Why Amazon and Banks Are Blocking AI Agents

For two years, the industry promised that an AI agent would shop for you, book a flight and move your money. By autumn 2026, it had become clear that an agent first has to get through the door - and those doors are closing. Amazon, Delta, Yelp and some of the biggest US banks are turning away agents from Meta, xAI and OpenAI. I think this is more than a technical glitch. It points to an internet where agents can go only where someone has paid to let them in.

On Friday, 17 October 2026, The Verge published an article by Emma Roth whose headline summed up the previous few weeks: websites are closing their doors to AI agents. Users of Meta’s Muse, xAI’s Grok, OpenAI’s Dots and the Instinct agent have been reporting the same problem for weeks. An agent gets a task, opens a retailer’s, airline’s or bank’s website, then stalls at a verification screen, an access-denied message or a blank page. The day before, Charles Schwab CEO Rick Wurster told Bloomberg TV that his company blocks dozens of attempts each week by major AI agents to access customer accounts.

It is easy to dismiss this as temporary friction, the kind that comes with any new technology. I think it is more lasting than that. Three different forces are behind the blocks: security, money and control of the customer relationship. Only the first is discussed openly. Europe has already been through a similar dispute, a decade ago, in banking and under a different name.

Which companies have blocked AI agents?

The list is long and varied. Amazon cut Muse off from its store around 20 September and, according to The Verge, treats Grok, Dots and Instinct similarly. This is not the first time: Amazon has been in a dispute with Perplexity over its Comet browser since November 2025. The case went to court, and in August an appeals court overturned an injunction Amazon had previously secured (I wrote about the ruling in the Comet shopping-bot case). Yelp told TechCrunch plainly that it does not admit non-human traffic unless an agent has paid for access through its data licensing programme. Delta does not let agents buy tickets. United’s terms prohibit the use of robots and “other automated devices” without written permission.

Then there are the banks. JPMorgan Chase and Charles Schwab confirmed that they block agents, and Bloomberg reports that Citi and Bank of America do the same. Some blocks happen quietly: users say agents have stopped working on Cars.com and Amtrak’s website, though neither company has announced a change. Others are accidental. Walmart is a Meta partner, yet an agent can still get stuck at a “confirm you are human” button because ordinary bot protection cannot tell a malicious script from an assistant acting for a customer. Some users have linked Muse’s problems to a change Cloudflare made to its default crawler protections on 15 September. Cloudflare told TechCrunch it has no data showing that personal agents are being blocked.

First reason: no one knows who is responsible

Wurster put the issue most plainly. The problem is not that the agent is stupid. It is that customers hand over their username and password, then the agent acts on their behalf in a place the bank cannot see or understand.

Wurster also raised the question that matters most here: who is responsible if something goes wrong? JPMorgan CEO Jamie Dimon said during an earnings call that nobody wants “rogue agents” - potentially thousands of them. That is not hysteria. An agent that knows an account password is an ideal target for a prompt injection attack: a hidden instruction on a website it visits could make it initiate a transfer the account holder never intended. I have written about who is responsible when an AI agent gets out of control and Muse sharing a home address without permission.

Schwab is not saying “never.” It is saying “not this way.” The company says external language models will be able to connect through MCP servers with controlled authentication. They may be able to check balances and find information, but they will not be able to move money. Schwab is also promoting its own AI assistant. The pattern is worth watching: an outside agent gets a window; the in-house agent gets the keys.

Second reason: agents do not watch ads

Security explains the banks’ position. It does not explain Yelp, which says plainly that it will let an agent in if it pays. Nor does it fully explain Amazon. Here, the less openly discussed economics come into view.

An online store is not just a shelf of products. It is a machine that makes money by getting customers to look: at recommended products, sponsored results, “customers also bought” suggestions and promotions the retailer wants to sell right now. Amazon has been making more and more money from advertising for years, and ads work only when someone sees them. An agent does not browse. Give it the instruction “buy the cheapest filter for this vacuum cleaner” and it can compare prices at three stores, make the purchase and leave. It will not see a promoted bundle, be tempted by premium delivery or add another item to the basket. For the store, that is a customer who pays for the product but not with their attention.

Slashdot readers discussing The Verge’s article raised another issue: price transparency. A seller that changes prices dynamically may not want thousands of agents comparing them in a second every time someone searches for shoes. From a customer’s point of view, that sounds ideal. From a retailer’s, it threatens margins built on people not bothering to compare.

Critics make a similar argument about banks: an agent that moves savings to an account with a better interest rate is a problem for a bank not because it is dangerous, but because it is effective. Banks have not confirmed that accusation, but it is hard to dismiss.

Third reason: who owns the customer relationship?

Meta responded to the blocks with a line that was both clever and a little cheeky:

Clever, because it is true: behind the agent is a person with a payment card. Cheeky, because Meta built its empire on the idea that it - rather than publishers and retailers - owns the relationship with the user. Now it wants the same position in shopping. Meta’s agent sits between customer and store, deciding where the order goes. The store risks losing not just a transaction, but contact with the customer, data about them and the chance to build loyalty.

Elon Musk had his own response to Grok being blocked: perhaps he should start a competitor to Amazon. It sounds like a joke, but it captures what is at stake. The dispute is not about whether agents are useful. It is about who gets to be the gatekeeper: the retailer, the agent platform or a third party such as Cloudflare, which already operates a marketplace where AI bots pay for access to content.

Europe has seen this before: PSD2

For readers in Europe, this story may sound familiar. Before 2019, financial management apps and some payment intermediaries worked much like AI agents do today: customers gave them their bank username and password, and the services logged in on their behalf and read the screen. This was called screen scraping. Banks opposed it for the same reasons Wurster gives today: they did not know who was on the other end or who would be responsible for any harm.

The EU settled that dispute with the PSD2 directive and rules on strong customer authentication, which took effect on 14 September 2019. The compromise was straightforward. An intermediary had to be licensed and identify itself to the bank. The bank had to provide a proper interface - an API - and could not discriminate against it. Customers had to consent to a specific scope of access and could withdraw that consent. In Poland, banks prepared a shared standard called PolishAPI, developed under the auspices of the Polish Bank Association. “Pretending” to be the customer anonymously stopped being the norm and became a fallback for when a bank’s API was not working.

It matters what PSD2 did not do. It did not ban intermediaries or let banks cut them off. It made both sides negotiate under rules set by law, rather than by whoever held the stronger position. In the US, there is no equivalent framework for agents, so every retailer and bank is making its own rules. That helps explain the chaos of recent weeks.

Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →

What this means for you

The figures from Gemius offer a snapshot of attitudes in Poland, not a measure of how people elsewhere use AI. In that survey, 65% of respondents said they used AI tools, but 71% did not want AI to make purchasing decisions on its own. It is one country-specific data point, not evidence of a global trend.

I see three possible scenarios, and none is the open internet promised by AI companies’ marketing.

• An internet of deals. Agents can go where their makers have signed agreements. Meta is already moving in this direction: rather than fight Amazon, it has struck deals with Walmart, Gap, Sephora and Best Buy, while Shopify has opened its stores to agents. The quality of your agent would then depend not on the model but on its company’s partner list, much as the quality of cable TV depends on the channels in your package.
• An internet of toll gates. An intermediary such as Cloudflare charges each agent for access and shares the fee with the website. In this model, the agent pays for what it does not pay in attention. It may be fair, but it is expensive, and the cost will eventually show up in the user’s subscription.
• An internet of rules. A regulator does for agents what the EU did for payment intermediaries: require licensing and identification, define the scope of consent and prohibit discrimination. This is the slowest option, but the only one that gives customers the right to send their own agent while letting a store know who it is dealing with.

My view is that Europe will end up somewhere between the second and third scenarios, and the US somewhere between the first and second. The practical lesson for retailers and banks is already clear. Organisations that treated PSD2 as an unwelcome chore in 2019 spent years patching their interfaces. Those that built good APIs gained partners. Agents may follow the same pattern: a store that offers a predictable, secure way in with clearly defined permissions can win orders. A store that relies only on an “I am human” button may end up blocking not machines, but the customers who sent them.

The promise of an AI agent was simple: tell it what you want and it will take care of the rest across the whole internet. Autumn 2026 is showing that “the whole internet” was an assumption, not a fact. An agent will be only as good as the agreements behind it, and as safe as the rules someone eventually writes down. Until then, the best agent for moving money is still your thumb on your own phone.