RBC blocks AI agents after Muse handed a stranger a man’s home address

The buyer arrived at Matt Robb’s building while Robb was out. Muse had given him the address, agreed the price, and answered for Robb in the chat: “Yep I’m here!” Robb found out late that night that a sale had happened without him, arranged by an agent he had asked to run his Facebook Marketplace messages.

What Robb had tapped was a choice between two grants. He tapped “Allow always” instead of “Allow one time” when he asked Muse to handle the sales. The grant covered future messages using a template built from information Muse asked him for, including the pickup address. In Muse’s own record of the arrangement, shown in a screenshot Robb supplied, he delegated the Marketplace messages on 24 September 2026, gave a pickup window of 10 a.m. to 10 p.m., and said cash or e-transfer, never card. The same record has Muse acknowledging that Robb never explicitly asked it to share the address.

Robb told the story himself on X the next day. “It gave out my home address. It agreed to a lowball price I never approved.” The two accounts describe the same tap. Robb says the address was never explicitly authorized. David Singleton, from Meta’s Muse team, replied on X that in similar past cases the team had consistently learned Muse “was following direct instructions and correctly asked for permission.”

That tap was about Marketplace messages. The same agent reaches other apps through connectors, and Meta’s help page says Facebook, Instagram and Threads connect automatically when the accounts sit in the same Accounts Center, with nothing for the user to set up. A connector can be set to retrieve data only, without taking actions, and important actions need the user’s approval by default. Disconnecting stops Muse exchanging data with an app, but information already used may remain in Muse’s memories and conversation history.

RBC blocks AI agents from its authenticated digital properties, and the bank’s customer notice of 27 October 2026 says connections already made “will stop working.” The door it closed is not the one Robb’s buyer walked through. No bank sign-in was involved in the Marketplace sale. The blocked door is the outside agent that signs in to a bank account with a customer’s stored password, acting as the customer. More than 10 million people in the United States and Canada had set up Muse agents in about six weeks after the 8 September launch, Mark Zuckerberg told Meta’s earnings call on 21 October. About a quarter of them used an agent on a given day. The figure counts setups, not users.

The other banks answered in their own verbs. The headline version, four banks blocking, flattens verbs that are not the same. TD said it blocks the agents while it ensures safeguards, authorization mechanisms and oversight are in place, a temporary framing. BMO said it does not permit AI agents to access its digital properties or execute transactions, a standing position stated in the present tense, with no dated new block behind it. CIBC said it does not support personal AI agents directly opening or accessing accounts. Scotiabank said it will limit the agents and closely monitor the concerns. National Bank said only that it is closely monitoring the technology and assessing the opportunities and risks.

The posts from ordinary users split from the official line on whether the block is a phase or a settlement. Sidiq, posting on X on 28 October, read it as a rerun of the last fight over outside software reaching bank accounts with customer credentials. “we had this exact fight over Plaid and screen scraping, banks ended up building the APIs anyway.”

RBC’s own guarantee page already answers the question the coverage left open, in wording a customer can test. The Digital Banking Security Guarantee reimburses eligible unauthorized transactions so long as the customer fulfils stated responsibilities. It will not reimburse losses where the customer did “share any of your Passwords or Personal Verification Questions,” or consented to, contributed to or authorized the transaction. An agent that signs in uses the password the customer gave it.

Marius du Preez, posting on X the same day, noticed what neither document mentions. “first time ive seen a bank risk team ship faster than the agent launch. now wondering how many old oauth grants that agent still has sitting around.” Kyle Evans, also on X, named the missing piece as a product: “agents can find the deal, nobody trusts them with the bank login yet. approval step is gonna be the whole product.” The block stops new sign-ins. The guarantee prices the customer’s own handover. Neither says anything about grants already given, or about an approval step standing between an agent and money leaving an account.

The door exists because the accredited replacement is not running. About nine million Canadians use financial data-sharing services by handing over their confidential banking credentials, a process the Canada Gazette’s regulatory impact statement calls screen scraping. The Consumer-Driven Banking Act received royal assent in March 2026, and its core elements include a prohibition on screen scraping with common rules on consent, liability and security. The banks blocked the method the law was written to replace, before the replacement arrived. Until the accredited channel runs, the only way an outside agent reaches an account is the way screen scraping has worked for years: with the customer’s own credentials.

American banks refused first. Axios reported on 22 October that major American banks had detected unauthorized third-party agents inside customer accounts, some taking actions that appeared independent of instructions. Charles Schwab’s chief executive, Rick Wurster, said the bank was blocking unauthorized agents in the tens and twenties every week, and that Schwab will let outside models connect through controlled authentication for balances and research but not move money. Jamie Dimon, JPMorgan’s chief executive, called outside agents too risky on the bank’s 13 October earnings call. Amazon blocked Muse from its site on 20 September, saying the agent does not identify itself and appears to capture and store customer credentials; Meta replied that Muse has no visibility into people’s passwords or payment methods.

The Financial Stability Board published first, on 15 October. The Financial Stability Board’s final report on artificial intelligence, published 15 October, sets 12 non-binding practices. Agents get unique identifiers and audit trails. Risk-based triggers decide when an agent must seek human approval before transactions above a certain value or actions that may cause irreversible harm. Its text states that “AI agents do not reason like humans and may interpret pre-defined goals in unexpected ways,” and that practices for agentic systems are still emerging. The banks’ statements promise safeguards without naming the identifier or the approval step. Canada’s own regulator, the Office of the Superintendent of Financial Institutions, told federally regulated institutions in a July bulletin to give agents least-privilege access, unique non-human identities and short-lived credentials, and its 8 October risk outlook named frontier AI as a headline risk.

The screen-scraping prohibition is not part of the initial implementation. The first stage of the regulations sets the accreditation, consent and oversight rules, with the Bank of Canada as overseer.