Key facts
- OpenAI, Meta, Google, xAI and other technology companies are racing to deploy autonomous AI agents that can browse, shop, book and transact on behalf of users.
- Yelp, Delta Air Lines, JPMorgan Chase, Charles Schwab, Amazon, Cars.com and Amtrak have been identified in reports as services that block, restrict or frustrate AI agents.
- Amazon and Perplexity are locked in a legal dispute over agentic shopping. A lower court ordered Perplexity to stop, an appeals court overturned that ruling, and Amazon filed an amended complaint.
- Meta says refusing an AI agent means refusing the customer behind it. It has partnered with Walmart, Gap, Sephora, Best Buy and others, while Shopify has opened its storefront network to agents.
- Anti-bot and security systems are catching agents even when a site has not announced a formal ban, creating errors and checkout failures for users.
Autonomous agents are being marketed as the next great leap in computing. OpenAI, Meta, Google, Instinct and several other companies promise that their agents can scour the internet on a user's behalf, handling tasks that range from booking a dinner reservation and cleaning out an inbox to buying a new pair of shoes. The pitch is simple: instead of clicking through dozens of websites, a user can delegate the work to software that understands intent and acts on it. The agent becomes a personal assistant, a shopper, a researcher and a travel planner all at once.
The trouble is that much of the web was not built for that vision. In recent weeks, users of services such as Meta's Muse, xAI's Grok, OpenAI's Dots and Instinct's agent have reported blocks that prevent their AI agents from completing tasks across top websites. Yelp has said it only allows AI agents that pay for its data licensing program. Delta Air Lines is preventing agents from booking tickets on behalf of users. JPMorgan Chase and Charles Schwab have confirmed that they are blocking AI agents from accessing accounts because of security concerns. Some users say sites that previously worked with their agent, including Cars.com and Amtrak, are no longer accessible, suggesting that other companies may be quietly blocking automated visitors without announcing it.
Amazon and Perplexity have become the most visible flashpoint. Amazon previously banned Perplexity's agentic shopping feature and sued the AI startup, raising legal and practical questions about the future of agents on the web. Amazon claimed it had repeatedly requested that Perplexity stop allowing its AI agents to shop on its website. The retailer added that third-party companies which purchase items on behalf of customers should operate openly and respect a service provider's decision whether or not to participate.
Perplexity responded by arguing that Amazon does not want AI agents roaming its platform because it would mean fewer human eyeballs in front of its advertisements. That is a real issue for an ecommerce giant whose business model depends on attention, product discovery and customer data. The AI startup likened its agent to an extension of the user and argued that Amazon does not believe in a customer's right to hire labor, to have an assistant or to have an employee act on their behalf. A judge later ordered Perplexity to stop its AI agents from shopping on the website, but an appeals court overturned that ruling in August. Amazon has since filed an amended complaint.
That legal battle has not stopped OpenAI, Meta and Google from rolling out agents of their own. But they are running into the same problems that Perplexity faced. Muse, Meta's AI assistant, most recently encountered resistance from Amazon, which said its continued access violates site policies. There have also been reports of xAI's Grok, Instinct's AI agent and OpenAI's Dots being unable to use Amazon. xAI owner Elon Musk responded by saying that perhaps he should start a competitor to Amazon. The more places bots struggle to access, the more urgent the question becomes: how useful can an agent really be if large parts of the web are closed to it?
Does this impact the perceived value of the Anthropics and the OpenAIs? I would say absolutely, Chris Canal, chief executive of the AI safety evaluator EquiStamp, said in an interview. One of the claims is that they are going to permeate every aspect of our lives and be able to do anything that we could do online. If there are companies that are actively working to make that not happen, there are just fewer useful things the agents can do.
Meta responded to instances of websites blocking Muse in a post earlier this month. Turning away a personal agent means turning away the customer behind it, the company said. We would rather work with businesses to address the underlying concerns than see them lose that customer. Instead of trying to fight Amazon directly, Meta has partnered with retailers such as Walmart, Gap, Sephora and Best Buy, allowing Muse to shop on their sites. Shopify has also opened its network of storefronts to AI agents, creating an alternative path for automated commerce.
OpenAI and Google did not immediately respond to requests for comment about the roadblocks their AI agents are facing. Instinct declined to comment. The silence is notable because the companies are making expansive claims about what their agents will soon be able to do. Those claims depend not only on advances in artificial intelligence but also on the cooperation of websites that have their own commercial interests, security policies and technical systems.
Even if websites are not banning AI agents outright, agents may still clash with anti-bot systems that have become ubiquitous across the web. Reports suggest that Google is blocking some accounts that use Muse due to suspicious activity, while other users have reported issues checking out on Walmart despite its Meta partnership. There are all kinds of things that are set up not even to block agents, but to block in general bots or programs that are trying to scam or hack, Canal added. These AI agents trigger those same safeguards.
Cloudflare has also played a role in helping sites clamp down on unwanted AI visitors. After introducing a one-click block for AI crawlers in 2025, Cloudflare began blocking crawlers that simultaneously scrape websites for both search indexing and AI training. The move is part of Cloudflare's effort to protect the web from an influx of AI bots that is putting strain on internet infrastructure and wreaking havoc on email inboxes. The same automated pressure could eventually make it even harder to compete against bots when purchasing concert tickets, booking reservations or trying to get hold of certain products.
The security concerns go beyond nuisance. Financial institutions such as JPMorgan Chase and Charles Schwab are cautious about any automated system that logs into customer accounts, even when a human user has granted permission. Banks rely on fraud detection, identity checks and behavioral monitoring. An agent that acts on a customer's behalf can look indistinguishable from a compromised account or a malicious bot. Airlines and travel sites face similar questions about payment fraud, cancellation rules and liability when an automated system makes a mistake. Retailers worry about scalping, inventory manipulation and the erosion of direct customer relationships.
The commercial concerns are just as important. Yelp's requirement that AI agents pay for data licensing reflects a broader tension between the open web and the value of structured information. Amazon's resistance to agentic shopping reflects its desire to control the storefront, the advertising experience and the relationship with the buyer. Meta's partnerships with retailers point to another model: allowlisted access, negotiated terms and formal integration rather than open-ended browsing by anonymous bots. Shopify's decision to open its storefront network to agents suggests that some commerce platforms see automated shopping as an opportunity rather than a threat.
The technical layer is messy as well. AI agents often rely on browsers, automation frameworks and cloud infrastructure that websites already associate with scraping and abuse. Anti-bot vendors fingerprint devices, inspect traffic patterns and require challenges to prove that a visitor is human. Legitimate agents can be misclassified, especially when they move quickly, open many pages or attempt to complete checkout flows. Partnerships and application programming interfaces can solve some of those problems, but they require coordination between agent makers and websites. They also create a two-tier web in which approved agents get access while others are blocked.
The result is a web that is becoming less open in practice, even if it remains open in principle. Agent makers want universal access because their products become more valuable when they can reach every service. Websites want control because their businesses depend on advertising, data, security and customer loyalty. Users want convenience, but they also want their accounts and payments protected. Regulators have not settled the rules, and courts are still working through cases such as the dispute between Amazon and Perplexity. Every block, lawsuit and partnership adds another layer to the debate over whether an automated visitor is a customer, a security risk or both.
For users, the practical effect is already visible. An agent that can compare prices on one site may fail on another. A shopping assistant that works with a partnered retailer may encounter a robot check at checkout. A travel agent may be able to research flights but not complete a booking. Those failures are not abstract. They determine whether people trust agents with important tasks or treat them as novelties that work only in narrow circumstances. The more friction users encounter, the more likely they are to fall back on manual browsing.
For the companies building agents, the challenge is to persuade websites that automated access can be safe, accountable and commercially useful. That may require identity standards for agents, clear permission models, payment mechanisms and audit trails. It may also require new agreements that compensate sites for data and transactions. For websites, the challenge is to distinguish helpful agents from abusive bots without making the web unbearable for ordinary people. The rise of verification screens, account checks and one-click blocks suggests that many sites are choosing caution first.
The friction is becoming a feature of the agent economy. The promise of an assistant that can do anything online depends on a web that is willing to let it in. Right now, many of the most important doors are closing, and the companies that want to walk through them are still negotiating the terms of entry.
Source:The Verge News