Five of the most-integrated consumer surfaces in America shut third-party AI agents out inside four weeks, and every one of them left a different door open. Schwab published both halves of the rule on its third-quarter earnings call on 14 October 2026: agents that log in with a client's password are blocked, and outside models may still read balances and pull research through Schwab's own MCP servers — but may not move money. Read that pair carefully and the thing being refused is neither automation nor AI. It is credential delegation, and no bot-identity standard repairs it, because an agent holding the user's password is built to be indistinguishable from the user.
At a glance
Five gatekeepers, four weeks, one shared boundary. The column that matters is the third one.
| Gatekeeper | Reported date | What it closed | What it left open |
|---|---|---|---|
| Amazon | 20 Sep 2026 | Meta's Muse on the retail site, after Meta reportedly declined a removal request | Nothing stated publicly for general agents |
| Yelp | Oct 2026 | Agents not enrolled in its paid data-licensing programme | Licensed agents, by contract |
| Delta | Oct 2026 | Third-party agents booking flights; states it has no agent deals | Nothing stated |
| JPMorgan Chase | 13 Oct 2026 | Agents logging in with customers' banking credentials | Not specified on the call |
| Charles Schwab | 14 Oct 2026 | Unauthorised agents logging in for clients; money movement | Balances and research via Schwab's own MCP servers |
Dates are as reported in third-party coverage of earnings calls and company statements, not from primary filings; one outlet puts Schwab's remarks at a 16 October interview rather than the 14 October call. Treat the exact days as approximate and the pairing as the finding.
Schwab is the clean case, because it shipped the refusal and the replacement together
Most of this fortnight's coverage read as a verdict on agents. Schwab's version is not a verdict, it is a specification, and it is the only one of the five that stated both halves on the record in the same breath.
President and CEO Rick Wurster is reported to have told analysts that Schwab blocks unauthorised agents trying to log in on behalf of clients, that he receives a weekly report of the blocks, and that the big providers are stopped "in the tens and twenties each week." He named Meta's Muse. He gave the reason as liability rather than capability — the firm cannot control the agent, the client cannot control the agent, and if something goes wrong the question of who pays has no answer. The objection, as he put it, is to a client handing over a password and letting the agent act in their name.
Then the other half: external models are reported to retain access to balances and research through Schwab's own MCP servers, and are barred from moving money. For anything beyond reads, clients are pointed at Charley, Schwab's in-house assistant.
That is three distinct decisions stacked in one policy, and they are usually discussed as if they were one. Schwab refused a channel (a browser session opened with the client's credentials), permitted a surface it issues and scopes itself, and reserved a capability — the write — to an agent it operates. Separate those three and the rest of the month decodes.
The refusal is aimed at credential delegation, not at agents
An agent that signs in with the user's password presents the resource owner with a session that is, by construction, the user's. There is no field to inspect. Amazon's stated complaint about Muse was not that an agent visited but that it did not identify itself as AI while browsing and that its access had not been disclosed — which is a complaint about the absence of a signal that a borrowed credential cannot carry. This is ambient authority arriving from outside the building: whatever the user could do, the agent can do, and the institution's own controls cannot tell the difference between a client checking a balance and a client's agent initiating a transfer.
Which is why the industry's preferred answer does not apply here. Agent-identity work — signed requests, verifiable agent credentials, the bot-verification machinery catalogued under bot verification and agent access — answers the question "which agent is this?" Schwab's problem is not that it cannot name the agent. It is that naming the agent does not reassign the liability for a write made with the client's own authority. A perfect identity attached to a borrowed credential is a better log entry and the same exposure, which is the general lesson of attested agent identities: attribution and authorisation are different purchases.
The scoped MCP server does reassign it. When Schwab issues the surface, it chooses the operations, logs against a grant it controls, and can revoke that grant without touching the client's own login — the ordinary properties of a short-lived, scoped credential. The asymmetry between the two shapes is not about trust in the agent's builder. It is about which party is able to refuse.
"Tens and twenties each week" is the most important number in the story
Schwab serves tens of millions of brokerage accounts. Against that, dozens of blocked agent logins a week is noise — far too little to be the operational problem that forces a policy. Read it the other way and it is the finding: the rules are being written before the traffic exists.
That timing is the part builders have mispriced. Yelp's position is not "no agents" but "agents whose makers pay for the data." Meta's answer to the Amazon block was a list of retailers it has arrangements with — Walmart, Best Buy, Gap, Sephora, Wayfair. Schwab's is a read scope on infrastructure it runs. In every case the access that survives is access somebody granted in advance, to a named counterparty, on terms.
So the cost of being blocked in October 2026 is approximately zero, and the cost of still being un-contracted when consumer agent traffic becomes material is the product. The scarce asset in agentic commerce is turning out to be a distribution agreement, not a protocol implementation — which is the uncomfortable half of AP2 and agent commerce: the payment rails can be standard and the admission still bilateral.
There is a legal overhang on all of it. Amazon's dispute with Perplexity over AI shopping is reported as unresolved, with an initial order to halt the feature overturned on appeal in August 2026. Nobody should plan on the question of whether a site may exclude an agent acting for a logged-in user being settled soon, in either direction.
The browser is the channel that cannot be authorised
A browser agent is excellent engineering and a terrible integration contract. Its whole competence is operating a surface built for a human, which means it inherits the human's session, the human's user-agent string and the human's permissions, and detecting it is permanently adversarial — the better it works, the less distinguishable it is. The confused-deputy shape is baked in: the institution holds the authority and an unaccountable third party supplies the intent.
Teams building shopping and checkout agents have treated browser automation as the universal adapter precisely because it needs no counterparty. October's lesson is that "needs no counterparty" and "has no standing" are the same sentence. The agents still working inside these five gatekeepers got there through a path the gatekeeper issued — a licence, a partnership, or a server the gatekeeper runs.
There is a design consequence that survives whatever happens to the litigation. If your product's only path to a system of record is a credentialed browser session, you do not have an integration; you have a tolerated behaviour, and its availability is a policy decision made by someone with no contract with you. Build the browser path for the long tail where nothing else exists, and treat every destination that matters as a place you will eventually need an issued scope from. That is also the honest reading of MCP's OAuth 2.1 authorisation model: it exists so that the resource owner, not the agent, decides what the token can do.
What to change if you are building an agent that acts for a user
| Decision | What October implies | What to do instead |
|---|---|---|
| How the agent authenticates | A user-supplied password is the thing being blocked, everywhere | Treat credential capture as a last resort; ask for an issued grant and log which one you used |
| Reads versus writes | Reads survive the boundary; writes are being reserved to first-party agents | Design for read-rich, write-poor: compose, draft and verify, then hand the write to the institution's own surface |
| Self-identification | Hiding the agent is now a named grievance, not a stealth advantage | Identify the agent on every request even where nothing checks yet — it is the precondition for being licensable |
| Distribution | Admission is bilateral and the queue is forming now | Spend on counterparty agreements at the destinations that matter before the traffic arrives |
The scope discipline is worth stating in its own terms: an agent that asks for exactly the capability its current task needs is both easier to admit and cheaper to be wrong about, which is the whole argument of task scope. The agents that got licensed this month were the ones whose ask was narrow enough to approve.
FAQ
Did Schwab block AI agents?
It is reported to have blocked agents that log in using a client's credentials, while keeping balance and research reads available to outside models through its own MCP servers and barring money movement. The block is on the channel and the capability, not on agents as such.
Why does a cryptographic agent identity not solve this?
Because the problem is not identifying the agent. An agent acting with the user's own credential carries the user's authority, so a verified identity improves the audit record without changing who is liable for the write. The control that works is a scope the resource owner issued and can revoke.
Is a read-only MCP server actually safer than a browser agent?
For the resource owner, yes, and for a structural reason: it chooses the operations, it can rate-limit and revoke per grant, and it never sees the client's login. For the agent's builder it is also more durable, because it is permitted rather than tolerated.
How many agents is Schwab actually stopping?
Wurster is reported to have described the big providers being blocked "in the tens and twenties each week" — which is tiny, and is why the number matters. The policy is being set before the volume arrives.
Does this mean agentic commerce is dead?
No — it means admission is contractual. Meta's response to the Amazon block was a list of retail partners, and Yelp admits agents whose makers pay. Expect a federation of licensed read surfaces plus first-party write agents rather than one universal agent with your passwords.
Can a site legally exclude an agent acting for a logged-in user?
Unsettled. Amazon's case against Perplexity is reported as ongoing, with an early order against the shopping feature overturned on appeal in August 2026. Build for the policy as it is enforced today, not for an outcome.
Further reading
On this wiki:
- Bot verification & agent access — what identity signals an agent can carry, and what they cannot settle.
- Ambient authority — why inheriting a user's session is the failure mode, not a feature.
- Credential lifetime — the scoped, revocable grant that a borrowed password is not.
- Third-party agents logging in as your users — the same problem from the receiving end, with the detection limits spelled out.
- AP2 & agent commerce — the payment side, and why standard rails still leave admission bilateral.
- MCP authorisation (OAuth 2.1) — how an issued scope is supposed to work.
Sources:
- Financial Planning — Schwab blocks unauthorized AI agents, points clients to 'Charley'; the earnings-call remarks, the weekly report, the MCP read scope and the liability reasoning.
- Yahoo Finance — JPMorgan blocks outside AI agents from customer accounts; the 13 October 2026 third-quarter call.
- The Epoch Times — Charles Schwab, JPMorgan restrict third-party AI agents over security risks; the credential framing.
- Notebookcheck — US banks and Amazon are blocking AI agents like Meta's Muse; the Amazon block from 20 September 2026 and Meta's response.
- Startup Fortune — Amazon, Yelp and airlines are shutting AI shopping agents out the door; Yelp's licensing programme, Delta's position, and the Perplexity litigation status.