AI Agents Blocked by Airlines, Banks, and Retailers: The Web Is Building Walls

AI agents once promised to book your flights, reserve your restaurant tables, and buy your sneakers—all with a single sentence. But the reality is that the web isn't ready to welcome them. From Delta Air Lines to JPMorgan Chase, from Yelp to eBay, a growing number of mainstream services are denying AI agents access. Behind this "blockade" lie both deliberate corporate decisions and unintended collateral damage from security mechanisms—and for users, the result is exactly the same: the agent doesn't work.

Who Is Closing the Door

Restaurant reservation platform Yelp currently only accepts AI agents that have signed a paid data licensing agreement. Agents without a contract fail outright when attempting to make reservations or join waitlists. Delta Air Lines explicitly states that third-party AI agents are not permitted to purchase or book tickets on customers' behalf, with spokesperson Heena Chavda saying the company is evaluating how external agents could improve the customer experience. United Airlines, meanwhile, points to terms of service prohibiting "robots, spiders, and other automated devices" and declined to comment on specific AI agent questions.

In finance, the door is shut even tighter. JPMorgan Chase and Charles Schwab reportedly block AI agents from accessing accounts outright for security reasons. Users on social media also report encountering blocks at eBay, Zillow, Pizza Hut, Adidas, and several airlines—with some eBay users even having their accounts suspended for using agents. Some users have noted that Cars.com and Amtrak's booking service, previously accessible via agents, no longer work.

Two Kinds of Rejection, One Outcome

Not all blockades are intentional—and that's what makes the problem so thorny.

Walmart made a high-profile announcement at Meta Connect about an official partnership with Meta's Muse, yet users still report being blocked when shopping on its platform through Muse. The culprit is the "human verification" button on the site designed to block spam traffic and bots—agents can't pass the verification and are turned away. A Walmart spokesperson called this unintentional. Zillow's setup is similar: it says it allows agents acting on behalf of consumers, but anti-scraping measures inadvertently catch some agents.

For ordinary users, the experience of deliberate corporate blocking and security-mechanism collateral damage is identical—the agent doesn't work. Users have no way of telling which kind of wall they've hit.

How CAPTCHA and Human Verification Work

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is built on designing tasks that are easy for humans but hard for programs—such as identifying distorted text, selecting images containing traffic lights, or dragging a slider. Websites embed these challenges into key actions (login, checkout, add-to-cart) and use the results to determine whether a request comes from a real person or a script. Modern solutions also combine browser fingerprints, mouse trajectories, IP reputation, and other signals for frictionless scoring.

For AI agents, the problem isn't just whether they can solve the challenge—it's that they typically run through headless browsers or API calls, lacking the full environmental characteristics of a real browser. So even if a vision model can recognize images, it will be flagged as a bot based on fingerprint and behavioral signals. This is exactly the "collateral damage" Walmart and Zillow describe: the site intends to block spam traffic, but agents and scrapers look identical to the verification mechanism, so they're blocked together.

Cloudflare's Default Change Expands the Blockade

What further expands the scale of blocking is Cloudflare's default configuration adjustment. Cloudflare has begun blocking mixed crawlers that serve both search indexing and AI training by default. For sites already blocking AI bots for security reasons, this change means AI agents on pages with ads are also blocked. Site operators may never have made a deliberate decision about agents, but Cloudflare's configuration change effectively narrows their reach.

Interestingly, Cloudflare itself is also testing a dedicated browser for AI agents and operates a paid marketplace for AI bot data access. It stands on both sides of the door at once: blocking agents on one hand, paving the way for them on the other.

Mixed Crawlers and the robots Ecosystem

Search engine crawlers, AI training data collectors, and AI agents are technically highly homologous: they all crawl or operate web pages automatically, and many share the same infrastructure and User-Agent identifiers. Previously, many sites allowed crawlers "used for search indexing" so content could be discovered and drive traffic, while restricting purely training-purpose crawling.

Cloudflare's default blocking of mixed crawlers serving both search indexing and AI training tightens this distinction: once a crawler is judged to have a training purpose, its access across the entire domain may be restricted. Since agents often reuse the same crawling and rendering tech stack, they get classified into the same traffic category. Site operators may never have made any decision about agents, but configuration-level defaults have made it for them—this is the mechanistic reason "unintentional blocking" gets amplified at scale.

Courtroom Battles and Open Standard Attempts

The legal battle has already begun. Amazon sued Perplexity's shopping agent Comet in November 2025, alleging violations of the federal Computer Fraud and Abuse Act (CFAA). Comet logs into Amazon with user authorization to shop on their behalf, but Amazon considers this a violation. The district court issued a preliminary injunction in March 2026, but the Ninth Circuit Court of Appeals overturned it in August, reasoning that it was the user—not Perplexity—accessing Amazon's systems. The main case continues, and the appellate court explicitly limited its ruling as not establishing a general legal principle for AI agents.

Amazon also blocked Muse just 12 days after launch, again citing the CFAA and terms of service violations. Perplexity countered that Amazon's real motive for excluding agents is that agents reduce human users' attention to ads.

Another path is open standards. Meta has partnered with Walmart, Stripe, Sierra, and others to develop open standards for secure interaction between AI agents and commercial systems. Its public stance: "Rejecting agents means rejecting the customers behind them. Rather than watching businesses lose customers, let's solve the underlying concerns together."

CFAA and the "Unauthorized Access" Controversy

The Computer Fraud and Abuse Act (CFAA) is a federal law enacted in the U.S. in 1986, originally aimed at hacking into government and financial institution computers, later widely cited in "unauthorized access" cases. The key dispute is whether a website's terms of service can constitute an "authorization boundary," and whether violating terms equates to "unauthorized access."

In Amazon v. Perplexity, Amazon argued that Comet, logging in and acting on the user's behalf with authorization, still bypassed its technical measures and terms restrictions. The Ninth Circuit overturned the preliminary injunction on the grounds that the person actually accessing the system was the user, with Perplexity merely providing a tool—thus not satisfying the CFAA's access-subject requirement—and explicitly stated the ruling does not establish a general rule for AI agents. This distinction means an agent vendor's legal risk largely depends on whether it is characterized as "a user's proxy tool" or "an independent access subject"—a definition that remains unsettled.

A Web Built for Humans, With No Door Left Open for Agents

AI agents are designed to use the web on people's behalf, but the web's underlying assumption is that "humans will visit in person." Ads depend on human attention, CAPTCHA distinguishes humans from bots, and terms of service are contracts written for people to sign. Agents satisfy none of these assumptions—even though they represent people, in the eyes of the web's mechanisms they are indistinguishable from bots.

eBay's statement reveals the key shift: it doesn't ban all third-party agents, but restricts unauthorized agents, automated scraping, and model training. The question is shifting from "is it an agent?" to "is it authorized?" But who grants authorization, and how, has no mechanism yet. Services with partnerships work; those without partnerships stall. This is exactly why users of Muse, Dots, and Instinct keep hitting walls in everyday shopping and booking.

Whether the web can transform from a network built for humans into one where agents can also pass depends on whether these standards can be implemented in time. Until then, the gateway to the agent era remains guarded by a series of different locks.

One-line Summary

Mainstream websites are shutting AI agents out through both deliberate blocking and unintended security collateral damage.

Paragraph Summary

The article surveys the widespread blocking AI agents encounter on the real web: services like Yelp, Delta, and JPMorgan Chase explicitly restrict or ban agent access, and platforms like eBay have even suspended related accounts. Blocking falls into two categories—deliberate corporate decisions based on data licensing and security, and unintended collateral damage from CAPTCHA and anti-scraping mechanisms—with identical outcomes for users. Cloudflare's default blocking of mixed crawlers further expands the blockade. Legally, the Ninth Circuit overturned the preliminary injunction in Amazon v. Perplexity but explicitly declined to establish a general principle. Meta is working with Walmart, Stripe, and others to push open standards, while the core question has shifted from "is it an agent?" to "is it authorized?"—and the absence of an authorization mechanism is precisely why agents struggle to get through.