Key facts

• Autonomous AI agents are facing growing resistance from major websites.
• Users of Meta's Muse, xAI's Grok, OpenAI's Dots, and Instinct's agent report blocks on popular services.
• Yelp allows only agents that pay for its data-licensing program.
• Delta Air Lines prevents agents from booking tickets for users.
• JPMorgan Chase and Charles Schwab block agent access to accounts over security concerns.
• Cars.com and Amtrak users say access that once worked has stopped.
• Amazon banned Perplexity's agentic shopping feature and sued the company.
• A court initially ordered Perplexity to stop; an appeals court overturned that ruling in August, and Amazon filed an amended complaint.
• Meta has partnered with Walmart, Gap, Sephora, Best Buy, and others, while Shopify opened its storefront network to agents.
• Anti-bot systems and Cloudflare controls are also blocking or challenging agents, creating false positives and checkout problems.

Autonomous AI agents are the most heavily promoted idea in consumer artificial intelligence. OpenAI, Meta, Google, and a wave of startups say their agents can search the internet, compare products, book reservations, manage inboxes, and even buy goods on a user's behalf. The pitch is simple: give an agent a goal, and it will handle the clicks, forms, and confirmations that normally consume time. The reality is more complicated. Across retail, travel, finance, and everyday services, websites are putting up barriers that prevent agents from completing tasks, or at least make those tasks much harder.

A promising pitch meets a guarded web

The friction is not limited to one company or one type of website. Users of Meta's Muse, xAI's Grok, OpenAI's Dots, and Instinct's agent have reported failures when trying to use major services. Some sites block the agent outright. Others allow browsing but stop short of purchases, bookings, or account changes. Still others challenge the agent with bot-detection systems that were designed to stop scrapers, fraudsters, and automated attacks. For consumers, the experience can look like a broken assistant. For the companies building agents, it is a strategic problem: an agent that cannot access the services people rely on has far less value than the marketing suggests.

The open web was never truly open for machines. Websites have long used terms of service, login walls, rate limits, CAPTCHAs, and fraud monitoring to control automated traffic. Those systems protect privacy, reduce abuse, and keep infrastructure costs down. But they also create a gray zone for AI agents that act on behalf of a human. An agent may be authorized by its user, yet it still looks like a bot to the website. That mismatch is now at the center of a widening dispute over who gets to automate the web, and under what conditions.

Retail, travel, and finance draw lines

Some companies have made their positions explicit. Yelp allows AI agents only if they pay for its data-licensing program, according to reports. Delta Air Lines is preventing agents from booking tickets on behalf of users. JPMorgan Chase and Charles Schwab have confirmed that they block agents from accessing accounts because of security concerns. Those decisions reflect different priorities. A bank cannot easily distinguish between a helpful agent and a compromised account. An airline may want to control the booking flow, verify the traveler, and manage fraud risk. A reviews platform may see agent access as a data business rather than a consumer convenience.

Other blocks appear less formal. Some users say Cars.com and Amtrak were previously accessible to their agents but are no longer. That pattern suggests that even companies that have not announced a policy may be filtering automated traffic quietly. The result is a patchwork. An agent may work on one retail site and fail on another. It may book a hotel but not a flight. It may read a page but not complete a transaction. That inconsistency is difficult for users to predict and expensive for developers to manage.

The Amazon and Perplexity dispute

Amazon has become the most visible battleground. The ecommerce giant previously banned Perplexity's agentic shopping feature and sued the AI startup. Amazon said it had repeatedly asked Perplexity to stop allowing its agents to shop on its website. The company argued that third parties purchasing items on behalf of customers should operate openly and respect whether a service provider wants to participate. Perplexity pushed back, arguing that Amazon's opposition was driven by advertising economics. If an agent completes a purchase without a human browsing product pages, Amazon loses the opportunity to show ads and promotions. Perplexity also framed its agent as an extension of the user, comparable to hiring an assistant to act on one's behalf.

The legal fight has moved in several directions. A judge initially ordered Perplexity to stop its agents from shopping on Amazon's website. An appeals court later overturned that ruling in August. Amazon has since filed an amended complaint. The case has become a test of how old rules about automation, terms of service, and unauthorized access apply to a new generation of agents. It also highlights a practical question: if a user asks an assistant to buy something, is the assistant a tool, a representative, or an unauthorized bot? The answer may vary by jurisdiction, by website, and by the specific task.

Meta's partnership strategy

Meta has taken a different approach with Muse. After reports that websites were blocking the assistant, Meta argued that turning away a personal agent means turning away the customer behind it. The company said it would rather work with businesses to address concerns than see them lose that customer. Instead of fighting every block, Meta has partnered with retailers including Walmart, Gap, Sephora, Best Buy, and others so that Muse can shop on their sites. Shopify has also opened its network of storefronts to AI agents. The strategy suggests a possible future: agents may not roam the entire web freely, but they may operate inside negotiated partnerships with clear rules.

That model has advantages for merchants. They can control the experience, maintain security, and track inventory and pricing. They can also decide what data to share and how to handle returns, payments, and customer service. But it creates a tiered web. Large platforms may strike deals, while smaller sites are left to block agents or accept unwanted traffic. Consumers may find that their assistant works well with a handful of partners and poorly everywhere else. The value of an agent then depends less on the model's intelligence and more on the business development deals behind it.

Anti-bot systems and false positives

Even when a website does not ban AI agents outright, agents may collide with anti-bot systems that have become ubiquitous. These systems look for patterns that resemble automation: rapid page loads, repeated form submissions, unusual mouse movement, fresh accounts, or traffic from data centers. AI agents can trigger all of those signals. Online user reports suggest that Google has blocked some accounts using Muse because of suspicious activity. Other users have reported problems checking out on Walmart despite its partnership with Meta. Those incidents point to a gap between corporate policy and technical enforcement. A company may welcome agents in principle, but its security stack may still challenge them in practice.

An AI safety evaluator told reporters that many safeguards were never designed specifically for agents. They were built to stop bots and programs that try to scam or hack websites. AI agents trigger the same safeguards because they perform many of the same actions. The result can be frustrating for users who are not doing anything malicious. A person asks an assistant to buy groceries, and the assistant gets stuck behind a verification page. A traveler asks an agent to change a seat, and the airline's fraud system flags the session. These false positives add friction to tasks that are supposed to become easier.

Cloudflare has played a major role in helping sites clamp down on unwanted AI visitors. After introducing a one-click block for AI crawlers in 2025, the company began blocking crawlers that simultaneously scrape websites for search indexing and AI training. The move is part of a broader effort to protect websites from a surge of AI bots that strain infrastructure, flood email inboxes, and compete with humans for limited goods and services. The same controls can affect agents that are not training models but are acting for users. That overlap makes policy design difficult. A website may want to allow a personal assistant while blocking a data scraper, but the technical signals can look similar.

Why sites are pushing back

Websites have several reasons to resist agent traffic. Advertising is one. Many free services depend on users seeing ads, and an agent that completes tasks without browsing can reduce ad impressions. Security is another. Banks and retailers face fraud, account takeover, and payment disputes. If an agent acts on a user's behalf, who is responsible when something goes wrong? Terms of service are a third. Many sites prohibit automated access or require written permission. Data licensing is a fourth. Some companies see agent access as a commercial use of their content and want to be paid. Infrastructure is a fifth. Bots can consume bandwidth, scrape inventory, and make it harder for human customers to buy scarce products.

There is also a competitive dimension. Agents could redirect purchases, reshape search traffic, and weaken the relationship between a website and its customer. If an assistant becomes the main interface, the website risks becoming a backend supplier with less control over pricing, promotion, and brand experience. That prospect explains why some companies are cautious even if they do not publicly oppose agents. They may not want to be excluded from the agent economy, but they also do not want to surrender the customer relationship without a fight.

What the standoff means for agentic AI

The standoff affects how useful agents can become. The companies building them promise a universal assistant that can handle anything online. That promise depends on broad access. If major websites block agents, the assistant's scope shrinks. If access depends on partnerships, the assistant works unevenly. If anti-bot systems challenge every transaction, users may decide that doing the task themselves is faster. The gap between demonstration and daily use becomes a credibility problem for the entire category.

Some companies are trying to close that gap through deals, technical standards, and clearer user consent. Others are testing legal boundaries. Websites are experimenting with data-licensing programs, agent-specific access rules, and bot-management tools. Regulators and courts may eventually clarify whether an agent acting for a user has the same rights as the user, or whether websites can refuse automated access even when the user authorizes it. In the meantime, the web is splitting into zones: sites that welcome agents, sites that block them, and sites that allow them only under narrow conditions.

The practical result is more verification for everyone. As sites try to distinguish humans from agents, users may face more login prompts, CAPTCHAs, and confirmation screens. Those tools can protect accounts, but they also make ordinary browsing slower. A simple grocery purchase could require jumping through hoops to prove that a person is using the computer or phone. That trade-off between security and convenience will shape whether agentic AI feels like a genuine assistant or just another layer of friction. The businesses that find a workable balance may gain loyal customers; those that block too aggressively may lose the people behind the agents. The companies building agents, meanwhile, are learning that intelligence alone is not enough. Access, trust, and commercial agreements may matter just as much as the model's ability to plan and click.

Source:The Verge News