Autonomous AI agents are being sold as the next interface to the internet: software that can open a browser, log into services, compare prices, fill in forms, and complete tasks on a person’s behalf. OpenAI, Meta, Google, xAI, Instinct, and other companies have spent the past two years promising that these agents will book dinner reservations, clean out inboxes, buy shoes, and handle mundane errands without human supervision. But the web is not a neutral testing ground. It is a patchwork of private services, advertising businesses, security systems, and legal terms, and a growing number of those services are refusing to let agents in.

In recent weeks, users of Meta’s Muse, xAI’s Grok, OpenAI’s Dots, and Instinct’s agent have reported blocks that prevent their AI agents from performing tasks across top websites. Some of those blocks are explicit. Yelp says it only allows AI agents that pay for its data licensing program. Delta Air Lines is preventing agents from booking tickets on behalf of users. JPMorgan Chase and Charles Schwab have confirmed that they are blocking AI agents from accessing accounts because of security concerns. Other restrictions are quieter. Users say sites that previously worked with their agents, including Cars.com and Amtrak, are no longer accessible, which suggests that more companies may be blocking automated traffic without announcing it.

Key Facts at a Glance

• AI agents from OpenAI, Meta, Google, xAI, and Instinct are being blocked by popular websites.
• Yelp limits agent access to companies enrolled in its data licensing program.
• Delta Air Lines blocks agents from booking tickets; JPMorgan Chase and Charles Schwab block account access over security concerns.
• Users report access problems at Cars.com and Amtrak, suggesting quiet restrictions beyond public bans.
• Amazon has fought Perplexity’s agentic shopping and says third-party purchasers must respect site policies.
• Meta has partnered with Walmart, Gap, Sephora, Best Buy, and others; Shopify opened storefronts to agents.
• Anti-bot systems often treat agents like scrapers, creating false positives and checkout failures.
• Cloudflare’s one-click crawler blocks and 2025 changes are part of a broader effort to manage AI traffic.

The Agent Promise Meets the Gatekeepers

The tension is easy to understand from both sides. For AI companies, an agent is only as valuable as the number of tasks it can complete. A shopping agent that can browse every retailer is more useful than one that can browse only a handful. A travel agent that can book flights, hotels, and rail tickets is more valuable than one that can only search. Every blocked website narrows the agent’s usefulness and weakens the sales pitch that these products will soon handle almost everything people do online. For websites, however, an agent is not necessarily a customer. It may be a bot that consumes bandwidth, bypasses ads, ignores terms of service, scrapes data, or creates security risks. Even a well-behaved agent can look like automation to systems designed to stop fraud and abuse.

The result is a growing standoff between two visions of the web. One vision is agent-first: humans delegate tasks to software, and websites become endpoints that agents call. The other is site-first: publishers, retailers, airlines, banks, and marketplaces decide who gets access, under what terms, and at what price. The second vision is winning in many places right now, not because websites oppose AI in principle, but because they have business models, security obligations, and infrastructure limits that agents threaten to disrupt.

The First Wave of Refusals

The early refusals are concentrated in high-value categories. Travel, finance, retail, and local discovery all involve money, personal data, or advertising revenue. Delta’s block on ticket bookings is a clear example: an agent completing a booking may look like a customer, but the airline wants control over the transaction, the data, and the customer relationship. JPMorgan Chase and Charles Schwab are even more sensitive. Account access involves identity verification, fraud detection, and regulatory obligations. Allowing an outside AI agent to log in and move money or read statements would create risks that banks are not prepared to accept. Yelp’s licensing requirement points to a different concern: data. If an AI agent reads reviews and business information at scale, Yelp wants to be compensated for the value of that data. A licensing program turns access into a commercial relationship rather than a free-for-all.

Cars.com and Amtrak illustrate why the problem may be larger than the public announcements. Users report that agents that once worked on those sites now fail. That pattern is common when websites change their bot defenses, add CAPTCHAs, or deploy new filtering rules. A company does not need to issue a press release to block agents. It can simply update its security stack and let automated traffic fail. That makes the true scope of agent blocking hard to measure. The visible refusals are only the ones that have been confirmed or reported.

Amazon, Perplexity, and the Shopping Fight

Amazon has become the most prominent battleground. The company banned Perplexity’s agentic shopping feature and sued the AI startup, raising legal and practical questions about whether an agent can act as a customer’s representative on a website. Amazon claimed it had repeatedly requested that Perplexity stop allowing its AI agents to shop on the site. It argued that third-party companies purchasing items on behalf of customers should operate openly and respect a service provider’s decision whether or not to participate. Perplexity pushed back by arguing that Amazon does not want AI agents roaming its platform because it would mean fewer human eyeballs in front of its ads. The startup likened its agent to an extension of the user, saying Amazon does not believe in a person’s right to hire labor or have an assistant act on their behalf. A judge initially ordered Perplexity to stop its agents from shopping on the site, but an appeals court overturned that ruling in August. Amazon has since filed an amended complaint.

The dispute matters beyond the two companies. It tests whether an AI agent is legally more like a browser, a user, or a third-party service. A browser merely displays a site; a user makes choices; a third-party service may scrape, automate, and transact at scale. Websites have spent years building terms of service around the assumption that a human or a conventional browser is on the other end. Agents blur that line. They can act with a user’s credentials, follow a user’s instructions, and make decisions inside a session. That makes them useful, but it also makes them hard to classify and easy to block.

Anti-Bot Systems Do Not Distinguish Intent

Even websites that have not announced a ban may still clash with anti-bot systems. These systems are designed to stop scraping, fraud, credential stuffing, ticket hoarding, and other automated abuse. They look for fast navigation, unusual mouse movements, repeated requests, headless browsers, and other signals. A helpful AI agent can trigger the same safeguards as a malicious bot. Reddit users have reported that Google is blocking some accounts that use Meta’s Muse because of suspicious activity. Others have reported checkout problems on Walmart despite Meta’s partnership with the retailer. That does not necessarily mean Walmart is targeting agents. It may mean the agent is being caught in a broader filter that cannot tell a shopping assistant from a script.

Cloudflare has played a central role in helping websites clamp down on unwanted AI visitors. After introducing a one-click block for AI crawlers in 2025, the company began blocking crawlers that simultaneously scrape websites for search indexing and AI training. The move is part of a broader effort to protect the web from an influx of AI bots. Those bots put strain on internet infrastructure, fill email inboxes with automated messages, and make it harder for ordinary people to compete for concert tickets, restaurant reservations, and limited products. The same infrastructure that blocks abusive scrapers will also block some legitimate agents, because intent is difficult to verify at network scale.

Partnerships as the Alternative

Meta has responded to the blocks with a mix of diplomacy and deals. In a post earlier this month, the company said that turning away a personal agent means turning away the customer behind it. Meta argued that it would rather work with businesses to address their concerns than see them lose that customer. Instead of trying to fight Amazon directly, Meta has partnered with retailers such as Walmart, Gap, Sephora, Best Buy, and others to allow Muse to shop on their sites. Shopify has also opened its network of storefronts to AI agents. Those partnerships show a possible path forward: agents get access through negotiated agreements, and websites get controls, data terms, and customer assurance.

That model is less open than the agent-first vision, but it may be more realistic. It gives retailers a way to participate without surrendering control of their storefronts. It gives AI companies a way to offer useful shopping features without constant cat-and-mouse games. It also creates a two-tier web, where agents can complete tasks on partner sites but fail on sites that have not signed up. For users, that could be confusing. An agent may work perfectly on one retailer and break on another. It may book a hotel through one platform but fail on an airline’s direct site. The promise of a universal assistant depends on universal access, and universal access is exactly what websites are reluctant to grant.

The Value Question for AI Agents

The blocks also raise a value question for the AI companies. Chris Canal, the chief executive of the AI safety evaluator EquiStamp, said the impact on the perceived value of companies such as Anthropic and OpenAI is real. One of the central claims about agents is that they will permeate every aspect of life and do anything a person can do online. If companies are actively working to make that not happen, there are fewer useful things the agents can do. That does not make agents useless. It makes them conditional. They can work inside partnerships, on websites that welcome automation, and on tasks that do not require access to sensitive accounts or high-value transactions. But the grand promise of an agent that can do everything is harder to sustain when major airlines, banks, retailers, and marketplaces are building walls.

The companies behind the agents have not offered detailed public responses to every block. OpenAI and Google did not immediately comment on the roadblocks their agents are facing, and Instinct declined to comment. That silence may reflect the awkwardness of the moment. The same companies that market agents as the future of computing are discovering that the web’s gatekeepers can simply say no. Websites are not required to support every automated client, and many have strong legal, security, and commercial reasons to refuse. The agent economy will not arrive all at once. It will arrive through a series of negotiations, exceptions, partnerships, and technical workarounds.

The Friction Tax on Human Users

There is another cost to the blocks: friction for people. As websites deploy more aggressive bot detection, they also deploy more CAPTCHAs, verification screens, and account checks. Canal warned that the web could become more annoying to use as more sites roll out interfaces to confirm that a visitor is not a robot. Those checks could soon appear on simple grocery shopping websites, forcing people to jump through hoops to prove they are human. That friction is a direct consequence of the struggle between automated traffic and site owners. Every bot block is also a potential false positive. Every verification step is a small tax on legitimate users.

The current wave of agent blocks is therefore not just a story about AI assistants failing at checkout or booking. It is a story about who controls the interfaces of the web. AI companies want agents to act as universal intermediaries. Websites want to preserve their relationships with customers, their advertising models, their security controls, and their data rights. Both sides have reasons that make sense from their own vantage point. For now, the websites are proving that access is not automatic. An agent may be able to browse, click, and type, but it cannot force a company to accept it. The web is closing some of its doors, and the agents are learning that not every door opens just because software knocks.

Source: The Verge News