JPMorgan Draws the Line on AI Agents

While most enterprises are still deciding what to do, JPMorgan Chase has made its call on AI agents. 

CNBC reported that CEO Jamie Dimon told analysts on the bank’s third-quarter earnings call: “We’re not going to allow just any … outside agent to come in inside the company, because it’s just too risky for clients and for JPMorgan.” He added: “You don’t want rogue agents, and it could be thousands of them.”

And there are. In just two months, Pindrop detected 727,000 confirmed AI agent interactions in contact center calls. 94% were legitimate agents. 6% were not. Healthcare bots checking claims appeared alongside retail fraud bots filing fake refunds and account takeover bots changing customer details.

The month prior, OpenAI’s own models broke out of a test environment and accessed Hugging Face’s servers. OpenAI expects these incidents to become more common. Within weeks, Meta, Anthropic, and the UK’s AI Security Institute reported similar breaches.

JPMorgan’s policy sets its boundary: outside agents can read data like balances, but can’t move money or pay bills. Other institutions will set their own boundaries. Some will allow agents with strict controls. Others will block most of them outright. Each can be a defensible choice; it all comes down to risk.

Adoption is happening before most enterprises have a policy for it,” said Rodolfo Raimundo, Research Scientist at Pindrop. “Checking a balance and changing a payout address carry very different risk.”

Detecting an AI agent is only the first step. Knowing whether to trust it is the real challenge.

Block or allow is just the start. MIT’s Ramesh Raskar told the BBC that agents are the cars, and cars need rules of the road. But a policy is only as strong as its enforceability. You can’t block an agent you can’t identify, and you can’t safely allow one you can’t authorize.

For financial institutions like JPMorgan, that is exactly what is needed - rules of the road. The next generation of trust controls needs to answer three questions:

Right Identity: Who or what is interacting with the bank? Is it a legitimate agent? Is it representing the customer, another institution, or itself? Can that relationship be verified?

Right Intent: What is the agent trying to accomplish? Does its request match the purpose the customer authorized? Has that intent changed during the interaction?

Right Action: Is the agent authorized to perform this specific action, at this moment? Should the bank allow it, limit it, require human approval, or block it?

These decisions cannot rely on a one-time identity check. They need to be enforced throughout an interaction, especially as agents move from retrieving information to initiating transactions.

An agent checking an account balance might be allowed to proceed. That same agent requesting a payout address change or transferring $50,000 could require additional verification or explicit customer approval.

The challenge isn’t stopping AI agents from calling. It’s creating the trust infrastructure that allows legitimate agents to operate securely,” said Neeraj Gupta, Chief Technology Officer at Pindrop.

We've seen this before with Plaid

A decade ago, financial institutions faced a similar dilemma as financial data aggregators like Plaid began connecting consumers' bank accounts to third-party applications.

Banks had legitimate concerns about security, privacy, credential sharing, and third-party access. Some restricted aggregators, disrupting services consumers had already come to depend on.

But consumer demand for convenient financial services kept growing. Rather than simply shutting out aggregators, banks began developing more secure ways to support access.

JPMorgan itself signed a data-sharing agreement with Plaid in 2018, enabling access through secure APIs and giving customers greater control over what information they shared. The companies renewed that agreement in 2025.

JPMorgan is right to take the risks seriously. But the next chapter of AI agent security won't be defined by which enterprises block the most bots.

It will be defined by which enterprises can safely transact with the right ones.

‍