Banks, airlines and retailers are turning AI agents away. Your company is on both sides of that door

What happens to an agent that can do the task when the website will not let it in?

The Verge’s Emma Roth gathered the answer on October 17. Users of Meta’s Muse, xAI’s Grok, OpenAI’s Dots and Instinct report agents blocked on major websites. Some of the restrictions are confirmed policy: Yelp told TechCrunch it allows only agents that pay for its data licensing program; Delta Air Lines is preventing agents from booking tickets on behalf of users; JPMorgan Chase and Charles Schwab confirmed they block agents from accessing accounts, citing security. Others are reports from users, such as Cars.com and Amtrak no longer working, which may or may not reflect a decision. Amazon, which sued Perplexity over its shopping agent last year, says Muse’s “continued access” violates its policies; the Perplexity case remains in litigation after an appeals court overturned an injunction in August and Amazon filed an amended complaint.

Not every failure is a ban. Anti-bot systems built to stop scraping and fraud also stop agents, and some users report accounts flagged for “suspicious activity.” Meanwhile Meta has partnered with Walmart, Gap, Sephora and Best Buy so Muse can shop on their sites, and Shopify has opened its storefronts to agents.

Most of this is consumer news. The enterprise lesson is that every company sits on both sides of the door.

As the company deploying agents

Many enterprise agent plans quietly assume a browser: an agent that books travel on an airline site, pulls invoices from a supplier portal, checks a bank balance, files a form on a government site. Browser automation makes those demos easy. It also makes the integration depend on a counterparty that never agreed to it.

The Verge’s reporting shows how that dependency fails. The counterparty can change its terms, its anti-bot rules or its login flow at any time and with no notice. A blocked agent is the mild outcome. The worse one is an anti-fraud system flagging and locking the company’s own account at a bank or supplier because an agent behaved like a bot, which it is.

Three rules follow:

• Classify every external dependency of an agent as official API, contracted partner integration, or unofficial browser automation. Only the first two belong in a production workflow with a service level. The third is a prototype.
• Never design around a block. Rotating identities, solving challenges or disguising an agent as a person is a terms-of-service and possibly legal problem, and the counterparty’s security team will treat it as an attack. A refusal is information about the integration you need to negotiate.
• Plan the blocked path. When an agent cannot reach a site, it should stop and hand the task to a person with what it found, not improvise; we saw what blocked agents do when nobody designed that path.

As the company whose site agents visit

The other side is less discussed. If you run a bank, an airline, an insurer, a marketplace or any customer portal, agents acting for your customers are already arriving, and “block everything” is a policy with costs. Meta’s line, “turning away a personal agent means turning away the customer behind it,” is self-interested and also partly true.

The banks’ security concern is real. An agent logging in with a customer’s password is credential sharing, and the bank cannot tell the agent from an attacker using stolen credentials. The answer is not to open the login page to bots. It is the pattern banking already knows from open banking and payment APIs: delegated access with scoped, revocable tokens, so the customer grants an identified agent specific permissions (read balances, not move money) and the bank can see and revoke it. Signed agent credentials such as ServiceNow’s AI Passport point the same way for the enterprise side.

Yelp’s choice shows a second model: agents are welcome if they license the data. Meta’s retail partnerships show a third: agents are welcome as a sales channel, under an agreement. We looked at that third path when Radisson treated an AI assistant as a booking channel with the transaction kept on its own site.

The decision to make now

For your own properties, write an agent access policy with the same care as an API policy: which agents may do what, authenticated how, on whose behalf, with what audit trail, and through which interface. Block, license, partner or delegate are all defensible; having no decision is not, because your anti-bot vendor is making it for you by default.

For your agent programs, list which workflows depend on websites you do not control. Those are not integrations yet. They are negotiations that have not started.