Personal AI agents are supposed to save people the trouble of shopping, booking flights, or reserving a table at a restaurant. But the more people use them, the more often they find themselves facing closed doors. Websites block them, sometimes intentionally, other times by mistake, and the person who sent the agent to complete a task usually has no idea why it failed.
Agents shop for people, websites fight back
Meta’s Muse, Instinct, ChatGPT’s Dots, and other agents can now book flights, order dinner, or buy groceries without users having to configure anything complicated on their own computers. The problem arises when the website on the other end rejects the agent.
Most recently, Amazon began blocking the Muse agent on its online store, so it can no longer browse the catalog or make purchases. But Amazon is far from alone. Users on social media complain about Yelp, eBay, Zillow, Pizza Hut, Adidas, and various airlines, and some feel that blocking has become more common recently. A few people even claim that eBay blocked their accounts for using an agent, while another complained that Google kicked Instinct out while it was cleaning up their Gmail inbox.
Walmart wants agents, yet still kicks them out
The Walmart case illustrates the problem best. People reported that Muse was unable to complete purchases on its website, but a company spokesperson says this is not intentional. Walmart is a Meta partner and wants to be wherever its customers are, including apps with AI agents.
The issue apparently lies with the button visitors use to confirm that they are human. If the verification is interrupted, the check fails and the agent is thrown out. Protection that has safeguarded stores against spam and fraudsters for years is now suddenly driving away paying customers.
Yelp wants payment, airlines want caution
Other companies reject agents entirely deliberately. Yelp allows third-party bots in only if they pay for data access under its licensing program. An agent that wants to check a price, add a user to a waitlist, or book a table is unlikely to succeed without an agreement with Yelp.
Airlines behave similarly. Delta said it protects customers from unauthorized automated traffic and does not yet work with any third-party agents, although it continues to explore new technologies. United pointed to its terms, which prohibit bots and other automated tools without written consent. eBay says it does not impose a blanket ban on shopping agents and restricts only unauthorized activities such as bulk data scraping or model training. Zillow allows agents, but its bot protection occasionally stops them.
Cloudflare and advertising are behind some of the blocking
Some people suspect the companies that protect websites from attacks. On September 15, Cloudflare changed its default settings, and websites that previously used the old AI-blocking option now automatically reject agents on all pages containing ads. The explanation is purely economic. According to Cloudflare, advertising revenue depends on a human actually viewing the page. An agent merely downloads it, and no one sees the ad.
However, when asked about agent blocking, Cloudflare provided no specific data. The company itself profits from this issue. It operates a marketplace where AI bots pay for access to data, and it recently began testing a browser designed specifically for AI agents.
Meta is preparing shared rules
Meta has therefore introduced its own solution. The Personal Agent Protocol is an open standard that Meta is developing with Sierra and partners such as Genesys, NiCE, Decagon, Rocket, Shopify, Stripe, and Walmart. According to Meta, anyone who rejects a personal agent also rejects the customer behind it. The company therefore wants to address stores’ concerns so they do not unnecessarily lose customers.
According to Meta, Muse should apply two tests before every step. It determines whether an honest person would perform the same step manually and whether the system could handle it if all users wanted to do the same thing at once. For important actions, it should proceed only with the user’s explicit consent. The collaboration is expected to develop gradually. First, stores will be able to direct agents along acceptable paths, then agents will gain direct integrations instead of controlling a browser, and finally, agents representing stores and customers will communicate directly.
One thing is still missing, however. The published proposal does not explain how an agent should prove its identity to a website. A website cannot distinguish a legitimate Muse agent from a data scraper merely impersonating it. For many security teams, blanket blocking will therefore remain the safer option.
Sources: techcrunch.com and progressiverobot.com
