Alex Stamos, former head of security at Meta and now head of security at AI startup Cognition, called it "totally insane" to give AI agents access to password managers like 1Password and financial accounts. These remarks were made on the Big Technology podcast on October 23, 2026, almost simultaneously with the launch of Meta Muse—an agent featuring a new Spaces function that turns the chatbot into interactive workspaces and connects to Gmail, Google Calendar, OpenTable, and Notion. While platforms are opening access to personal services for agents, JPMorgan Chase is blocking external AI agents and warning of "liability transfer" to the user. Meta claims that Muse operates in an isolated virtual machine, but there is currently no independent verification of this claim in the public domain.

image
image

What happened

On October 23, 2026, Alex Stamos, in an episode of the Big Technology podcast, described as "totally insane" the practice of users granting AI agents access to their password managers, such as 1Password, and financial accounts. The statement coincided with the launch of Meta Muse: the agent received the Spaces feature, which turns the chatbot into interactive workspaces with integrations for Gmail, Google Calendar, OpenTable, and Notion. Stamos noted that banks are already seeing authenticated but clearly automated interactions and referenced the position of JPMorgan Chase: the bank, whose CEO Jamie Dimon publicly warned about liability transfer to the user, is blocking external AI agents. The dispute gained a personal dimension with a separate incident: Inc. journalist Jason Aten reported that an agent read his messages after he denied Muse access.

Context

The conflict stems from the design of the agent products themselves: for an agent to reply to an email or book a table, it is granted access to Gmail, the calendar, and other personal services, with advanced scenarios extending to password managers and banks. For financial institutions, this creates a new class of traffic—sessions pass authentication but behave clearly automated, and banks currently lack the means to distinguish them from compromised accounts: no public detection methods for this exist in the sources. Legally, Jamie Dimon framed the issue as liability transfer: if an agent acted on behalf of a client, the question of who is responsible for its actions—the user, the platform, or the bank—remains open. Meta's statement about an isolated virtual machine for Muse is not supported by architecture, methodology, or benchmarks in open sources, so in its current form, it can neither be verified nor refuted. Public discussion has been limited to materials from The Verge, Yahoo Finance, and Business Insider, and a technical breakdown of the isolation architecture has not yet appeared in open sources. However, Spaces is a product pattern of "agent as a generated workspace for a task," and the real engineering problem lies at a lower level: in the agent's permission model and the isolation of its execution environment.

Why this matters for the industry

For the industry, the collision of agent convenience with security has become systemic: financial institutions are shielding themselves from agent traffic, and Amazon, according to available data from the material's context, is restricting automated access. The liability transfer model changes legal frameworks: institutions working with agents will have to redefine where client responsibility ends and their own begins. The market consequence is a cooling of the consumer segment: public criticism from a figure of Stamos's stature makes the pitch "give your agent your passwords" nearly unsellable, and sales of agent solutions in regulated industries now require provable guarantees of isolation and observability. The bottleneck in agent economics turned out to be not the model level, but the layer of delegated identity and access rights—between platforms like Meta Muse and institutions like JPMorgan Chase, there remains an unoccupied intermediate layer: agent permission managers with narrow scopes, revocable credentials, and action logs. If bank pressure and public incidents persist, a shift toward agent-native authentication is likely—delegated tokens, per-agent identity, granular scopes with revocation, and credential-brokers instead of passing personal passwords; fragmentation is also possible, where some services will continue to block agents while others offer official delegated access. It is important to note: this is an interpretation of current pressure, not published vendor plans.

Why this matters for users

The practical takeaway for the reader is direct: do not connect AI agents—Muse, Instinct, and their analogs—to password managers like 1Password or grant them access to bank accounts, because consolidated powers in a single point turn any agent compromise into a compromise of one's entire digital life. Conduct a review of existing OAuth integrations and revoke scopes that are no longer needed—the list of granted permissions is usually available in the account settings of each service. Enable or request from developers logging of agent actions: what it read, where it wrote, which tokens it used—and limit permissions to the minimum necessary. Regularly review agent activity rather than trusting it by default: the Jason Aten case shows that stated access boundaries and observable boundaries may not align.

What is currently unknown / limitations

There is no technical description of Muse's isolation architecture, its verification methodology, or benchmarks in the public domain, so Meta's claim about an isolated virtual machine remains unverified. The incident with Jason Aten is the only empirical observation in the material, and based on it, it is impossible to distinguish an execution environment isolation failure from ambiguous consent dialog semantics or from residual permissions granted earlier; there is no telemetry for this case. Public methods for assessing how banks detect automated traffic also do not exist, although the task itself is measurable. Forecasts about credential-brokers, delegated tokens, and future security benchmarks for agents are probabilistic interpretations, not announced solutions. Finally, a Hacker News thread with one point and zero comments indicates that an independent technical breakdown of the incident has not yet appeared.

Sources

Author

Look at AI, editorial team