Personal AI agents are beginning to shop, book, compare, manage accounts and act on our behalf. The problem is that much of the internet still sees any automated visitor as a bot to block. Behind the growing collision is a deeper question: when an AI acts for a person, who is actually at the door?
October 2026 | AI Agents | Internet Access | Identity | Commerce | Security
The web has spent nearly three decades learning how to recognize a human being.
We log in. We accept cookies. We click buttons. We solve CAPTCHAs. We scroll past advertisements, open product pages, compare options and eventually press buy. Websites have built their security systems, analytics, advertising models and legal agreements around this familiar choreography.
AI agents do not move through the internet in quite the same way.
Give an agent a task such as find the cheapest suitable flight, order groceries, cancel a subscription or move idle cash into a better account, and it can navigate pages, read information, fill forms and sometimes complete transactions without the human ever seeing most of the website.
That sounds like the natural next stage of the internet. It is also beginning to collide with an internet that was designed to keep automated software out.
During October 2026, reports of personal AI agents being refused access to major websites have become increasingly visible. Some blocks are deliberate. Others are side effects of anti bot systems that cannot reliably distinguish a legitimate assistant acting for a real customer from a scraper, fraud tool or automated attacker.
The result is one of the most important practical problems facing consumer AI agents. Models may be capable of using the web, but capability is not the same thing as permission.
The new visitor does not look human
A traditional browser is technically a user agent too. It retrieves pages on a person’s behalf, but the web has learned what normal browser traffic looks like. Modern AI agents blur that familiar pattern because they can interpret a page, decide what to do next and continue through several steps with little or no additional instruction.
To a user, that feels like delegation. To a website, it can look remarkably similar to automation it has spent years trying to stop.
TechCrunch reported in early October that users of new consumer agents were encountering blocks on retail, travel and service websites. Yelp told the publication that it does not permit nonhuman traffic unless the agent participates through its paid data licensing arrangements. Walmart offered the opposite example. It is working with agent platforms, yet users still encountered human verification challenges because conventional anti bot systems sometimes interpreted the automated browser as suspicious.
More recent reporting by The Verge described intentional restrictions at companies including Yelp and Delta Air Lines, while financial institutions such as JPMorgan Chase and Charles Schwab have cited security concerns around unauthorized third party agents accessing customer accounts. Amazon has become the most visible battleground because it has repeatedly challenged external shopping agents that attempt to operate on its marketplace.
This is why the phrase websites are blocking AI agents is both true and incomplete. There is not one single blockade. There are several different problems arriving at the same locked door.
Sometimes the block is security. Sometimes it is business. Often it is both.
A bank has an obvious reason to be cautious about software that can move money. If an agent is compromised, misunderstands an instruction or acts beyond the user’s intention, the consequences can be immediate. The bank must also answer questions about authentication, fraud protection, legal responsibility and whether the customer really authorized a particular action.
The concern became especially visible this month as large US banks restricted outside agents from accessing accounts. Financial Times reporting said Citigroup joined JPMorgan Chase and Bank of America in limiting third party agent access. JPMorgan executives have spoken publicly about protecting customers from rogue agents and rejecting insecure practices such as credential sharing and screen scraping.
But security is not the only incentive.
An agent that optimizes entirely for the customer may behave very differently from a customer navigating a commercial website. It can compare hundreds of prices, ignore advertising, skip carefully designed recommendation pages, search competing services instantly and move money away from a low interest account without being tired, distracted or persuaded to stay.
That possibility has already entered the banking debate. Some analysts have wondered whether financial agents could automatically move deposits toward higher yielding accounts. Wells Fargo chief executive Charlie Scharf has argued that fears of an immediate deposit exodus are overdone because most people are not yet ready to hand that degree of control to an AI. The disagreement itself is revealing. Businesses are beginning to consider not merely whether agents are technically safe, but what happens when software becomes an unusually efficient consumer advocate.
For retailers, travel companies, publishers and marketplaces, the same tension appears in different forms. An agent may bring a paying customer. It may also bypass advertising, recommendations, loyalty mechanisms, sponsored placement and parts of the user experience that help finance the service.
The web has always contained friction. AI agents are very good at removing it. Not every company wants all of that friction removed.
Amazon and Perplexity turned the argument into a legal test
The clearest early legal battle came from Amazon and Perplexity.
Perplexity’s Comet browser includes an assistant that can carry out tasks at a user’s direction. When a user asks it to shop on Amazon, the browser can navigate the site while exchanging screenshots and instructions with Perplexity’s servers. Amazon objected and told Perplexity that its agent was not authorized to use the Amazon Store in this way.
The dispute became particularly interesting because Perplexity did not consistently identify the assistant with a user agent string that would allow Amazon to distinguish and block it. Amazon sued in November 2025 under the US Computer Fraud and Abuse Act and a similar California law, arguing that the agent was accessing Amazon systems without authorization.
A federal district court initially granted Amazon a preliminary injunction. Then the Ninth Circuit Court of Appeals reversed that decision in August 2026.
The appellate court did not declare that AI agents have a general right to enter websites. It made a much narrower finding. On the technical record before it, Perplexity’s servers were not directly connecting to Amazon’s servers. The user’s local browser was. The court therefore concluded that Amazon was unlikely to prove that Perplexity itself had accessed Amazon’s computers in the sense required by the anti hacking law.
The opinion contains a sentence that may become historically important. On the facts of that case, the court treated the AI assistant as a tool used by the person. The user, it said, was the one accessing Amazon with the assistant’s help.
That sounds intuitive, but it creates a profound legal question for the agent era. If a human can use a browser to click a button, why should using software that clicks the same button for them automatically become unauthorized access? At what point does an assistant stop being comparable to a browser and become an independent actor whose conduct should be attributed to the company that built it?
The Ninth Circuit deliberately refused to answer that larger question. It said its ruling did not create a new legal regime for agentic AI and did not decide how responsibility might work under tort law or under different technical facts. The case was sent back for further proceedings.
In other words, one of the first major agent cases produced not a final rule, but a boundary marker. The law can see the user. It can see the company. It does not yet have a simple category for the software in between.
The web has a good bot problem
For years, website security worked with a useful assumption: human traffic was desirable and automated traffic was suspicious unless it belonged to a small group of recognized services such as search engines or monitoring systems.
AI agents break that assumption.
A malicious bot and a helpful personal assistant may both open pages quickly, fill forms, follow links and make repeated requests. One is attacking the site. The other may be carrying out an instruction from a customer who genuinely wants to spend money there.
The website needs to know the difference before it can safely decide what to allow.
Cloudflare now describes this as an identity problem. Its verified bot system allows legitimate automated systems to identify themselves through methods such as cryptographic Web Bot Auth. The company is also developing infrastructure for what it calls an Agentic Internet, where agents can identify themselves, discover machine friendly interfaces, call functions directly and make payments without pretending to be humans clicking through pages.
That shift is more important than it first appears. Today an agent often has to look at a website designed for human eyes, work out which field means destination, which button means continue and which popup is trying to sell an upgrade. It is effectively operating a human interface by imitation.
A web designed for agents would expose the underlying action directly. Instead of visually finding an Add button, an authorized agent could call a defined tool that says add this item. Instead of hiding behind a browser fingerprint, it could cryptographically identify itself.
The problem then changes from can we detect this bot to a much more useful question: who is this agent, who sent it, and what exactly is it allowed to do?
An agent needs more than an identity card
Knowing that an agent is legitimate is only the first layer.
Suppose a website can prove that a request really came from a trusted AI assistant. That still does not prove the user authorized this particular purchase, transfer or booking.
The agentic web therefore needs two different kinds of trust. The first is identity. The site needs to know what system is speaking to it. The second is delegated authority. The site needs evidence that a real person has allowed that system to perform a specific action within specific limits.
Payments companies are already building around this distinction. Mastercard’s Agent Pay Trust Framework combines agent identity with proof of user intent, authority controls and transaction security. Its partners describe the emerging idea as Know Your Agent, an echo of the identity checks long used in finance.
Visa’s Trusted Agent Protocol approaches the same problem from the merchant side. Its specification is intended to help a merchant recognize an approved agent with commerce intent, verify that the agent represents an authenticated user and determine whether the user has actually authorized the purchase. Visa has already reported live agent initiated purchases with participating European merchants under controlled infrastructure.
A newer proposal called x401, launched by identity company Proof on October 15, attempts to carry verified legal identity and signed transaction authorization with the agent itself. Proof describes the protocol as a way for a website to ask not merely which agent are you, but who are you acting for and what did that person approve. It is an early commercial protocol rather than a universal web standard, but it is aimed directly at the missing trust layer.
These systems are all trying to solve the same deceptively simple problem. A human standing at a shop counter can say, this is my assistant and I authorize them to buy this for me. The internet needs a cryptographic equivalent.
robots.txt was never built for this
The old web already has a language for telling automated crawlers where they should and should not go. The best known example is robots.txt.
But a crawler and a personal agent are not the same thing.
A search crawler visits pages for its own indexing purpose. A personal agent may be visiting because an authenticated customer asked it to complete a task inside that customer’s own account. It may need to access information that is private to the user, change a reservation, make a payment or submit a form.
That makes simple crawler rules inadequate. The site needs to understand identity, user consent, scope, rate, transaction limits and sometimes the difference between reading and acting.
Cloudflare’s current verified bot policy still expects legitimate automated systems to identify themselves clearly and respect site preferences. That principle is unlikely to disappear. What is changing is the level of detail needed around permission. The future agent may need something closer to a passport, a signed letter of authority and a spending limit than a traditional bot label.
The most difficult question is who carries responsibility
Imagine an agent books the wrong flight after misreading a user’s preference. Who pays the change fee?
Imagine it moves money into an account that looked optimal but carried a hidden restriction. Is that the customer’s decision, the agent developer’s decision or the bank’s failure to prevent an unsuitable transaction?
Imagine the agent is legitimate but has been manipulated by instructions hidden on a webpage. The website sees a trusted agent with valid credentials. The user never intended the resulting action.
These are not abstract edge cases. They explain why banks and other regulated services are cautious even when the customer is willing to delegate.
Bank of England governor Andrew Bailey has now warned that AI agents can blur accountability and legal liability in financial transactions. The concern is not simply whether the model is intelligent enough. It is whether institutions can reconstruct who instructed what, which permissions were active, what information the agent saw and why a transaction occurred.
This is where security architecture and legal architecture begin to merge. A robust agent system will need logs, scopes, confirmations, revocation, identity, limits and evidence of consent. Those features sound technical, but they are really mechanisms for answering an old human question after something goes wrong: who was responsible?
There are two very different futures for the agentic web
One future is a patchwork of private partnerships.
Large AI platforms make agreements with large retailers, banks and travel companies. Their agents receive privileged access through private interfaces. Smaller agents remain blocked. Websites choose a handful of approved ecosystems. The agentic web becomes convenient, but increasingly gated by commercial alliances.
The other future looks more like the open web itself. Common protocols let any compliant agent prove its identity, present user authorization and interact with a website through standardized tools. Merchants can still refuse access, limit functions and enforce security policies, but they do not need a separate commercial integration with every AI company.
Cloudflare explicitly argues for this second model. Its vision uses open standards for identity, tool calling and payments so that websites and agents can cooperate without one company owning the entire path between discovery and transaction.
Neither future is guaranteed. The current battle over access may decide which one becomes normal.
That is why the websites blocking agents story is larger than a frustrating CAPTCHA. It is a negotiation over who controls the next interface to the internet.
The customer may no longer be the person looking at the page
The deepest change is easy to miss because the technology still looks like a browser moving a mouse.
For the first time, a large part of the commercial web may have to serve customers who never directly visit the website.
A person can ask an agent to find the best product, compare every offer, read the return policy, place the order and track delivery. The merchant still receives the customer’s money, but it may never receive the customer’s attention.
That breaks several assumptions that shaped the modern internet. Advertising becomes harder to show. Brand presentation matters differently. Search ranking changes. Loyalty may be evaluated mathematically instead of emotionally. Interfaces designed to keep people browsing become less useful when the visitor has no desire to browse at all.
This is why some companies will welcome agents and others will resist them. An agent can be a new sales channel and a new security risk at the same time. It can be a customer representative and a threat to the merchant’s control over the customer relationship.
The question is not simply whether AI agents should be allowed onto the web. The more useful question is what kind of web we need when a legitimate user can arrive in the form of software.
The doors are not closing forever
Despite the current blocks, the direction of travel does not look like a permanent ban on agents.
The infrastructure being built by Cloudflare, Visa, Mastercard, identity companies and AI platforms suggests something more transitional. The web is moving from a crude distinction between human and bot toward a richer distinction between unknown automation and authorized representation.
That transition will be messy. Some websites will block first and negotiate later. Some agents will disguise themselves and make the trust problem worse. Some companies will prefer their own assistants to outside ones. Courts will have to decide when an agent is legally a tool, when its developer shares responsibility and how existing computer access laws apply to increasingly autonomous software.
But the technical destination is becoming clearer.
A legitimate agent should be able to say who it is. It should be able to prove who it represents. It should carry limits on what it may do. The website should be able to accept, restrict or reject that delegation. And when something goes wrong, there should be enough evidence to reconstruct the decision.
The original web solved a simpler problem: how to let computers exchange documents.
The agentic web has to solve a stranger one: how to let computers act for people without losing the people somewhere in the transaction.
For now, many doors are locked because nobody is completely certain who is knocking.
The next generation of the web may be built around answering that question.
Sources
The Verge, “Websites are closing their doors to AI agents,” October 18, 2026.
TechCrunch, “The next hurdle for AI agents: getting websites to let them in,” October 6, 2026.
Cloudflare documentation, Verified Bots and Web Bot Auth.
Mastercard, “An age old question for the AI era: Can I see some ID?” October 8, 2026.
Visa Developer Center, Trusted Agent Protocol specifications.
Visa, “Your AI Just Bought You a Couch. Are You Okay with That?” September 9, 2026.
Financial Times, reporting on US banks restricting third party AI agents, October 17, 2026.
Financial Times, Andrew Bailey on accountability and AI agents in finance, October 18, 2026.
Prepared for BunCosmos.ai | October 2026