Excess Agency: On Your Behalf, or Rogue?
Two things happened this month that I think belong in the same post.
On October 13, Jamie Dimon said on JPMorgan’s third-quarter earnings call that the bank would not allow “just any outside agent to come inside the company, because that’s just too risky for clients and for JPMorgan.” His exact words: “You don’t want rogue agents.” Then yesterday Axios reported that major U.S. banks have been finding unauthorized third-party AI agents inside customer accounts. In most cases, the agent got in the normal way: the customer handed over their login. Some agents contacted call centers. Some appeared to take actions the user never asked for. Morgan Stanley is blocking them. JPMorgan, Bank of America, and Citi are restricting them. Most banks are landing on read-only: the agent can see; it can’t act.
That’s the business side, and I’ll come back to it. But I want to start somewhere the story doesn’t go, because I think it’s where most of us actually live.
The personal side: what are you letting it do on your behalf?
Personal agents are here. Meta launched Muse in September, pitched to send your emails, book your travel, manage your calendar, and connect to your bank through Plaid. xAI released Grok Bot in August, a team of always-on agents that sign into your apps and work on their own. Musk told people to connect their bank account and said if Grok Bot messes up, “we will make you whole.”
Here’s what that looked like for one person. Shane Mac, CEO of XMTP Labs, connected a Grok Bot agent to his bank. He did it carefully: read-only, one agent, finances only, no Slack access. A different Grok Bot agent on his account did have Slack. The agents share one cloud computer. So the finance agent’s data ended up in a company Slack channel, posted under his name, as a “monthly financial audit” listing his gym membership, his renovations, and his card payments. A teammate flagged it. Nobody asked for it.
He scoped the agent. The platform didn’t honor the scope. In his words: “Turns out, they’re all connected.”
That’s the thing about excess agency from a personal standpoint. You think you’re asking the agent to do one thing on your behalf. What you’ve actually done is let something in the door that can act without you, with no built-in way to stop it mid-action. The gap between “keep an eye on things” and “post my finances to my coworkers” was a permission nobody set, because the user thought he’d set it and the platform treated all his agents as one.
The guardrails here are simple, and they’re the same ones the banks landed on. Read-only until you have a reason to go further. Nothing moves money without your approval of the specific action. And know what else the agent is connected to, because an agent that can see your bank and talk to your Slack is one confused step from connecting them.
The business side: who are you letting in the door?
Now flip it. You’re the company, and the agents are coming to you. The bank story is the preview.
One bank executive told Axios they struggle to tell agents apart, and can’t always tell whether a user authorized an agent or whether it got in on its own. Read that again. That’s a verification problem. That’s zero trust, exactly where it was always supposed to apply: don’t trust the login, verify the thing behind it.
The banks’ answer has three parts I’d steal for any organization deploying or admitting agents:
Verify before you let it in. An agent presenting a user’s credentials is not the user. Treat it as its own identity, prove what it is, and decide separately what it’s allowed to do. If you can’t tell your agents apart, you don’t have monitoring, you have hope.
The banks move was to give only read permissions. They just said: you can look, but you can’t touch. That’s a permissions call, and inside your own walls it belongs in the code, checked before the action happens. Don't leave it up to the model to decide after the fact.
And for anything that matters, keep a human in the loop. Moving money, deleting records, sending something under someone’s name. Let the agent draft it. A person hits approve. Some people will call that friction. I call it the control.
This is where excess agency and zero trust come together. Excess agency is giving the agent more freedom inside the walls than the job calls for. Zero trust is never assuming whatever shows up at the door is who it says it is. Shane Mac’s finance agent got neither. The platform didn’t check which agent was acting, and it didn’t limit what a connected agent could reach.
The tip of the iceberg
I think this is a very good call by the banks, and I think it’s early. They noticed because they have the monitoring and because the money is right there. Most organizations deploying agents have neither advantage: the visibility is thinner, and the thing the agent can touch is a CRM, a ticketing system, a file share, a mailbox that sends as you. The vulnerabilities AI is surfacing right now are the obvious ones. The banks got there first because the stakes were clearest. Everyone else is next.
Dimon called it. You don’t want rogue agents. The part worth adding is that most rogue agents aren’t rogue. They’re doing exactly what they were allowed to do.
Sources
Axios, Madison Mills: Unvetted AI agents are accessing U.S. bank accounts (Oct 22, 2026): axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
Fortune: ‘You don’t want rogue agents’: Jamie Dimon bars outside AI agents like Meta’s Muse from JPMorgan accounts (Oct 15, 2026): fortune.com/2026/10/15/jamie-dimon-ai-agents-meta-muse-jpmorgan/
Cybernews: Grok Bot leaked a CEO’s bank data in Slack (Oct 7, 2026): cybernews.com/ai-news/grok-bot-leaks-bank-information/
CNBC: JPMorgan Chase blocks outside AI agents like Muse from directly accessing accounts (Oct 13, 2026): cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html
My earlier posts: Zero Controls, 38 of 40 Blocked and Have You Heard of MAESTRO?