Websites Are Shutting Out AI Agents: Banks Lead as Yelp, Delta Draw Their Lines

For the past year, AI vendors have all told the same story: agents will book your flights, manage your bank accounts, buy things and run your life. On October 17, a report from The Verge punctured that narrative — the other end of the internet is collectively saying "no." JPMorgan Chase and Charles Schwab confirmed they block AI agents from reaching customer accounts. Yelp only admits agents that pay for its data licensing program. Delta won't let any third-party agent book tickets for travelers. And anti-bot systems are causing collateral damage: login screens, CAPTCHAs and device checks treat automated browsers as hostile by default.

This isn't one company's PR line — it's a forming "right-of-way war": AI companies want agents treated as the user's proxy, while platforms want humans kept inside their funnels. If you're building agent apps, or planning to let agents act for users, this is required reading on the environment — no matter how capable the model, without right-of-way it goes nowhere.

1. Who's closing the door: banks lead, each with their own reasons

Banks are the hardest-liners, with the clearest reasons. JPMorgan CEO Jamie Dimon said on the October 13 earnings call: "We're not going to allow just any… outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan." A bank spokesperson later confirmed JPMorgan blocks outside AI agents from performing tasks for customers.

Schwab CEO Rick Wurster was even blunter with investors on October 15: "there's one way we think is not safe, and that's just an agent coming to our site and trying to log in on behalf of a client. We are not going to allow that," as reported by American Banker. Schwab blocks agents that arrive with a client's login credentials or via browser automation.

The banks' logic is hard to argue with: an assistant holding your password can move money, and liability is completely murky when something breaks. As analyst Tim Welsh put it: "An outside agent works for the client. Charley works for Schwab." — Schwab has its own AI assistant (Charley); certain LLMs may connect to place trades, but money movement is off-limits. Translation: roads can be built, but the toll booths and traffic police must be ours.

Yelp chose the paywall route. It told TechCrunch it only allows AI agents that have paid for its data licensing program. That's not a ban — it's treating agents as a new class of API customer to be charged. Given Yelp's core asset is its merchant review database, the stance is a template for the whole industry: your agent is welcome, but buy a ticket first.

Delta's wording is the softest, but the meaning is the same. Delta said it does not "currently have a partnership or integration" letting third-party agents shop for or book its flights, is "continuing to evaluate," and is taking steps to protect customers from unauthorized automated activity. Note: not an explicit ban — but in practice, there is no officially supported agent booking channel for Delta today.

Two more quietly changed course: some users say Cars.com and Amtrak used to cooperate with their assistants and no longer do. Both are unverified — The Verge flagged them as such. Worth noting, not worth treating as settled fact.

2. Amazon: the longest fighter in this war

If banks just joined in October, Amazon has been fighting for over a year. Last year it banned Perplexity's shopping agent and sued the startup. A judge initially ordered Perplexity to stop, but this August an appeals court overturned the injunction, and Amazon has since filed an amended complaint — the case grinds on.

The two sides' arguments are the standard attack-defense template of this "right-of-way war." Perplexity says Amazon wants human eyeballs on ads, not helpful assistants. Amazon counters that companies buying on behalf of customers should respect site policies. Meta's Muse later hit the same wall: some Muse users saw a pop-up saying continued access by an unauthorized AI agent violates Amazon's Conditions of Use. Musk's response was characteristically his: maybe start a competitor to Amazon.

Meta frames its position as a philosophy of the customer: "Turning away a personal agent means turning away the customer behind it." Its solution is co-optation rather than confrontation: it has cut deals with retailers — Walmart, Gap, Sephora, Expedia, Wayfair, Best Buy — where Muse can prepare a purchase and wait for your approval. But partnerships aren't magic: some users report Walmart checkout failures despite the deal.

Shopify took a different path: opening its storefront network directly to AI agents (we covered it on October 6), via the Shop channel with buyer approval on each order by default. Side by side, the two routes are revealing: Meta negotiates partnerships one by one; Shopify builds one official channel. One is heavy, the other light — but both point to the same conclusion: wild agents that simulate human clicks are losing their habitat.

3. Beyond bans: the wider collateral damage from anti-bot systems

Notably, many agent failures aren't "named bans" at all — they're collisions with pre-existing anti-bot defenses. Login screens, CAPTCHAs and device-fingerprint checks treat automated browsers as hostile by default: "agents that look like browsers still fail the tests that browsers pass."

Developers thus face two layers of obstacles: explicit policy (banks say no, Yelp says pay first) and gray friction (CAPTCHAs that never pass, device checks that block, risk systems that quietly throttle). The latter is nastier, because it never gives you a clear "no" — just an endless "try again."

Reddit users have also reported Google flagging Muse activity — unverified, but fully consistent with the gray-friction logic: platforms don't need to publish announcements; they just tune down the risk score of certain automated traffic.

4. Four judgments for vibe coders

First, the axis of agent competition is shifting from "model capability" to "access permission." For two years everyone compared whose model was smarter and whose tool calls were more reliable. Starting this October, whether an agent can book your Delta flight or check your Schwab holdings may matter more than a 2-point lead on SWE-bench. Chris Canal, CEO of AI safety evaluator EquiStamp, told The Verge: "One of the claims is that they're going to permeate every aspect of our lives." — if major websites actively prevent that permeation, agents will do fewer and fewer useful things, and a gap will open between launch-day demos and what you can actually use.

Second, draw the "right-of-way map" before writing code for an agent app. For every critical website in your target scenario, check: does it offer an official agent channel? (Shopify's Shop and Meta's retail partnerships are positive examples.) Does it explicitly prohibit agents? (Banks and Yelp are negative ones.) Is there litigation history? (The Amazon v. Perplexity ruling from August currently favors the agent side, but the case isn't over.) Only with that map does your product roadmap stand. Otherwise you get the classic embarrassment: applause at demo day, then users discover in week one that they can't book flights or log into banks.

Third, never let your agent log into a bank with a user's real password. This isn't UX optimization territory — it's a red line. Schwab and JPMorgan have said their piece, and if something breaks, the liability lands entirely on the developer. The right posture is official channels (Schwab's Charley, or restricted read-only/trading APIs) — or simply removing finance from your agent's capability list. Admitting "I can't do this" is far more dignified, and far safer, than secretly simulating logins.

Fourth, design a graceful degradation for "being refused." Since gray friction is everywhere, your agent must treat "this site won't let me in" as a first-class state: tell the user clearly which site, why (policy ban / authorization required / suspected risk-system block), and offer alternatives (official app, human handoff, one-tap generated instructions). An agent that is honest and clear when refused preserves more user trust than one that retries a CAPTCHA forever and times out.

5. The flip side: how to build an agent-friendly website

Rather than just decrying the lockout, flip the question: when your own website faces the agent tide one day, how should it be designed to not lose? This report happens to hide two correct answers — Shopify's "official channel" and Meta's "one-by-one co-optation" — which share one set of agent-friendly website design principles, ready to use when you build products.

First, give agents an official lane instead of forcing them to impersonate browsers. Shopify opened its store network to agents via the Shop channel, with buyer approval on every order by default: agents get work done, the platform gets auditability, users keep veto power. Wild click-simulating agents lose their habitat while compliant agents thrive — a "licensed lane" serves platforms better than a blanket ban.

Second, tier authorization for sensitive actions instead of one-size-fits-all. Schwab's approach is worth copying: certain LLMs may connect to place trades, but money movement is off-limits. Split "read-only queries," "order placement" and "fund transfers" into distinct permission tiers; agents only hold low-privilege tokens, and high-risk actions fall back to the official app or human confirmation. Banks aren't afraid of agents checking balances — they're afraid of agents moving money. Tiered permissions answer exactly that fear.

Third, charge early and price transparently. Yelp's "data licensing program" is a template for the industry: agent traffic is a new class of API customer. Instead of quietly throttling via risk controls (gray friction hurts everyone), meter usage and set rate quotas like any API. Meta's deals with Walmart, Gap, Sephora and friends are the same thing at heart — "paying for right-of-way," turning unwritten rules into explicit contracts.

Fourth, make refusal a plain-text protocol. What torments developers isn't "no" — it's an unintelligible "no": infinite CAPTCHA retries, silently down-weighted traffic. If your site won't serve a class of agents, return an explicit rejection code and reason, so developers can build graceful degradation. That's no loss for platforms either: a clear "no" burns fewer server resources than a pretending-to-think "hmm."

One honest closing note: this war won't have a winner anytime soon. AI companies need the "agents everywhere" story to sell subscriptions; platforms need the "humans must show up in person" funnel to sell ads and data. The Verge's headline nailed it — websites are "shutting out" agents, but how far the doors close, and whether a "licensed lane" reopens, will be contested for the next year or two. For developers, the best position isn't picking a side — it's treating "permission" as an architectural constraint on par with "model," written into the design premises of every line of agent code.

Note: The Verge's original piece (Emma Roth, October 17, 2026) could not be opened directly due to this site's browser policy. Facts were cross-verified against a full-text mirror (thetechstreetnow, timestamped 2026-10-17T13:06:35Z) and four independent secondary reports (rrtechpulse, mylistingo, bombos.ai); key quotes (Dimon, Wurster, Meta's statement) are consistent across outlets.