The open web is getting less open for agents, and the blocks are coming from ordinary companies rather than from regulators. Yelp only lets in agents that pay for its data licensing program, Delta Air Lines stops agents from booking tickets, and JPMorgan Chase and Charles Schwab block agent access to accounts over security concerns - all reported by The Verge, which also found users saying Cars.com and Amtrak stopped working with their agents. Source: https://www.theverge.com/ai-artificial-intelligence/1013195/ai-agents-blocked-web
Key facts
| Fact | Detail |
|---|---|
| Question answered | Websites Are Closing Their Doors to AI Agents |
| Short answer | Yelp only allows agents that pay for its data licensing program, Delta blocks agent-booked tickets, and JPMorgan Chase and Charles Schwab block agent account access on security grounds. |
| Reading time | ~5 min |
| Last updated | 2026-10-18 |
The article, by Emma Roth, frames the gap neatly: OpenAI, Meta, Google and Instinct promise an agent that scours the internet on your behalf, and the internet is increasingly saying no.
Who is blocking what
The reported list is worth reading as a map of where agents actually get stuck:
- Yelp - agents must be part of its paid data licensing programme. This is a commercial decision, not a technical one.
- Delta Air Lines - agents cannot book tickets on a user’s behalf.
- JPMorgan Chase, Charles Schwab - agent access to accounts is blocked, citing security.
- Cars.com, Amtrak - users report they previously worked and now do not, which suggests quiet blocking elsewhere.
- Amazon - the longest-running fight, covered below.
Users of Meta’s Muse, xAI’s Grok, OpenAI’s Dots and Instinct are the ones reporting failures. Note the shape of that list: these are consumer agents that act as you in a browser, which is precisely the kind of traffic a site cannot easily distinguish from fraud.
The Amazon vs Perplexity case set the template
Amazon banned Perplexity’s agentic shopping feature and sued. Its argument was contractual and practical: it had “repeatedly requested” that Perplexity stop allowing agents to shop on its site, and third parties buying on behalf of customers “should operate openly and respect service provider decisions whether or not to participate.”
Perplexity’s counter-argument is the one every agent company will end up making: Amazon does not want agents because agents mean fewer human eyeballs on ads, and it likened its agent to an extension of the user - arguing Amazon “does not believe in your right to hire labor, to have an assistant or an employee acting on your behalf.”
A judge initially ordered Perplexity to stop. An appeals court overturned that in August. Amazon has filed an amended complaint. In other words: unresolved, and being litigated while the technical blocks go up anyway.
The same pattern repeated with Meta’s Muse - Amazon said its “continued access” violates site policies - while Grok, Instinct and Dots were also reported as unable to use Amazon. Elon Musk’s response was that he “should start a competitor to Amazon,” which is one way to solve a distribution problem.
Anti-bot systems cannot tell your agent from a scraper
The technical layer is where this gets uncomfortable for anyone building on agents. Chris Canal, CEO of the AI safety evaluator EquiStamp, told The Verge that the same safeguards a site uses against someone “trying to scam or hack” are what an agent trips: “These AI agents trigger those same safeguards.”
That is the crux. A site’s defences are tuned to detect automation, not authorisation. An agent with your explicit permission and your logged-in session still looks, at the packet level, like a bot - and increasingly like a bot that is probing accounts.
Cloudflare has made this easier to enforce. After a one-click block for AI crawlers in 2025, it began blocking crawlers that scrape for both search indexing and AI training. That is a product decision with a side effect: it gives every site a switch, and switches get flipped when traffic gets expensive.
Canal’s prediction is the part worth sitting with: as more sites add “prove you are not a robot” interfaces, the web gets more annoying for humans too - “we could see them on a simple grocery shopping website soon.”
What this changes for desktop agents
The interesting split is not cloud versus local; it is whose identity the request carries.
- Cloud agent, its own infrastructure: the site sees an unknown client. It gets blocked, rate-limited, or asked to pay for a licence.
- Local agent, your machine, your session: the site sees your account and your IP. It usually works - until the behaviour pattern trips fraud detection, or the terms of service say no automation.
That is why the practical value of a desktop agent is not “it can browse anything.” It is that it works on the things that live on your machine and in your accounts, where you are already the authenticated party. Sorting a folder, filling a form you are looking at, reconciling two spreadsheets, driving an app that has no API - none of that requires the open web’s permission.
MOOGH takes that position deliberately: it runs locally, acts on your files and apps, and asks you to approve the steps that matter rather than pretending a remote bot is you - [download MOOGH].
What to do about it
- Prefer first-party APIs. If a service offers an integration, use it. An API is permission; a browser automation is an argument you may lose.
- Keep a human on anything that spends or changes an account. Booking, buying, transferring, deleting. The block is often the site’s way of asking for exactly that.
- Do not build a business on scraping a site that has started licensing its data. Yelp’s position - pay or stay out - will be copied.
- Expect the CAPTCHA tax. Budget for agents that fail on a percentage of sessions and need a human to finish.
- Read the terms once. “Technically possible” and “allowed” diverged years ago; agents just made the gap expensive.
FAQ
Is this the end of browsing agents? No - it is the end of the assumption that they can use anything. The agents that survive will be the ones with integrations, licences, or a human in the loop.
Why would a site block an agent that a customer sent? Because the site cannot verify the customer sent it, because automation changes ad exposure, and because an agent that can move money is an attack surface. All three are the site’s problem to manage.
Does using a residential IP help? It helps with detection and does nothing for terms of service. Blocks are increasingly policy-driven, and those follow the account, not the address.
Where does the legal fight stand? Unresolved. Amazon’s suit against Perplexity survived an appeal in August and continues on an amended complaint; other companies are blocking first and arguing later.
Related reading: