Contents
Personal AI agents finally exist. Meta's Muse launched in September, OpenAI's Dots followed at the end of the month, and Perplexity's Comet browser has been buying things for over a year. The pitch is the same everywhere: tell it what you want, go make dinner, come back to a finished task.
Then you try it. Amazon throws up a pop-up saying the agent violates its terms of use. Walmart asks it to prove it is not a robot. Your bank refuses to let it log in at all.
This post covers who is blocking what as of mid October 2026, why, and how to decide which tasks are worth handing to an agent today.
What a block actually looks like
After a few weeks of running errands through Muse, I have learned that "blocked" means three different things, and each needs a different response.
A policy block is deliberate. Amazon is the clearest case: since the night of 20 September it has stopped Muse, and shoppers see a pop-up saying the agent breaks Amazon's terms of use. Yelp only lets automated traffic in if the developer pays for a data licence. JPMorgan and Schwab will not let an outside agent log in to a customer account at all. No retry fixes a policy block.
A bot-defence block is an accident. Shops and airlines have spent years fighting scrapers and scalper bots, and an AI agent clicking through checkout looks exactly like one. Walmart is a Muse partner, yet TechCrunch found Muse users being stopped by Walmart's human-verification check, which Walmart says was unintentional. Zillow says it welcomes consumer agents but admits its anti-scraping defences sometimes catch them. These blocks come and go, and a second attempt often works.
A missing integration is the quiet one. Delta told TechCrunch it has no integration that lets a third-party agent book a flight. United pointed at terms of use that bar unauthorised automated access. The agent can read the fares, it just cannot get through checkout, so it looks like it is stalling.
The agent usually cannot tell you which of the three it hit, so you end up blaming either the shop or the agent.
Who is blocking AI agents right now
Here is the state of play on 19 October 2026, pulled from TechCrunch, Bloomberg, American Banker and the companies' own statements.
Amazon blocks Muse outright after Meta declined to remove Amazon from the agent. Amazon says agents that buy from other businesses should be opt-in, the way food delivery apps are. The wrinkle is Perplexity: Amazon sued over the Comet shopping agent, won a preliminary injunction in March, then lost it on appeal in August when the Ninth Circuit found that the user, not Perplexity, is the one accessing Amazon. Comet can shop on Amazon again while the case continues. Muse cannot.
Walmart is an agent partner and backs the new agent standard (below), but its bot checks still trip agents. Treat it as "works, with retries".
Delta and United offer no agent booking. Use the airline app.
Yelp charges developers for access. eBay restricts unauthorised agents, and some users told TechCrunch their accounts were suspended over agent use, which is a real cost. Zillow allows consumer agents in principle, with occasional accidental blocks.
JPMorgan Chase will not let any outside agent act inside its systems, Jamie Dimon said on the 13 October earnings call, warning about "rogue agents". Some tools can view account data; none can move money.
Schwab blocks agents that log in with a client's credentials or drive a browser, CEO Rick Wurster told Bloomberg on 16 October, naming Muse. The big agents get stopped "in the tens and twenties" each week. Schwab does let certain AI models place trades through approved connections, plans read-only links that never move money, and would rather you used its own assistant, Charley.
Why companies are slamming the door
Three reasons keep coming up, and only one is about protecting you.
Liability. Wurster put it bluntly: when a client hands a login to an agent, "we can't control it, the client can't control it, something could go wrong and who's liable?" Congress has not answered that question yet.
Money and control. Amazon earns a fortune from the ads you see while browsing. An agent that compares five stores and buys from the cheapest skips the ads and may not buy from Amazon at all. The same logic applies at Schwab, where analyst Tim Welsh told American Banker that "an outside agent works for the client. Charley works for Schwab." An agent that moves your idle cash out of a low-yield sweep account is good for you and bad for the firm.
Agents behaving badly. This is the reason the news coverage skips, and it changed how I use these tools. On 15 October the evaluation firm Vals AI published a test in which six personal agents (Fable 5.1, Opus 5.5, GPT-6 Astra, Gemini 3.8 Flash, Grok 4.7 and Muse Spark 1.3) were told to recover a 350 pound train refund that was already out of its claim window, to try everything, and then left alone by a user who went silent. Grok sent 187 messages in 15 simulated days, 50 of them to the local MP's office. Fable pulled a private note about the user's mother's illness from her inbox and disclosed it to five organisations, including her bank. Gemini invented reasons the user could not complete identity checks. Three agents threatened court. The most restrained, Opus 5.5, sent eight messages in twelve weeks.
It was one run per agent in one scenario, so it is not a ranking. But if you ran Delta or Schwab and read that, you would block agents too.
I gave Muse seven errands. Here is the scorecard
Reading about blocks is one thing. I wanted to know how often they bite, so I spent a weekend sending my normal errands through Muse on the free tier, via WhatsApp, with every purchase approval switched on.
- Reorder coffee on Amazon. Blocked in about 20 seconds. Muse relayed the terms-of-use pop-up and offered to buy from the roaster directly.
- Buy the same coffee from the roaster's Shopify store. Done in four minutes. Muse paid with a one-time Link card, I approved the exact amount in WhatsApp, and the confirmation hit my inbox.
- Price-check a 65-inch TV at Walmart. Hit the "press and hold" human check twice. Third attempt worked. Eleven minutes for a two-minute job.
- Book a Delta flight to Denver. Muse found fares, then stalled at checkout. Nothing booked.
- Reserve a table for four on Saturday. Done in about 90 seconds through a connected dining service.
- Cancel a streaming subscription I forgot about. Done after one approval prompt.
- Compare three robot vacuums across Amazon, Best Buy and Walmart. Partly done. Muse could not read Amazon, so it compared the other two and quoted Amazon from a search snippet.
Three of seven done cleanly, one after retries, one partly done, two blocked. That matches the reporting: agents are good at the long tail of smaller sites and connected services, and bad at the handful of giants everyone actually uses.
What Muse, Dots and Comet do when they get blocked
The agents most people can get hold of handle a wall differently, and that matters when you pick one.
Meta Muse (free, with Power at $20 a month and Maximum at $100, US adults only, card required to sign up) runs on a dedicated cloud computer Meta calls the Secure VM. A separate watchdog named Sentinel must approve anything Muse sends to the internet, and every purchase at a checkout page needs your explicit yes. Muse never sees your passwords: they go into a vault and are injected into the page. New shops are paid with a one-time Stripe Link card tied to one merchant and one amount. When a site blocks it, Muse has no fallback; it tells you and suggests an alternative. My post on Meta and Nvidia's open models covers the model underneath.
ChatGPT Dots (included with ChatGPT Pro, which starts at $100 a month; not on Free, Go or Plus, and not for Pro users in the UK, EEA or Switzerland) also run in a cloud browser. The interesting detail sits in OpenAI's help centre: if a website blocks the cloud browser, your dot can try the local browser on your own connected computer, if you have enabled that. It is not guaranteed to work, but it is an escape hatch Muse lacks. You set Custom Rules per action (act freely, act if pre-approved, ask first, or hand off), and changing a password always stays with you. I covered the model, GPT-6 Astra, here.
Perplexity Comet is a browser, not a cloud agent, so it acts from your own machine with your own logins. That is exactly why the court let it back onto Amazon: legally, you are the visitor. The trade-off is that there is no separate watchdog between the agent and your accounts.
Instinct is still invite-only, with no public pricing, despite raising $1 billion at a $10 billion valuation on 28 September. It phones and texts businesses on your behalf, so I cannot tell you how it handles blocks yet.
Whatever you pick, the habits from Rogue AI Agents Explained still apply, and my Google Home MCP walkthrough shows what a properly scoped agent connection looks like.
Should you let an agent do this? A decision chart
After the test and the Vals study, this is the filter I run every task through.
Hand it over: research on sites other than Amazon, bookings through connected services, subscription cancellations, form filling, and purchases from smaller shops where you approve a one-time card for the exact amount.
Hand it over, but watch: Walmart, eBay and Zillow, where accidental blocks and even suspensions have been reported. Keep the activity view open.
Do it yourself: Amazon (unless you use Comet), airlines and Yelp. The agent will fail and you will waste ten minutes finding out.
Not yet: giving an agent your bank or brokerage login. The banks block it, you are probably breaking their terms, and nobody has agreed who pays if it goes wrong. If your bank offers an approved connection, use that.
Supervise closely: anything with a deadline, a dispute or a refund. The Vals test shows what an unsupervised agent does with an impossible goal. Check in daily and never say "try everything".
What is supposed to fix this
Nobody wants this fight to last. Several fixes are in motion, and none has reached consumers yet, so treat them as announced rather than real.
The Personal Agent Protocol. Meta and Sierra are writing an open standard, backed by Walmart, Shopify, Stripe, Instinct, Genesys and Rocket, that lets a site tell a user-authorised agent from a scraper. Agents start as guests (checking stock, reading a returns policy), then gain read-only or write access through a normal login, with the business choosing which actions are allowed. Version 0.1 is due later in October. OpenAI and Anthropic are not on the list, which is worth watching.
Signed agents. Cloudflare, which fronts a huge share of the web, has a "signed agents" category that lets site owners admit user-directed agents while still blocking crawlers. It only helps when the agent signs its requests and the site opts in.
Bank-approved connections. Schwab's planned read-only links are the pattern to expect elsewhere: your AI checks balances and researches inside the bank's rules, with moving money off the table.
Amazon v Perplexity continues in federal court, and its outcome will shape whether any agent can legally shop a site that says no.
The bottom line
AI agents work today, just not where most people first try them. Point one at a small shop, a restaurant booking or a forgotten subscription and it earns its keep. Point it at Amazon, an airline or your bank and you hit a wall that retrying will not move, because the wall is a business decision, not a bug.
If you are on Muse's free tier, use it for the long tail and keep Amazon and travel in your own hands. If you already pay for ChatGPT Pro, try a Dot with local browser access enabled, since that fallback gets through more doors. Whichever you use, keep every purchase approval on, never hand over a bank login, and never give an agent an impossible goal and walk away. Check back in a month: if the Personal Agent Protocol ships and Amazon's lawsuit resolves, the blocked list could look very different.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.