation on “high-impact actions”
ChatGPT Work’s cloud browser	You sign in through a form; the login is “not visible to the model,” and the session lasts “until it expires.”	Asks before actions “such as confirming a booking or making a payment”
Claude in Chrome	Works in your own browser, with your sign-ins	“Claude asks for permission before accessing financial sites”; Anthropic lists “Managing financial accounts or investments” under what to avoid
Meta’s Muse	Connects accounts through Plaid “to share balances, transactions, investment holdings, mortgage information and more”	Plaid says you manage the connections in Plaid Portal

The sources are OpenAI’s help on ChatGPT agent and its cloud browser, Anthropic’s Claude in Chrome safety page, and Plaid’s announcement for Muse.

Two kinds of connection are hiding in that table. Typing your password into an agent’s browser means a browser the agent runs signs in as you and stays signed in. The model never sees the password, but you’ve still handed it to an outside service that acts for you, which looks like the case Bank of America’s email describes, though no bank has said so directly. A connection made through the bank’s own consent screen is different: you sign in at the bank, approve what’s shared, and can withdraw it later. Bank of America publishes consent terms for Plaid, the service Muse uses.

What to do

1. Don’t give an agent your bank username and password, in a chat or in its browser. If a task needs your bank’s site, do that step yourself.
2. Connect through the bank instead. Bank of America’s page on third-party apps describes its more secure method: “Instead of sharing your login credentials, you’ll log in directly to Bank of America” and approve what’s shared. You can “view a list of third-party services” in Mobile or Online Banking and “revoke your permission for them to access your account information at any time.” Its Plaid terms say consent is good for “a rolling 365 days” and lapses if an app doesn’t use it for 180 days.
3. Or give the assistant less. A statement or transaction export you download and hand over lets it answer questions about your spending without any access to your account.
4. If you already shared your login, change your password. For apps that use your login, Bank of America says “the safest and most secure way is to change your Bank of America password.” It warns that apps “may still be able to retain and use the data that you previously shared.” Then clear the agent’s saved session: in ChatGPT, open Settings > Cloud browser > Browser data > Cookies and clear the bank’s site, which signs it out. Check your recent activity while you’re there.
5. Keep confirmations on. ChatGPT asks before it makes a payment, and Anthropic’s Chrome safety page describes a “Manually approve” mode for reviewing every action. Leave those on for anything that touches money.

If an agent works in your own browser

Agents that drive your browser use whatever you’re signed in to. Anthropic’s advice for Claude in Chrome is to “use a separate browser profile without access to sensitive accounts (such as banking, healthcare, government).”

The same goes for Claude Code. Enjoy turns on Claude’s Chrome connection in every Claude Code conversation, and Claude works in tabs that share your browser’s sign-ins. Keep your bank out of that browser profile. Depending on your permission mode, an approval card asks before Claude uses a browser tool, and Claude waits for your answer.

What hasn’t been said

• What counts as sharing. No bank has said whether signing in through an agent’s own sign-in form, as ChatGPT’s cloud browser asks you to, counts as sharing your login. Bank of America’s email asks customers not to share it with any outside service that offers to act for them.
• How many customers got the email. Bank of America hasn’t said.
• When banks will let agents in. Wells Fargo’s agreement speaks of agents “if and when we permit” them, and a Citi AI executive said the bank wants a “know your agent” process first. Bank of America and five other banks published principles for agentic commerce in September and say a second paper, on putting them into practice, is in the works.
• What happens to locked-out customers. None of the banks has said how it handles an account it locked over agent activity.

We’ll update this memo if Bank of America or the other banks publish more.