RBC has cut off third-party AI agents that log in with a customer’s password. Businesses wiring agents into their own systems should read that as a design spec.
The block is aimed at borrowed passwords, not at AI.
OSFI’s July bulletin already describes the safer build.
Any agent that signs in as a person is a liability on your books.
RBC is blocking third-party AI agents from signing in to its online banking, and we think the bank made the right call. Its October 27 notice says personal agents need access to accounts and may store passwords to get there, and that those connections will stop working. As a result, the lesson for Canadian firms is simple: an agent should never use a human’s login.
Key points
- RBC’s block covers third-party personal agents reaching authenticated RBC sites, including online banking.
- The problem is the shared password, which leaves no way to tell the customer’s actions from the agent’s.
- OSFI’s bulletin calls for unique non-human identities, least privilege and short-lived credentials for agents.
- RBC’s security guarantee excludes losses when a customer shares a password.
Why did RBC block third-party AI agents?
RBC says personal AI agents need access to online accounts and may store customer passwords to reach them, and that the risks grow as these tools act more on their own. It has decided to block third-party personal agents from direct access to its authenticated digital properties, including online banking. Customers keep the website, the app and RBC’s own tools.
However, read the notice closely and the target is narrow. RBC is not banning AI from banking. It is refusing a specific access pattern: software that walks through the front door wearing the customer’s name. We covered the contract side of that problem in what Canadian bank terms say about AI agents and bank logins. This piece is about the engineering.
What is wrong with giving an AI agent your password?
A shared password collapses two actors into one. When an agent signs in as you, the bank’s logs show you, every permission you hold is open to it, and there is no way to revoke the agent without changing your own password. If the agent is tricked by a malicious web page or email, the attacker inherits your access.
For that reason, it is the mechanism we would put at the centre of any agent review. OSFI’s bulletin on generative and agentic AI names the same two failures: over-privileged access, and shared or inherited credentials that undermine accountability. It adds tool chaining, where one agent action feeds the next, as a way small mistakes compound. We have not tested any agent against a bank login ourselves. The risk follows from how credentials work, not from a lab result.
Meanwhile, the money side is just as plain. RBC’s Digital Banking Security Guarantee, set out on the same page, does not cover losses when the customer shares a password. An agent holding your password is, in contract terms, you.
What does a safe AI agent setup look like?
A safe agent setup gives the agent its own identity, the smallest set of permissions the task needs, credentials that expire quickly, and a human approval step before anything that moves money or data. Every action it takes is logged under its own name, so you can review it and switch it off without touching anyone’s personal login.
| Risk | Agent on a person’s login | Agent with its own identity |
|---|---|---|
| Who the logs show | The person | The agent |
| Permissions | Everything the person has | Only what the task needs |
| Credential | Stored password, reused | Short-lived, just-in-time |
| High-risk actions | Run with no check | Need human approval |
| Switching it off | Reset the person’s password | Revoke one agent account |
| RBC guarantee | Can fall away | Not at risk from sharing |
In short: an agent on a borrowed login looks like the person, holds all of their access and puts the bank guarantee at risk, while an agent with its own identity is scoped, logged and easy to switch off. The own-identity column summarizes the access controls in OSFI’s July 2026 bulletin on generative and agentic AI. The login-sharing column reflects the password risk RBC describes in its October 27, 2026 notice.
In fact, some vendors are already building third-party AI agents this way. Google’s move to give agents their own mailbox, which we looked at in Gemini coworker agents with their own email, is the same idea applied to inboxes.
How can you tell if an AI tool is using your password?
Check how you connected it. If setup asked you to type your bank or software username and password into the tool itself, it is almost certainly storing them. A safer tool sends you to the provider’s own sign-in page and asks you to approve named permissions, which you can later revoke from that provider’s settings.
Other tells include these: the tool runs a hidden browser that clicks through websites on your behalf, it asks for your one-time security codes, or it stops working whenever you change your password. Each points to borrowed credentials rather than a connection the provider approved. Finally, ask the vendor directly, in writing, which method it uses, and keep the answer with your records.
Does the OSFI bulletin apply to my business?
Legally, no. OSFI supervises federally regulated financial institutions, and its bulletin describes sound practices for them. Even so, it is the clearest Canadian checklist for agent access that a regulator has published, and every control it lists is available to a small firm using ordinary identity tools. Treat it as a free design review.
The bulletin also asks institutions to treat models, data, tools and agents as controlled technology assets, and to test what happens when an AI service fails. Above all, that second point matters for any firm that has built a workflow around one agent. If RBC can switch off a connection overnight, so can any other provider you depend on.
What should businesses using third-party AI agents do now?
Start with an inventory. List every agent or automation that signs in anywhere, write down whose credentials it uses, and move the riskiest ones onto their own accounts first. Anything touching banking or payroll should run through an official integration or wait for a human. In most cases, a firm can finish the first pass in an afternoon.
- List every AI agent, browser extension and automation that logs in to a system on someone’s behalf.
- Flag any that use a staff member’s personal username and password. Those come off first.
- Give each remaining agent a separate account with only the permissions its task needs.
- Prefer official APIs or bank-approved connections over tools that drive a browser with a stored password.
- Require a person to approve payments, refunds, data exports and account changes.
- Turn on logging under the agent’s own name, and read those logs weekly for the first month.
- Write down a manual fallback for each workflow in case the provider blocks or retires the connection.
For agents that buy or fill in forms on the open web, our notes on how attackers target AI agents in online stores and reviewing AI agent output before it ships cover the next layer.
Is blocking AI agents bad for customers?
Admittedly, in the short term some customers lose a convenience they liked, and that cost is real. The stronger objection is that banks may use security as cover to keep customers inside their own apps. We take that seriously. Still, it argues for a proper delegated-access standard, not for letting agents keep using passwords in the meantime.
What would change our view: if a bank offered agents a scoped, revocable, logged connection and still blocked them, the security argument would no longer hold. Until that option exists, however, refusing the password route is the defensible position.
What to watch
- Whether RBC or other banks publish an approved, scoped route for third-party agents. No date has been announced.
- Updates to OSFI’s guidance on AI risk following the July 2026 bulletin. Not before 2027 is our working assumption, not a date OSFI has given.
- Agent vendors that switch from stored passwords to separate agent accounts, which is the shift that would make blocks unnecessary.
FAQ
Can I still use third-party AI agents with my RBC account?
Yes. RBC says customers can keep using its website, mobile app and its own digital tools. What stops working is a third-party personal AI agent signing in to RBC online banking directly.
Why is sharing a password with an AI agent risky?
The agent gets every permission you have, its actions look like yours in the logs, and RBC’s security guarantee does not cover losses when you share a password.
What is a non-human identity for an AI agent?
It is a separate account created for the agent alone, with its own scoped permissions and short-lived credentials, so its actions can be tracked and revoked without affecting any person’s login.
Does OSFI regulate small businesses that use AI agents?
No. OSFI supervises federally regulated financial institutions. Its agentic AI bulletin is still a useful checklist for any business, because the access controls it lists apply to agents anywhere.
Our buyer’s test for third-party AI agents: ask whether the product signs in with its own account or with yours. If the answer is yours, the vendor has handed you its security problem.
Fact-checked against RBC and OSFI primary sources on October 29, 2026. We have not tested any AI agent against a live bank account.
