# Should I give an AI agent my brokerage password?

No. [Bloomberg Law](https://news.bloomberglaw.com/banking-law/us-banks-block-ai-agents-attempting-to-move-money-for-customers) quotes Charles Schwab CEO Rick Wurster: "We don't want someone just giving their password to Muse, and letting Muse come in and take action on that client's behalf." [Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html) reports that he said it Friday in a Bloomberg Television interview.

Checked 2026-10-19.

## Should I give an AI agent my brokerage password?

No. [Bloomberg Law](https://news.bloomberglaw.com/banking-law/us-banks-block-ai-agents-attempting-to-move-money-for-customers) reports that Charles Schwab CEO Rick Wurster said the company is actively blocking unauthorized AI agents attempting to move clients' money, including Meta's Muse. He does not want someone giving their password to Muse. [CNBC](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html) reports that JPMorgan Chase will not allow outside AI agents to access customer accounts and operate on their behalf.

[Bloomberg Law](https://news.bloomberglaw.com/banking-law/us-banks-block-ai-agents-attempting-to-move-money-for-customers), Oct 16, 2026, says Charles Schwab CEO Rick Wurster said the company is actively blocking unauthorized AI agents attempting to move clients' money, including Meta Platforms' Muse. The same page quotes him: "We don't want someone just giving their password to Muse, and letting Muse come in and take action on that client's behalf. We can't control it, the client can't control it, something could go wrong and who's liable?"

[Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html), Oct 16, 2026, quotes that password line and says Wurster said it Friday in a Bloomberg Television interview. It adds his next line: "For the protection of the client and for the protection of us, we're not allowing it."

[CNBC](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html), Oct 13, 2026, says JPMorgan Chase will not allow outside artificial intelligence agents to access customer accounts and operate on their behalf, and attributes that to CEO Jamie Dimon.

## Why are banks and brokers blocking AI agents?

Schwab and JPMorgan are blocking that login. A JPMorgan spokeswoman told [CNBC](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html): "Because it is not safe, we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf." [Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html) quotes Schwab CEO Rick Wurster: "For the protection of the client and for the protection of us, we're not allowing it."

A JPMorgan spokeswoman told [CNBC](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html): "Because it is not safe, we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf." She also said: "We support secure, customer-authorized data sharing through open banking providers and are committed to enabling agentic connections securely."

[CNBC](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html) quotes Dimon: "If people are using them, they should understand the risk." He added: "They should understand there's a liability transfer."

[Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html) quotes Wurster: "I get a report on how many times we've blocked clients from using one of these agents in a week and it's in the tens and twenties" per week "that the big agents are being blocked."

[FINRA's investor insight](https://www.finra.org/investors/insights/be-mindful-data-aggregation-risks), "Know Before You Share: Be Mindful of Data Aggregation Risks," January 12, 2024, is about data aggregators, and the same mechanism applies to an agent that logs in as you. It says screen scrapers "sign in with your credentials." It says the risks "include potential vulnerability to cyber fraud, unauthorized transactions and identity theft" and "are especially heightened for aggregators that use screen scrapers and require you to share your security credentials." It says "Some financial institutions have even begun blocking scraping by third parties."

## What is the safer way to connect an agent to a broker?

Use the broker's own authorized connection. [FINRA's note](https://www.finra.org/investors/insights/be-mindful-data-aggregation-risks) is about data aggregators, and the same mechanism applies to an agent that logs in as you. [FINRA](https://www.finra.org/investors/insights/be-mindful-data-aggregation-risks) says an API lets you authorize access without sharing security credentials, limit scope, and specify whether fund transfers are permitted. [Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html) reports protocol servers let Schwab control authentication and what they can access.

[FINRA](https://www.finra.org/investors/insights/be-mindful-data-aggregation-risks) says: "APIs give consumers the ability to authorize access without sharing security credentials, as well as to limit scope and specify whether fund transfers are permitted." That note is about data aggregators, not AI agents.

[Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html) says Schwab will prepare model context protocol servers to connect external large-language models. It quotes Wurster: "What that allows us to do is control the authentication process and also control what they can access." He added: "We're not going to allow them to move money, but if they want to come in and see their account balances and do research, they will be able to do that through their LLMs."

## What the official connections say

Checked 2026-10-19. One row each. TradeStation is first. The other rows are alphabetical. Each cell links that firm's page.

| Broker | How you connect | What the page says about orders |
| --- | --- | --- |
| [TradeStation MCP](https://www.tradestation.com/platforms-and-tools/mcp/) | You can request MCP access in HUB on the Platforms page ([TradeStation MCP](https://www.tradestation.com/platforms-and-tools/mcp/)). The ChatGPT setup says the server URL is https://mcp.tradestation.com/v2/mcp and says "Select OAuth for authentication" ([ChatGPT setup](https://www.tradestation.com/insights/2026/07/16/mcp-chatgpt/)). | "TradeStation MCP requires explicit confirmations before orders are placed, and all actions remain subject to your existing trading permissions and risk controls" ([TradeStation MCP](https://www.tradestation.com/platforms-and-tools/mcp/)). Traders can "grant or deny access to different pieces of information and functionality" ([ChatGPT setup](https://www.tradestation.com/insights/2026/07/16/mcp-chatgpt/)). |
| [Interactive Brokers](https://www.interactivebrokers.com/en/trading/ai-integrations.php) | Connects "without sharing API keys or passwords." "IBKR retains full control of authentication, and your login credentials are never passed to the AI platform." The connector URL is https://api.ibkr.com/v1/api/mcp-public ([Interactive Brokers](https://www.interactivebrokers.com/en/trading/ai-integrations.php)). | The AI analyzes your portfolio and drafts trade instructions. You open the AI Instructions tab to review and submit the order. "Instructions never become orders automatically." ([Interactive Brokers](https://www.interactivebrokers.com/en/trading/ai-integrations.php)). |
| [NinjaTrader MCP](https://docs.ninjatrader.com/mcp/connect) | Beta, and not yet generally available. This uses OAuth. "Your agent never sees your password." Demo, simulated money: https://mcp-demo.tradovateapi.com/mcp. Live, real money: https://mcp-live.tradovateapi.com/mcp ([NinjaTrader connect](https://docs.ninjatrader.com/mcp/connect)). | "Start on Demo." Confirm the server with a read-only prompt before anything else. The page's example is "List my NinjaTrader accounts and show my current positions and working orders" ([NinjaTrader connect](https://docs.ninjatrader.com/mcp/connect)). |
| [Robinhood Trading MCP](https://robinhood.com/us/en/support/articles/onboarding-an-external-agent/) | External agents connect through the Robinhood Trading MCP. "To trade with an external agent, you must open a Robinhood MCP account specifically for your external agent" ([onboarding](https://robinhood.com/us/en/support/articles/onboarding-an-external-agent/)). | The agent has read access to all your Robinhood accounts, including account numbers, and "can only place trades in your Robinhood Agentic account" ([onboarding](https://robinhood.com/us/en/support/articles/onboarding-an-external-agent/)). Trade approvals "are turned off by default for MCP accounts (external agents)" and can be turned on under Safety Controls in Agent Settings. With trade approvals off, the agent can place eligible trades without your manual confirmation of each order. "Certain trades may still require your approval even when trade approvals are turned off." "Trade approvals are still rolling out for MCP accounts. Not all customers have access." ([trading](https://robinhood.com/us/en/support/articles/trading-with-your-agent/)). |
| [tastytrade MCP](https://developer.tastytrade.com/docs/sdks-and-tools/mcp-server/) | Self-hosted. Authentication is environment-only, and there is no interactive login flow. You supply TASTYTRADE_CLIENT_ID, TASTYTRADE_CLIENT_SECRET, and TASTYTRADE_REFRESH_TOKEN. The docs say -s project writes a shareable .mcp.json, "the wrong place for a client secret or refresh token" ([tastytrade MCP](https://developer.tastytrade.com/docs/sdks-and-tools/mcp-server/)). | "Unset means production." With no environment configured, the server connects to the production API, where every order moves real money, immediately and irreversibly. TASTYTRADE_READ_ONLY=1 withholds and refuses all 14 write and destructive tools. Five order tools need a single-use confirmation token from a dry-run tool, valid for 60 seconds ([tastytrade MCP](https://developer.tastytrade.com/docs/sdks-and-tools/mcp-server/)). |
| [Webull Cloud MCP](https://developer.webull.com/apis/docs/AI-friendly-Resources/mcp) | "OAuth Authorization Code Flow." You may authorize one or more accounts, and capability groups independently: Account Infos, Order Query, Market Data, and Security Master. "Only selected accounts will be accessible through MCP" ([Webull Cloud MCP](https://developer.webull.com/apis/docs/AI-friendly-Resources/mcp)). | Each place instruction tool creates an order instruction that "requires confirmation in Webull APP / Desktop" ([Webull Cloud MCP](https://developer.webull.com/apis/docs/AI-friendly-Resources/mcp)). |

The [tastytrade MCP](https://developer.tastytrade.com/docs/sdks-and-tools/mcp-server/) names the five order tools that need the token: tastytrade_place_order, tastytrade_edit_order, tastytrade_replace_order, tastytrade_place_complex_order, and tastytrade_edit_complex_order. Each takes a single-use confirmation_token minted by its own dry_run tool, valid for 60 seconds. The same page says TASTYTRADE_READ_ONLY=1 withholds every write and destructive tool, and the variable table says it withholds and refuses all 14 write and destructive tools.

## What should an agent be allowed to do first?

Read first. [Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html) quotes Wurster: "We're not going to allow them to move money," and customers can "see their account balances and do research." [NinjaTrader](https://docs.ninjatrader.com/mcp/connect) says start on Demo and confirm with a read-only prompt. [tastytrade](https://developer.tastytrade.com/docs/sdks-and-tools/mcp-server/) says TASTYTRADE_READ_ONLY=1 withholds every write and destructive tool. Paste one order into [Agent Order Check](/check) before you approve it.

Read before an order. [Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html) quotes Wurster: "We're not going to allow them to move money, but if they want to come in and see their account balances and do research, they will be able to do that through their LLMs." [NinjaTrader's connect page](https://docs.ninjatrader.com/mcp/connect) says "Start on Demo" and says to confirm with a read-only prompt before anything else. [tastytrade](https://developer.tastytrade.com/docs/sdks-and-tools/mcp-server/) says to set TASTYTRADE_READ_ONLY=1, which withholds every write and destructive tool. On [Robinhood](https://robinhood.com/us/en/support/articles/trading-with-your-agent/), trade approvals are turned off by default for MCP accounts, and with them off the agent can place eligible trades without your manual confirmation of each order. The same page says: "If you turn the setting on, your agent can propose trades, but you must review and manually place the proposed orders in the Robinhood app."

Paste one order into [Agent Order Check](/check) before you approve it. The page reads one order and runs 11 checks: symbol, side, quantity, asset type, order type, time in force, a stop, the stop's side and distance, bracket legs, dollar risk against your max loss, and whether the order tries to change LIVE_TRADING or human approval. The check runs in the browser. The order is not stored, sent, or given to a model.

The [kill switch guide](/guides/ai-trading-bot-kill-switch) says a kill switch is a control the agent can read and cannot write. When it is on, the process that sends orders refuses new ones. The [guardrails guide](/guides/ai-agent-trading-guardrails) keeps max loss, live trading, and human approval in a file the agent does not write, and a checker rejects a bad order before a person sees it. The [paper trading guide](/guides/ai-agent-paper-trading) says the agent sends paper orders and you review every fill, and live waits on a written checklist. Official rows for these firms sit on [broker connectors](/guides/broker-ai-connectors).

## How do I audit how my agent connects today?

Paste the prompt below into the agent before you change anything. [FINRA](https://www.finra.org/investors/insights/be-mindful-data-aggregation-risks) says screen scrapers sign in with your credentials, and that the risk is especially heightened when you share them. [FINRA](https://www.finra.org/investors/insights/be-mindful-data-aggregation-risks) says to revoke access when you stop using a service, which might take more than deleting the app. If a stored secret is not visible, stop and ask.

### Paste this into your agent

```
List every brokerage or bank connection you use.
For each connection, say whether you hold a raw username and password, an API key or secret, or an OAuth token.
Say which accounts that connection can see, and which permissions it has: read, trade, or move money.
Flag any password stored in a prompt, in this chat, in a .env file checked into a repo, or in a shared config file.
Say whether placing an order needs a confirmation that sits outside you.
Stop and ask before you change anything.
```

### Don't know: stop and ask

- A broker with no row in the table. Stop. Do not treat a missing row as permission to paste a password.
- Where your chat client stores an OAuth token or a refresh token. The broker pages name the auth type. They do not name that file, except the [tastytrade MCP](https://developer.tastytrade.com/docs/sdks-and-tools/mcp-server/) warning that -s project writes a shareable .mcp.json, "the wrong place for a client secret or refresh token."
- A published Charles Schwab server for external models. [Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html) reports that Schwab will prepare model context protocol servers, control what they can access, and not let them move money. This page does not add a row for a server those articles do not link.
- How a bank revokes a screen-scraper session. [FINRA](https://www.finra.org/investors/insights/be-mindful-data-aggregation-risks) says stopping access "might involve more than just deleting the software application." The steps are not on this page.
- Whether an order needs a confirmation outside the agent, when that broker's page does not say. Stop and ask.

## Sources

Checked 2026-10-19.

- [Bloomberg Law](https://news.bloomberglaw.com/banking-law/us-banks-block-ai-agents-attempting-to-move-money-for-customers), Oct 16, 2026
- [Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html), Oct 16, 2026
- [CNBC](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html), Oct 13, 2026
- [FINRA, Know Before You Share](https://www.finra.org/investors/insights/be-mindful-data-aggregation-risks), January 12, 2024
- [TradeStation MCP](https://www.tradestation.com/platforms-and-tools/mcp/), checked 2026-10-19
- [TradeStation ChatGPT setup](https://www.tradestation.com/insights/2026/07/16/mcp-chatgpt/), July 16, 2026
- [Interactive Brokers AI integrations](https://www.interactivebrokers.com/en/trading/ai-integrations.php), checked 2026-10-19
- [NinjaTrader MCP connect](https://docs.ninjatrader.com/mcp/connect), checked 2026-10-19
- [Robinhood, onboarding an external agent](https://robinhood.com/us/en/support/articles/onboarding-an-external-agent/), checked 2026-10-19
- [Robinhood, trading with your agent](https://robinhood.com/us/en/support/articles/trading-with-your-agent/), checked 2026-10-19
- [tastytrade MCP](https://developer.tastytrade.com/docs/sdks-and-tools/mcp-server/), checked 2026-10-19
- [Webull Cloud MCP](https://developer.webull.com/apis/docs/AI-friendly-Resources/mcp), checked 2026-10-19
- [Agent Order Check](/check)
- [Kill switch](/guides/ai-trading-bot-kill-switch)
- [Guardrails](/guides/ai-agent-trading-guardrails)
- [Paper trading](/guides/ai-agent-paper-trading)
- [Broker connectors](/guides/broker-ai-connectors)

Educational only. Not financial advice.

Free check: https://theagentictrader.com/check?utm_source=md&utm_medium=agent&utm_campaign=guides-ai-agent-brokerage-password
Weekly note on broker and agent changes: https://theagentictrader.com/subscribe?utm_source=md&utm_medium=agent&utm_campaign=guides-ai-agent-brokerage-password
Desk Kit, $79 one-time. Full refund within 7 days: https://theagentictrader.com/desk-kit?utm_source=md&utm_medium=agent&utm_campaign=guides-ai-agent-brokerage-password