OpenAI, Meta, Google and Instinct all sold users the same vision: say the word, and an AI agent books your dinner, cleans your inbox, buys your shoes. But in recent weeks, users of these agents have run into an awkward reality — the doors agents can walk through are closing, one by one.
Who is closing doors
According to The Verge, the list keeps growing. Yelp says it only allows agents that pay for its data licensing program. Delta Air Lines is preventing agents from booking tickets on behalf of users. JPMorgan Chase and Charles Schwab have confirmed they are blocking agents from accessing accounts over security concerns. Tellingly, sites that previously worked with agents — Cars.com and Amtrak — are no longer accessible, suggesting other companies are quietly reversing course.
Amazon is where the pressure peaks. Meta's Muse was blocked first, with Amazon saying its "continued access" violates site policies. Users then reported that xAI's Grok, Instinct's agent and OpenAI's Dots could not shop on Amazon either. Elon Musk's response was characteristic: maybe he "should start a competitor to Amazon."
Two reasons behind the blocks
Strip away the statements and there are really just two reasons.
The first is security. The banks' logic is the bluntest: an agent acts with your credentials and payment info, but if it buys the wrong thing or moves money by mistake, who is liable? Until a liability framework exists, closing the door is the cheapest answer.
The second is money. Yelp offers the template — not "stay out", but "pay to come in". A data licensing program turns agent access from a public webpage into a billable commodity.
The wall-crossers are already moving
Interestingly, both sides of the wall are in motion. Rather than fight Amazon, Meta partnered with retailers — Walmart, Gap, Sephora, Best Buy — to let Muse shop on their sites. Shopify went the other way and opened its storefront network to more AI agents.
One side sells tickets; the other rolls out the carpet. The dividing line is not technology. It is business terms.
So what
The top-rated Slashdot comment puts it plainly: next, agents will drive a real browser and become indistinguishable from a human user. The block-versus-bypass arms race is just starting.
For anyone building agent products, this may be a harder constraint than model capability: however smart your agent is, it cannot get past "access denied" at the door. Before the "agent web" becomes real, it has to answer an old question — why should the person behind each door let you in.