On October 22, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), together with the Canadian Centre for Cyber Security and partner agencies, released the joint guidance Managing AI Token Consumption for Operational Resilience. In the same week, JPMorgan Chase, Citigroup, Bank of America, and Charles Schwab each made clear that unauthorized third-party AI agents may not log into customer accounts or move customer funds. Both developments point to the same compliance reality — AI's pay-per-use pricing and its ability to act on your behalf are becoming risk exposures that enterprises must manage.
What the guidance covers: new attack types and a three-tier priority model
The guidance, published on the Canadian Centre for Cyber Security's website (reference ITSM.00.125), is aimed at organizations adopting third-party "super intelligence" services, with emphasis on critical infrastructure operators and cyber defenders. Among the risks it names, two new attack types stand out: denial-of-tokens and denial-of-wallet attacks.
A "denial-of-wallet" attack doesn't target the system — it targets the bill. Attackers exploit AI's consumption-based pricing with overly complex inputs or AI self-loops (feeding outputs back in as inputs) to maliciously burn through a victim organization's token quota or budget; once the quota is gone, legitimate business grinds to a halt.
The governance framework is a three-tier model: Tier 1 "mission critical" (cyber defence, incident response, threat intelligence) gets the highest priority; Tier 2 "operational" (compliance activities, policy analysis) is continuously monitored and cost-controlled; Tier 3 "productivity" (drafting emails, meeting summaries) can be throttled during peak demand. Supporting measures include streamlining prompts, reusing caches, right-sizing models to tasks (small models or local models for small jobs), standing up a cross-functional AI governance group, feeding token telemetry into the security operations center, and conducting a risk assessment before allowing AI agents to operate autonomously.
In the same week, banks moved first: blocking AI agents from moving money
On October 14, JPMorgan CEO Jamie Dimon said on the earnings call that outside AI agents would not be allowed into customer accounts, citing the danger of "rogue agents." The Financial Times then reported that Citigroup bars third-party AI agents or assistants from logging into customer accounts or transacting directly on its digital banking platforms; Bank of America CEO Brian Moynihan told CNBC that money leaving an account must go through "human in the loop" approval, while the bank is still working out who is liable for "a payment approved by AI."
Charles Schwab CEO Rick Wurster said the firm blocks unauthorized agents dozens of times a week. On October 22, Reuters, citing Axios, reported that several banks are finding and removing unauthorized third-party AI agents lurking inside customer accounts, some of which had tried to execute actions users never requested. The common thread across all four policies: read-only functions like checking balances stay, moving money does not.
Connecting the dots: who is affected and what to do
The two developments are two ends of the same logic: the guidance governs "AI spending," the banks govern "AI moving money." Three groups are most affected — teams running core business on third-party LLM APIs, financial and e-commerce scenarios where AI agents touch customer funds or sensitive data, and critical infrastructure operators.
The actionable checklist follows the guidance: tier AI usage and ring-fence quotas for critical functions; draw authorization boundaries for agents, with separate approval paths for read-only access and money movement, keeping human confirmation for the latter; bring token consumption into security monitoring and treat abnormal spikes like suspected data exfiltration; write quotas, throttling, and degradation guarantees into vendor contracts. The banks' "read-only stays, money movement blocked" approach is a ready-made reference — the point isn't to ban agents, but to stop an agent from signing on your behalf with your password.
Scope: these are U.S. rules — don't treat them as global
The scope needs to be stated plainly. The CISA guidance was issued by a U.S. federal agency together with the cyber agencies of Canada, Australia, the United Kingdom, and New Zealand; it binds organizations in those countries, especially critical infrastructure — it is not a global mandatory standard. The four banks' blocks are each company's own policy, applying only to their own customer accounts.
What Chinese companies can directly borrow is the methodology: cost governance under consumption-based pricing, least-privilege authorization for agents, and human approval for money-movement operations. The Financial Stability Board's recently finalized financial-AI practices — requiring human approval before high-risk agents act (/zh/article/2643-fsb-jin-rong-ai-1-2-xiang-zuo-fa-ding-gao-gao-feng-xian-zhi-neng-ti-dong-shou-qi) — follow the same line. But "who is liable for a payment approved by AI" is a question U.S. banks themselves haven't resolved, and China has no ready answer either — the relevant contracts and internal policies need to be put in place in advance. Treating U.S. regulatory moves as globally applicable rules is the most common misreading in compliance.
