Agent Credential Sharing.
Agent credential sharing is giving an AI agent your own username and password so it can log in as you. Delegated access replaces it with a scoped, revocable grant that names the agent.
Credential sharing is how most consumer agents got into accounts before delegated access existed for them. It works, which is why it spread, and it fails every test a CIAM system cares about: no scope, no audit trail that separates agent from person, no revocation short of a password reset, and MFA prompts the agent either breaks on or is handed the codes for.
Bank of America's email is notable less for the advice than for the liability line. It shifts the risk of shared credentials onto the customer, which is a strong incentive for both sides to move to proper delegation. Sources: TechCrunch, October 27, 2026 and TechRadar.
Our reading. Blocking agents only pushes users to share passwords more quietly. The better move is to offer a sanctioned path: an OAuth grant with agent-level consent, or a protocol such as the Personal Agent Protocol, and then treat password-based agent sessions as higher risk. The authentication for AI agents guide covers the delegated options.
Common questions
Is it safe to give an AI agent my bank password?
Banks advise against it. Bank of America's October 2026 email told customers not to share credentials with AI tools or agents and said customers are responsible for activity resulting from that access. A password gives the agent everything you can do, with no limit and no separate way to revoke it.
Who is liable if an AI agent misuses shared login credentials?
Under Bank of America's stated position, the customer is responsible for activity resulting from credentials they chose to share. Terms differ by bank and country, and the question has not been widely tested in court, so check your provider's account agreement.
What should replace credential sharing for AI agents?
Delegated access. The service issues the agent its own token through an OAuth grant or an open banking connection, scoped to specific actions, time-limited, revocable, and tied to a named agent. The person signs in on the service's own page and the agent never sees the password.
How can a service tell an agent from a customer using the same password?
Often it cannot, which is the core problem. Agent traffic detection can flag automated sessions, but the durable fix is to give agents their own credentials so their activity is labeled from the start.
Related terms
In the guides
Account Takeover Defense: A Layered Approach for 2026
ATO is the single largest CIAM threat in 2026. The defense stack is layered, credential stuffing protection, MFA, session management, and recovery design, each addressing a different attack class.
Authentication for AI Agents: OAuth Patterns for Non-Human Identity
How AI agents authenticate in 2026. The on-behalf-of pattern, delegated agent identity, OAuth 2.1 Dynamic Client Registration, and where the patterns are still being invented.
Token Management for AI Agents: Lifetimes, Rotation, and Revocation at Machine Speed
Agent tokens are stolen faster and used harder than human tokens. How to set lifetimes, rotate refresh tokens, scope per-tool, and detect anomalies in production agent deployments.