Major websites are restricting autonomous AI agents from accessing accounts, purchasing products and booking travel, limiting the everyday tasks that companies including OpenAI, Meta, Google, xAI and Instinct say their software can perform.
Over recent weeks, users of Meta’s Muse, xAI’s Grok, OpenAI’s Dots and Instinct’s agent have reported failures across prominent services, according to a report published by The Verge on October 17, 2026. Some restrictions have been confirmed by the companies operating the websites, while others are based only on user reports.
The result for users is straightforward: an agent may be able to research a purchase or prepare a transaction but still be prevented from logging in, checking out or completing a booking. Those steps may instead require direct human interaction with the website.
Banks, airlines and review platforms impose limits
JPMorgan Chase and Charles Schwab confirmed that they prevent AI agents from accessing customer accounts because of security concerns, The Verge reported. Delta Air Lines similarly blocks agents from booking tickets for users.
Yelp applies a different model. According to a TechCrunch report cited by The Verge, the company permits agent access only through its paid data-licensing program. That makes access a commercial arrangement rather than a capability available to any agent acting through an ordinary user account.
Users have also said that Cars.com and Amtrak, which had previously worked with their agents, are no longer accessible. Those reports do not establish that either company deliberately introduced an agent-specific block.
The restrictions expose a basic conflict in agent design. AI providers present these systems as representatives acting at a user’s direction, but website operators may see automated sessions as bots subject to access rules, fraud controls and commercial data policies.
Amazon challenges agents that shop on customers’ behalf
Amazon has become a central battleground. The company said Meta’s Muse violates its website policies through its “continued access,” while reports indicate that Grok, Instinct’s agent and OpenAI’s Dots are also unable to use Amazon.
Elon Musk, the owner of xAI, responded that he “should start a competitor to Amazon.”
Amazon previously banned Perplexity’s agentic shopping feature and sued the startup. According to Amazon’s position as reported by The Verge, it had “repeatedly requested” that Perplexity stop using agents to shop on the platform. Amazon argued that third parties purchasing for customers should identify themselves and respect a service provider’s decision about whether to participate.
Perplexity countered that Amazon wanted to preserve human views of its advertising. It characterized its agent as an extension of the customer and accused Amazon of opposing a user’s ability to delegate work.
A judge ordered Perplexity to stop the agent-shopping activity, but an appeals court overturned that ruling in August. Amazon subsequently filed an amended complaint. The available report does not assign a year to the August decision.
Meta promotes partnerships instead of unrestricted access
Meta has argued that rejecting a personal agent effectively rejects the customer directing it. In a post described by The Verge as appearing earlier this month, the company said it would rather work with businesses to resolve their concerns.
That approach is already producing authorized integrations. Meta has partnerships with Walmart, Gap, Sephora, Best Buy and other retailers that allow Muse to shop on their websites. Shopify has also opened its network of storefronts to AI agents.
Authorized access does not necessarily eliminate operational problems. Unverified user posts describe checkout failures on Walmart despite its Meta partnership. Separate Reddit reports claim that Google has blocked some accounts using Muse after detecting “suspicious activity.” These accounts are user reports, not confirmed company disclosures.
OpenAI and Google had not responded to The Verge’s requests for comment by publication. Instinct declined to comment.
Anti-bot defenses cannot always distinguish agents from abuse
Some blocks may result from existing security systems rather than a policy aimed specifically at consumer AI agents. Anti-bot controls commonly evaluate automated navigation, repeated actions and unusual account behavior—the same patterns an autonomous agent may produce while carrying out legitimate instructions.
Chris Canal, CEO of AI safety evaluator EquiStamp, told The Verge that safeguards designed to stop scams and hacking also catch AI agents. He expects users to encounter more checks requiring them to prove they are human before completing routine purchases.
Infrastructure providers are also giving website operators more control over automated access. Cloudflare introduced a one-click option for blocking AI crawlers in 2025 and later began blocking crawlers that collect website content for both search indexing and AI training.
Crawler controls and transactional-agent restrictions are not identical: one concerns automated collection of website content, while the other can prevent software from acting inside shopping, travel or financial workflows. Together, however, they show that agent access depends on the rules and defenses of each external service.
For consumers, the practical limit is that an AI agent cannot guarantee completion merely because it can navigate a website. Banking, travel and retail tasks may stop at authentication, anti-bot verification or checkout, forcing the user to take over. Canal said broader restrictions could also reduce the perceived value of agent products from companies such as OpenAI and Anthropic by shrinking the number of useful tasks they can complete.
