Autonomous AI agents are being sold as the next convenience layer of the internet. Technology companies say their software can search across websites, compare products, book reservations, manage inboxes, and complete purchases on behalf of users. That vision depends on something far less glamorous: permission from the sites those agents need to visit. In recent weeks, a growing number of popular services have begun closing their doors to automated agents, creating a collision between the agentic AI boom and the web's existing security systems, business models, and legal boundaries.
The resistance spans retail, travel, finance, and local services. Yelp has said it only allows AI agents that participate in its paid data licensing program. Delta Air Lines is preventing agents from booking tickets on behalf of users. JPMorgan Chase and Charles Schwab have confirmed that they block AI agents from accessing accounts because of security concerns. Users also report that sites such as Cars.com and Amtrak, which previously worked with their agents, are no longer accessible. Those reports suggest that other companies may be quietly restricting agents without public announcements.
Amazon has become the most visible battleground. The ecommerce giant previously banned an agentic shopping feature from Perplexity and sued the AI startup. Amazon argued that third-party companies purchasing items for customers should operate openly and respect whether service providers want to participate. Perplexity countered that Amazon is protecting its advertising model, because automated agents do not produce the same human eyeballs in front of sponsored products. The startup framed its agent as an extension of the user, arguing that people should be able to hire software labor to act on their behalf. A judge initially ordered Perplexity to stop using agents to shop on Amazon, but an appeals court overturned that ruling. Amazon has since filed an amended complaint, leaving the legal questions unresolved.
Even as that fight continues, major AI companies have released agents of their own. Meta's Muse, xAI's Grok, OpenAI's Dots, and Instinct's agent have all encountered access problems. Amazon said Muse's continued access violates its site policies, and reports describe similar difficulties for other agents trying to use Amazon. xAI owner Elon Musk responded by suggesting he might start a competitor to Amazon. The more frequently agents hit walls, the more urgent the question becomes: how useful is an assistant that cannot complete the tasks it was designed to handle?
One AI safety evaluator said the access restrictions strike at the core of the agentic pitch. If companies are actively working to prevent agents from operating online, then there are fewer useful things those agents can do. That directly affects the perceived value of the companies building them. The promise is not merely that an AI can answer questions, but that it can act across the open web as a human would. Each block shrinks the surface area of that promise.
Security and business incentives collide
Some of the resistance is driven by security. Financial institutions are wary of automated tools that log into accounts, move money, or read sensitive data. A bank may conclude that an agent authenticated as a customer is still an unknown program with unpredictable behavior. Even if the customer authorized the agent, the bank bears responsibility for fraud, account takeovers, and compliance. Blocking agents outright is a blunt but effective defense.
Other sites cite business reasons. Data licensing programs turn access into a paid relationship. Retailers want control over pricing, inventory, checkout flow, and the customer experience. Advertising-supported businesses depend on human attention, and an agent that skips promotions or completes purchases without browsing can undermine revenue. Travel companies also worry about liability when an automated system makes a mistake, misses a schedule change, or books a fare with complex restrictions.
The result is a patchwork. A service may welcome agents through an official partnership while blocking unauthorized agents that mimic a browser. A retailer may allow an agent on one part of its site but block it at checkout. A bank may block account access while still permitting public pages to be read. The lack of a common standard makes the agentic web difficult to navigate for users and developers alike.
Legal fight sets a precedent
The Amazon and Perplexity dispute illustrates how quickly technical access questions become legal ones. Amazon claimed it repeatedly asked the AI company to stop allowing agents to shop on its site. The AI company argued that Amazon does not believe in a customer's right to hire labor or have an assistant act on their behalf. The case raised questions about terms of service, unauthorized access, and whether an AI agent is more like a browser extension, a scraped data service, or an automated user.
The initial court order favored Amazon, but the appeals ruling changed the immediate picture. That back-and-forth has not settled the underlying rules. Instead, it has encouraged both sides to prepare for a longer conflict. For websites, the case is a signal that blocking agents can be defended as a matter of policy and security. For agent developers, it is a signal that access is not guaranteed and may need to be negotiated site by site.
Meta has taken a partnership approach rather than a pure confrontation. The company responded to blocks by arguing that turning away a personal agent means turning away the customer behind it. It said it would rather work with businesses to address concerns than see them lose that customer. Meta has partnered with retailers including Walmart, Gap, Sephora, and Best Buy so that Muse can shop on their sites. Shopify has also opened its network of storefronts to AI agents. These deals show that the future may not be a fully open web for agents, but a set of private agreements and gated integrations.
Agent makers seek workarounds
OpenAI and Google did not immediately respond to requests for comment about the roadblocks facing their agents, and Instinct declined to comment. But the broader industry is already experimenting with ways around the problem. Some agents use browser automation that looks like a human clicking through pages. Others rely on APIs, data partnerships, or merchant-specific integrations. Each approach has trade-offs. Browser automation is flexible but fragile and more likely to trigger anti-bot defenses. APIs are more reliable but require cooperation and often payment. Partnerships provide access but limit the agent to a curated set of services.
Anti-bot systems add another layer of friction. Even when a website has not announced a formal ban, its defenses may treat an AI agent as suspicious traffic. Reports on social media describe Google blocking some accounts that used Muse because of suspicious activity, while other users have reported checkout problems on Walmart despite the Meta partnership. The issue is not always intentional exclusion. Many systems are designed to stop scraping, fraud, spam, and automated attacks. AI agents can trigger those same safeguards because they move quickly, repeat actions, and behave differently from ordinary shoppers.
Cloudflare has played a significant role in helping sites control unwanted AI visitors. After introducing a one-click block for AI crawlers in 2025, the infrastructure provider began blocking crawlers that scrape websites for both search indexing and AI training. The move is part of a wider effort to protect websites from a surge of AI bots that strain infrastructure, flood email inboxes, and compete with humans for limited goods and reservations. Those same tools can affect agents that are acting for a user rather than training a model.
Bot defenses catch humans too
The long-term risk is that the web becomes more hostile to everyone. As sites add more verification screens, CAPTCHAs, and account checks, ordinary users may be asked to prove their humanity more often. An AI safety evaluator warned that such interfaces could soon appear on simple grocery shopping sites, forcing people to jump through hoops to prove they are human using a computer or phone. That friction may be acceptable for high-stakes banking, but it is costly for routine tasks.
For now, the standoff is producing a fragmented internet. Consumers can use agents on some retail sites but not others. They can plan parts of a trip but may have to finish booking manually. They can ask an agent to compare products, but the final purchase may require a human click. The agentic web is arriving not as a single open network, but as a collection of negotiated doorways, blocked paths, and verification gates. As more sites deploy defenses, even human users may face extra steps when shopping for groceries, booking travel, or buying tickets.
Source: The Verge News