Schwab and JPMorgan Lock Outside Agents Out of Customer Accounts, Opsin Finds Agents Over-Permissioned, and Step 5 Preview's Open Weights Are Hard to Confirm

Three stories this week are about who gets to act, with what access, and how much you can verify before you build on it. We could not open most primary pages from our environment, so details come from search summaries and secondary coverage, and we flag where sources disagree or where a figure is a vendor claim.

1. Banks Draw the Line at Credentials and Money Movement

Charles Schwab CEO Rick Wurster said the firm is blocking unauthorized AI agents, Meta's Muse among them, that try to move client money. On JPMorgan's October 13 earnings call, Jamie Dimon said the bank will not let just any outside agent in, calling it too risky for clients and the bank. Per trade coverage, a JPMorgan spokeswoman said third parties cannot collect customers' banking credentials and log in on their behalf.

The detail that matters for builders is what stays allowed. Reporting says Schwab permits outside tools to connect through MCP servers under rules it sets, which can check balances and do research but not move money, and JPMorgan keeps read-only data access through connectors like Plaid. Schwab also steers clients to its own assistant, Charley. Some observers think revenue is part of the motive, for example agents sweeping idle cash into higher-yield products, but that comes from secondary reporting, not from either bank.

If your chatbot touches third-party accounts, design for the line these firms are drawing: use sanctioned APIs or MCP connectors instead of stored passwords or browser automation, default to read-only, and put any write action behind an explicit, separately authorized step. A sketch:

type Scope = 'read' | 'write';
const TOOLS: Record<string, Scope> = { get_balance: 'read', transfer: 'write' };

function allowed(tool: string, userScopes: Scope[], confirmed: boolean) {
  const need = TOOLS[tool];
  if (!need || !userScopes.includes(need)) return false;
  return need === 'read' || confirmed; // writes need a user click, not model text
}

2. Opsin Raises $21M After Finding Agents Over-Permissioned

On October 15, AI governance startup Opsin announced a $21 million round co-led by SYN Ventures and Race Capital. It says its platform maps each agent's purpose, permissions, data access, tools and activity across agents employees build in Microsoft Copilot, Claude, ChatGPT Enterprise and Gemini. Opsin also reported from its customers' data that 93% of misaligned tools connected to agents had full, unrestricted access, and only 1 in 200 required human approval before acting. The company did not disclose how many agents or tools the sample covered, and this is a vendor's own analysis from a firm selling the fix, so treat the numbers as directional.

Even so, the pattern is easy to recognize in any tool-calling chatbot: tools get wired up with broad access during prototyping and nobody narrows them. A cheap audit is to list every tool and record its scope, whether it writes, and whether a human approves it. Anything that writes without approval is the first thing to fix.

3. Step 5 Preview: Check the Weights Before You Plan Around Them

Sources describe StepFun's Step 5 Preview as a sparse mixture-of-experts model with 600B total parameters and about 27B active per token, aimed at long-horizon agentic work, with an API reportedly opening September 20. Beyond that, the reports conflict. One lists a 256K context window and another 1M tokens. One places it among the top three open models on the Artificial Analysis index, another only in the global top 25. One blog says the Hugging Face repository held only a .gitattributes file at launch, with an open-weights release dated October 15, and we found nothing confirming the weights are actually downloadable.

The practical rule is that "open weights" announced is not "open weights usable." Before committing to self-hosting, confirm the repository contains weights, a license and a model card, and run your own evaluation instead of relying on reposted rankings:

huggingface-cli download stepfun-ai/Step-5-Preview-BF16 --include "*.json" --dry-run

Conclusion

Access, permissions and verification are the through-line. Banks are separating read-only access from money movement, the audit data suggests many teams never narrowed their agents' tools, and a headline model release still needs a check that the artifact exists. Prefer sanctioned connectors over credentials, scope tools to least privilege with human approval on writes, and verify vendor claims against primary sources before you plan around them.

— Maya