By This Hour Technology Desk
AI companies are promoting software agents as personal operators that can search, compare, book and buy on a user’s behalf. But the services those agents need to reach are increasingly drawing boundaries around that access. Reported failures involving Meta’s Muse, xAI’s Grok, OpenAI’s Dots and Instinct suggest that the usefulness promised by autonomous assistants may depend less on their underlying models than on whether websites allow them through.
The emerging dispute reaches beyond a technical argument about bots. It concerns who may act for an internet user, how a site distinguishes a customer from an automated intermediary, and who bears the risk when software attempts to enter an account or complete a purchase. Companies running websites have reasons to protect security, preserve service rules and control use of their data. Agent developers, meanwhile, are asking consumers to treat their systems as extensions of their own online activity.
The evidence described in the report points to a mixed landscape, not a uniform shutdown. Some businesses appear to be imposing direct limits; others may be catching agents in broad anti-bot defenses. A separate group is pursuing licensed or partnership-based access. Those distinctions matter because an error message or failed checkout alone does not establish that a website deliberately rejected an AI agent.
Travel, finance and shopping expose the immediate friction
Users of several agent products have reportedly encountered blocks while attempting tasks on major websites. The reported examples span consumer search and commerce, reservations, travel and financial services, giving the problem a breadth that could challenge the idea of one assistant moving smoothly across a user’s digital life.
Yelp has said it allows AI agents through a paid data-licensing program, as described in the report. That approach treats agent access not as an automatic consequence of a person’s ability to visit a website, but as a separate commercial arrangement. It also presents one possible model for publishers and platforms that want to make their information available without giving unrestricted access to outside systems.
Delta Air Lines is reported to prevent agents from booking tickets for users. JPMorgan Chase and Charles Schwab have confirmed that they block agents from account access on security grounds. The financial examples draw the issue into a particularly sensitive setting: an assistant may be acting at a customer’s request, but it can also introduce questions about authentication, fraud controls and responsibility for account actions. The supplied material does not describe the specific safeguards involved at either financial institution, so it cannot determine whether a different technical arrangement could satisfy those concerns.
There are also reports that Cars.com and Amtrak, services said to have worked with agents previously, can no longer be reached in that way. Yet the available account does not establish that either company intentionally added an agent-specific restriction. Their apparent inaccessibility could reflect a policy decision, a change in a technical defense, an ordinary service problem or another cause not identified in the reporting. Treating all such failures as purposeful exclusions would overstate what is known.
Amazon’s fight with Perplexity has made the stakes more visible
The conflict is most sharply illustrated by Amazon’s opposition to Perplexity’s shopping agent. Amazon barred the feature and sued the AI company, arguing that outside businesses buying on behalf of customers should be transparent and should honor a service provider’s choice about participation. That position frames the agent not merely as a customer’s tool, but as an independent commercial actor whose access can be conditioned or refused.
Perplexity countered that its software was acting for the user, comparing the agent’s role to an assistant or employee. The disagreement goes to the heart of the wider contest. If an agent is essentially a user’s representative, a website’s rejection of it may be seen as a barrier erected between a business and its customer. If it is a separate automated operator, a site may claim a stronger interest in deciding how, or whether, it can transact there.
The procedural history reported in the source shows that the argument is not settled. A judge initially ordered Perplexity to stop using agents to shop on Amazon, but an appeals court reversed that order in August. Amazon subsequently filed an amended complaint. The available material does not provide the reasoning for either court action, the claims in the amended filing or a timetable for the case. It therefore supports a narrow conclusion: the dispute remains active, and the reversal did not end the underlying clash.
Amazon’s conflict with Perplexity predates the more recent accounts involving Muse, Grok, Dots and Instinct. Reports indicate that those products have also had difficulty using Amazon. For companies building agents, such obstacles carry practical consequences. A system advertised as capable of completing online tasks becomes less reliable when high-demand destinations are unavailable or when it must halt before a consequential step such as checkout.
A blocked agent is not always a deliberate rejection
Website defenses may produce the same user-facing result even when they were not designed specifically for AI assistants. Anti-bot systems are widespread because sites seek to deter scams, hacking attempts and other automated misuse. An agent navigating pages, filling forms or moving quickly through a transaction flow can resemble the kinds of programs those safeguards are meant to detect.
The report describes accounts of Google blocking some Muse users for activity deemed suspicious. It also notes reported checkout problems at Walmart despite Meta’s partnership with the retailer. Together, those examples make a crucial distinction: access approved through a business relationship does not necessarily guarantee dependable agent performance in every part of a site. A partnership can open a door while security tools, account checks or transaction systems still stop an agent further along the process.
That ambiguity affects users as well as companies. When an agent cannot finish a task, the user may not know whether the problem lies with the agent’s software, the site’s policy, a fraud-prevention mechanism or a temporary error. The source does not supply systematic testing across the services named, so it cannot establish how often the reported failures occur, whether they affect every user, or whether they are permanent.
Cloudflare’s tools form part of the wider backdrop. The company introduced a one-click option in 2025 for websites to block AI crawlers and later began blocking crawlers that combine web scraping for search indexing with AI training, the report says. Crawlers and task-performing agents are not identical: one is generally associated with collecting content, while the other is presented as acting for a user. Still, the expansion of controls over automated visitors may make it easier for sites to set restrictive defaults or to draw sharper distinctions among different kinds of software.
Partnerships offer an alternative to open access
Not every business is turning agents away. Meta has formed arrangements with Walmart, Gap, Sephora, Best Buy and other retailers intended to let Muse shop on their websites. Shopify has also opened its storefront network to AI agents. These arrangements point toward a web in which agent activity may be negotiated business by business rather than assumed to be available wherever a person can browse.
That model could give retailers more control over how automated shoppers interact with inventory, checkout and customer service. It may also offer agent developers a path to more predictable access. But it could make an agent’s reach uneven, dividing the web between services that participate, services that license access on separate terms, and services that refuse or technically impede it. The report does not say how the cited partnerships operate in practice, what limits they contain, or whether other agent providers receive comparable treatment.
Meta has argued that refusing a personal agent amounts to refusing the customer represented by it, while saying it would rather address businesses’ concerns through cooperation. Its position highlights the commercial incentive to make agents feel like ordinary consumer channels. Website operators may see a different set of incentives, including preventing automated abuse and retaining authority over the systems that touch their services.
OpenAI and Google did not immediately provide comments to the source about the reported roadblocks, while Instinct declined comment. Their absence leaves important gaps: there is no explanation in the supplied material of how those companies identify blocks, how they respond to them, or what protections they offer users when an agent meets a site defense.
The central question is whether agency online can be delegated
The outcome may shape more than shopping assistants. Booking travel, looking up local information and using financial accounts all involve rules designed around a human being directly interacting with a service. Agents test whether those rules can be transferred to software while preserving security and accountability. A site may accept an automated assistant in low-risk browsing but reject it when it reaches a login, a payment screen or a high-value transaction.
For now, the record supports neither the claim that websites are universally closing themselves off nor the opposite claim that partnerships have solved the problem. It instead shows separate responses, from paid access and retailer cooperation to confirmed security restrictions, litigation and failures that may be side effects of general bot controls. The report cited here has not been independently corroborated, and the supplied evidence is based on a single secondary account. It does not establish the full scale, intent or permanence of the reported blocks.
What is clear from that account is that agent makers cannot determine the experience alone. Their systems operate inside websites owned by other organizations, each with its own commercial terms and defenses. Whether AI agents become reliable delegates for routine online tasks may turn on negotiated access and technical compatibility as much as on improvements in the agents themselves.
For further context on this subject, see Report says FTC examines security incidents involving Anthropic and OpenAI.
Reporting notes
What is confirmed: JPMorgan Chase and Charles Schwab confirmed blocking account access by agents for security reasons; Yelp described a paid licensing route.
Why this matters: Agent services depend on third-party websites to complete bookings, purchases and account tasks.
What remains unclear: The evidence does not establish whether every reported failure was intentional, widespread or permanent. This report is based on one source and has not been independently corroborated.
