This morning I had Claude edit my LinkedIn profile. It worked through a Chrome extension in my own logged-in browser, with my go-ahead, and LinkedIn didn't challenge any of it. I can't tell whether LinkedIn noticed the automation and let it through or never saw it at all. Either way, the requests came from my browser, on my network, in a session I had opened myself, and nothing in them said what I had asked the agent to do.
I kept thinking about that as the day's news came in, because the same gap matters a lot more when the agent is spending money.
Just send a photo of your card
Meta said this week that more than 10 million people in the US and Canada have set up Muse personal agents in about a month and a half. Mark Zuckerberg told analysts that about a quarter of them use it daily, that shopping is one of the top uses, and that more than a quarter of the engaged shoppers average over $200 a purchase. Meta started running Muse TV ads in September for people "watching the big game(s)," aka football fans. OpenAI's Dots and Anthropic's new Claude Duet are going after the same customers.
I use Grok Bot every day, mostly to draft email and do the prep before I book a trip or set up a meeting. Its Finance integration, added in September, is built the careful way. Accounts connect through Plaid, access is read-only, and Grok Bot never sees your bank logins. The shopping advice has been looser. On October 10, Elon Musk told his followers that "to buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @Bot will scour the Internet for the best deal on the item you want and order it." That post has more than 8 million views and now carries a Community Note pointing out that xAI warns users not to include personal information in prompts. Musk has since said that a screenshot is easier than filling out Grok Bot's secure vault, and promised that if Grok Bot ever leaks a card or makes a bad purchase, "SpaceX will make you whole."
He's right that the photo is easier, and the vault is there for anyone who wants it. The trouble is that the easy path is the one being promoted to millions of people, and it hands the agent the whole card.
The big banks are going the other way
On Thursday, Axios reported that major US banks are finding unauthorized third-party AI agents inside customer accounts, some of them trying to take actions that appeared to go beyond what the customer asked, and that Morgan Stanley, JPMorgan, Bank of America and Citi are blocking or restricting them. Many of those agents get in with a username and password the customer hands over, which goes against most banks' rules even when the customer is fine with it. Bank executives told Axios they often can't tell whether activity comes from a person or an agent, or whether the customer authorized it. A banking industry source told Reuters that banks typically flag and block transactions from agents using a shared password, and added something anyone tempted by the shortcut should know: when the customer shared the password, those transactions can't be treated as unauthorized.
Bank CEOs had drawn the same line the week before. Jamie Dimon warned about "rogue agents" and said customers who use outside agents should understand "the liability transfer." Schwab's CEO, Rick Wurster, said Schwab blocks the big unauthorized agents, Muse among them, "in the tens and 20s" each week. JPMorgan and Citi still allow read-only access through an approved connector like Plaid, and at JPMorgan that connector can't send money or pay bills.
A Morgan Stanley spokesperson said the bank hasn't seen rogue agents on its platforms, and nothing I've read shows a wave of losses. The banks are also building their own assistants, and Wurster said he'd rather Schwab clients use its new one, Charley, than hand a password to Muse.
Why a login in your browser still looks like you
An agent that signs in from a cloud data center with your password looks different from you, and banks are already blocking some of those. The harder case is an agent running in your own browser after you've logged in, the way mine did on LinkedIn. Then the bank's strongest signals point to you: your device, your network, your cookies, and a session that already passed your password and the code sent to your phone. Banks also watch how you type and click, score transactions for risk and ask you to confirm unusual moves like adding a payee. Those checks help, but none of them tell the bank what you asked the agent to do.
1Password for Agents, which launched the same day as the Axios story, keeps the password itself away from the agent. You approve access on your own device, and the agent signs in without ever seeing or storing the password. That's better than pasting a password into a chat, though the bank still sees a login as you.
Cloudflare has been working on the other side of this with the card networks. Its Web Bot Auth lets an agent sign its requests so a site can verify who operates it, and Visa's Trusted Agent Protocol and Mastercard's Agent Pay build on it so a merchant can tell whether a registered shopping agent is browsing or paying and tie it to a specific cardholder. American Express is building on it too. That's real progress for card purchases at merchants that support it. It covers registered agents talking to merchants, though, and an agent working inside my own browser at my bank usually doesn't carry a signature at all.
Mint asked for your password too
When Mint launched in 2007, it asked for your bank username and password so it could scrape your balances, and banks told customers not to share their credentials. People did it anyway because the product was useful. It took years, but banks and aggregators moved much of that traffic to tokens the customer can grant, limit and revoke.
Agents bring the same problem back with spending added. Connectors like Plaid already give agents read access at many banks, which still exposes a lot about your financial life but can't move money. Some open banking systems can initiate payments too, but the big banks in this week's reporting say outside agents won't move money out of their accounts. There's no common way to tell my bank that an agent may pay the electric bill up to $200 a month and nothing else.
Ways to give an agent less than everything
We already know how to give someone limited spending power, because it's how a lot of parents handle a teenager's first card. The teenager gets a card of their own instead of the login to the family checking account, the parent sets the limit and sees every purchase, and the card can be frozen from a phone in seconds. A delegated account for an agent could work the same way, and companies are trying several versions of it.
The most literal version gives the agent its own money. OnePay, a fintech that works through partner banks, announced Agentic Banking on Monday. Once it's available, a connected agent starts out able only to see your accounts. If you let it buy things, OnePay opens a separate sub-account the agent spends from, with per-purchase limits and a monthly cap you set, a single-use credential for each purchase, and a toggle to cut off any one agent. That caps what can go wrong, though it's one more balance to fund and keep an eye on. Cloudflare announced a version of this in August for agents that buy APIs and content. An account wallet hands each agent its own virtual wallet with an allowance, a list of approved merchants and a maximum transaction size. It runs on stablecoins and is aimed at developers more than at my electric bill, but it's the same allowance idea.
A card with its own limits does a similar job without moving money around. Robinhood has offered one since May. Your agent gets a virtual card inside your Robinhood Gold Card, and you either approve each purchase in the app or set a monthly limit. Privacy.com, which has sold merchant-locked cards for years, now offers an MCP server so an agent can use a card locked to one merchant and capped at, say, $200 a month. In both cases the agent sees that card's number, so the protection comes from the limits. Privacy's MCP tools can also create cards and change limits, so an agent connected with full access could raise its own cap. Robinhood's terms also say you're "ultimately responsible for the purchases your AI agent makes," which is worth reading next to the promise that SpaceX will make you whole. Claude Duet takes a lighter approach, paying through Stripe's Link with a virtual card so merchants never see the real number.
American Express published a narrower approach on October 13. The agent records what you asked it to buy along with your limits, like the merchant and a maximum price, you sign off, and the agent gets a payment credential tied to that request instead of your card number. That's close to a permission slip for a single purchase, though it only works where Amex supports it.
Robinhood's per-purchase approval and the Amex sign-off both sound careful until you're doing them ten times a day and start tapping yes without reading, the same way we all learned to click "Always allow." The big banks' own answer, keeping outside agents read-only and offering an assistant like Schwab's Charley, protects the bank but leaves me with a separate agent at every institution that only knows about its own accounts.
What I'd ask my bank for
My own wish is the allowance idea with the bank holding the rules. I'd like to be able to tell my bank that this agent may read my checking and brokerage accounts for the next seven days, may pay the electric bill up to $200, may not move money anywhere else, and has to leave a record I can export. Then I'd want the bank to hold those limits, enforce them and let me revoke them without locking myself out. It's the same kind of narrow, revocable grant I wrote about in Superintelligence Is a Permissions Problem, applied to a checking account.
In the meantime I keep my agents out of my bank and brokerage logins. I download all my own statements and scan those with code I built with Claude Code for my financial dashboards, which keeps the agent from acting on my accounts, though I still have to think about what's in those files and where they might accidentally end up. If an agent needs to buy something for me, I'd rather give it a locked card with a limit than a photo of my real one.
There are probably several good answers here, and I doubt the banks, the agent companies and the card networks will all land on the same one. What's the first payment you'd let an agent make without asking you, and what would you need in place before you allowed it? Tell me on X, LinkedIn, or at contact@exagentica.ai.