Websites Blocking AI Agents: Why the Doors Are Closing and What Still Works

Websites are blocking AI agents because an agent that logs in with your password, skips the page and acts on its own is a risk and a lost sale to the business on the other end. Since late September, Amazon has cut off Meta's Muse, Delta has stopped agents booking flights, Yelp has asked agents to pay for its data, JPMorgan Chase, Charles Schwab and other US banks have shut agents out of accounts, and on 27 October RBC became the first Canadian bank to do the same. Some blocks are deliberate; others are anti-bot systems catching agents by accident. The pattern in what still works is clear: agents get let in when they come through a sanctioned connection, read before they act, and leave money and other irreversible steps to a person.

Who is blocking AI agents

On 21 September 2026, people using Muse to shop on Amazon saw this popup: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." TechCrunch and GeekWire both carried it. GeekWire reports that Amazon says Muse does not identify itself and appears to capture and store customer credentials. Amazon's line on the remedy is: "third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate."

The Verge, on 17 October 2026, reports that Delta is preventing agents from booking tickets, and that Yelp only allows agents that pay for its data licensing program. The same piece says users report Cars.com and Amtrak no longer working.

Jamie Dimon, JPMorgan Chase's CEO, told analysts: "We're not going to allow just any … outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan." A spokeswoman told CNBC: "we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf." The bank does support read-only data sharing through open banking providers.

Charles Schwab's CEO, Rick Wurster, told Bloomberg, as reported by The Verge and Moneycontrol: "We don't want someone just giving their password to Muse, and letting Muse come in and take action on that client's behalf. We can't control it, the client can't control it, something could go wrong and who's liable?" Schwab plans model context protocol servers so an outside tool can see balances and do research. Wurster was explicit about the limit: "We're not going to allow them to move money."

Axios reported on 22 October 2026 that major US banks are detecting unauthorised third-party agents inside customer accounts, and that some agents have tried to take actions that appear independent of the user's instructions. Morgan Stanley has begun blocking third-party agents. A Morgan Stanley spokesperson told Axios the bank has not observed "rogue AI agents accessing our platforms." Bank of America and Citi are restricting agents. Citi told USA Today: "We do not permit third-party AI agents or assistants to log into a customer's account or transact directly within our digital banking platforms." Axios says most banks are moving toward read-only access.

On 27 October 2026, RBC said it is blocking third-party personal AI agents from direct access to authenticated RBC digital properties, including online banking. Bloomberg Law reported the internal memo: agents "can create unacceptable customer risk, including acting beyond customer expectations or creating liability exposure."

Cloudflare's docs set 15 September 2026 as the date new domains default to blocking bots classified as Agent and as Training on pages that display ads. Search stays allowed. A site owner can switch the block off, limit it to pages with ads, or apply it to every page.

How it blew up

On 18 October, @trikcode wrote that "the internet is starting to block AI agents that were supposed to do everything for us." It set off a long argument about which sites let agents in.

The Hacker News thread on The Verge piece is the long public argument beside it. @glenngabe put the merchant's fear in one line: "Imagine your agent ends up returning bad data, the wrong products, wrong pricing, or worse?"

Why websites block AI agents

Credentials and liability

An agent that logs in with the customer's password is a person the bank or the broker cannot see, using a credential it was never issued. Schwab's question is the liability version: if something goes wrong, who is liable? JPMorgan's spokeswoman drew the same line at credentials. RBC's memo names "liability exposure." Axios reports that many banks cannot tell whether activity in the account was directed by the user, or whether an agent was authorised or had gone rogue.

The margin sits in the page

@andrew_jennings wrote: "If your margin is in the interface, agents are a threat. If your margin is in the product, agents are a free sales channel." Cloudflare's default blocks Agent bots on pages that display ads, which is the page where that margin is sold. @royrubin05 put the marketplace version the same way: "If the agent owns the customer, no marketplace wants to become a dumb backend."

Accidental blocks

Some of the walls are anti-bot checks, not a policy. TechCrunch, on 6 October 2026, reported agents tripping those checks even on partner sites. Walmart, a Muse partner, told TechCrunch the checkout blocks customers were seeing were not intentional. The site was asking for a click to confirm the visitor was human. The Verge's own Muse test was caught by Target's bot check one day and got through the next.

Who is letting agents in, and on what terms

Meta's answer is the opposite bet. "Turning away a personal agent means turning away the customer behind it," the company said in its 6 October post. The Verge reports partnerships with Walmart, Gap, Sephora and Best Buy, and that Shopify has opened its storefronts to agents. Meta, Walmart, Stripe, Sierra and others are working on an open standard for agent-to-business communication, TechCrunch reported. Meta's post names that work the Personal Agent Protocol. Are AI agents safe? is where this site describes the protocol.

Schwab's split is the other working pattern: read through a connection the firm controls, and do not move money. @BenjieMalinao wrote the distinction the blocks keep missing: "Reading and acting are different risks, and most sites still treat them as one door."

What this means if you use an agent for work

• Agents that drive someone else's login page are renting access that can be withdrawn overnight.
• Expect read access before write access. Money, bookings and account changes will need a person.
• Prefer agents that work where you already have the right to work: your own files, folders and repos.
• When an agent hits a wall it should tell you and hand the task back, not retry until it gets flagged.

Where xSquads for Work fits

xSquads for Work gives each knowledge worker their own squad of specialised agents to delegate to and review, so they become 10x more productive. The line on the product page is "Make every teammate 10x."

It runs on your computer and works on your own files and folders in place. The squad works a shared task board from Backlog to To Do to In Progress to Review to Done. Finished work waits in Review until you approve it. Bots propose. You approve.

The security page states the gate in the site's words: "Bots propose edits as reviewable cards. Nothing is treated as final until you approve it, and irreversible actions are escalated to you instead of being executed."

Most of a knowledge worker's backlog, the plans, research write-ups, docs, listings and reports, lives in files you already own. That is the work no website can block.

When a bot works on a task, the prompt and any file content a bot needs is sent to the AI engine handling the task, under that provider's terms. That is the security page account of what leaves the machine.

Mac now, Windows coming soon. It is free via the waitlist.

Software teams: the same rule in a software factory

The lesson carries to agents that write code. Work through sanctioned access, your repo and the pull requests on it, and keep the irreversible step, the merge and the release, with a person.

On the code factory page, a code factory is an organized production system. Agents open pull requests you can read. A person reviews before code is merged. Nothing merges without your approval. Every output passes quality gates: automated tests, code reviews, QA validation and human approval.

On services, custom squads usually take the shape of an agent swarm or a code factory, built around one process your team already runs by hand. What a managed AI software factory does is that line, in the site's own words.

Frequently Asked Questions

Why are websites blocking AI agents?

Websites block AI agents for three reasons: an agent that logs in with a customer's password creates liability the site cannot control, the margin often sits in the page the agent skips, and anti-bot systems catch agents that were not the target. Charles Schwab's CEO said the firm does not want a customer handing Muse a password and letting it act, because the firm cannot control it, the client cannot control it, and nobody knows who is liable. Amazon says third-party applications that buy on a customer's behalf should operate openly and respect a service provider's decision about whether or not to participate.

Is Amazon blocking AI agents?

Yes. Since 21 September, Amazon has blocked Meta's Muse from browsing and buying on Amazon.com. The popup says, "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." Amazon wants those agents to operate openly and to respect a service provider's decision not to participate. TechCrunch and GeekWire reported the block.

Which banks are blocking AI agents?

JPMorgan Chase, Charles Schwab, Morgan Stanley, Bank of America and Citi have blocked or restricted third-party agents, as CNBC, Axios and USA Today reported. On 27 October, RBC blocked third-party personal AI agents from its online banking. Most allow read-only access through an approved connection. None of those statements let an outside agent move money on its own.

Does Cloudflare block AI agents?

New domains on Cloudflare have, since 15 September 2026, defaulted to blocking bots classified as Agent and as Training on pages that display ads. Search stays allowed. A site owner can change the setting. The rule is in Cloudflare's bot docs.

How can I use AI agents if websites block them?

Use a connection the site has agreed to, keep the agent on files, folders and repos you already own, and approve any step you cannot undo. xSquads for Work gives each knowledge worker a squad of specialised agents to delegate to and review. It runs on your computer and works on your own files. Finished work waits in Review until you approve it. Bots propose. You approve.

Related reading

• Are AI Agents Safe? What This Month's Agent Incidents Show
• Meta Muse Alternative for Work: Muse vs xSquads
• OpenAI Dots Alternative: AI Teammates on Your Own Files
• Computer use agent: ChatGPT in Chrome and the approval step
• A Grok Bot alternative that works on your files

Raina Rufus, Founder of xSquads

xSquads for Work is free during the waitlist. Mac now, Windows coming soon. Join the waitlist.