Artificial Intelligence

Websites Are Blocking AI Agents From Accessing the Web

Personal AI assistants designed to handle online tasks and purchases are facing growing hurdles as websites deploy security measures and deliberate blocks to restrict automated access.

Radwan AbdulhadiEditor and technology writer

Published: November 3, 2026 · Updated: November 3, 2026 · 4 min read

Websites Are Blocking AI Agents From Accessing the Web — Image: Engadget

The Promise and Reality of AI Assistants

The appeal of personal AI agents like Meta's Muse is that these assistants can navigate websites, fill shopping carts and book travel instead of handing you recommendations and leaving the rest to you. However, giving an agent permission to act on your behalf doesn't mean a website has agreed to deal with it.

Some restrictions are deliberate, while others come from security systems that can't reliably distinguish legitimate agents from unwanted automated traffic. Either way, users can end up back at the keyboard doing the very task they wanted to avoid, whether dealing with a CAPTCHA or a direct block from a retailer.

A smartphone on a red and blue backlit keyboard displays Meta's white plush Muse mascot with a frowning face. — Image related to the report from Engadget · Source: Engadget

Security Concerns and Financial Risks

Security is a much larger concern when money is involved. During JPMorgan Chase's October earnings call, CFO Jeremy Barnum stated that some agents use shared login credentials and screen scraping to transfer funds, methods he described as "not secure."

The bank actively blocks those methods where possible. Barnum also warned that customers who hand over their credentials could ultimately be responsible if an agent takes an unwanted action. While a botched grocery order is frustrating, an unauthorized bank transfer presents a completely different kind of operational and financial headache.

Commercial Disputes and Retail Bans

Beyond security protocols, businesses have clear commercial reasons to control automated access. Amazon has been direct in its approach, deliberately blocking rival shopping tools from operating on its site. The retail giant is also battling Perplexity over its Comet AI browser, arguing that the tool violates access rules and puts customer data at risk.

Perplexity maintains that users have authorized the browser to act on their behalf. Although a federal appeals court vacated a preliminary injunction against Perplexity in August 2026, the underlying dispute remains entirely unresolved. Adding an interesting wrinkle to the competitive landscape, Amazon has its own Buy for Me feature that can purchase products from third-party websites.

Other major companies are managing automated traffic through policy and infrastructure. eBay's user agreement explicitly prohibits unauthorized buy-for-me agents unless the company grants specific permission. Meanwhile, Delta has indicated it has no integration allowing third-party agents to book flights through its website, though the airline did not confirm whether it deliberately blocks specific tools.

Meta's Muse AI agent — Image related to the report from Engadget · Source: Engadget

Bot Protections and Verification Hurdles

Not every blocked agent is the result of a deliberate corporate ban. Walmart's experience with Meta's Muse highlights how human-verification prompts can abruptly interrupt automated shopping sessions, even when the retailer is an official partner. Similarly, Zillow has acknowledged that its anti-scraping defenses sometimes mistakenly catch agents that it otherwise permits on its platform.

This automated routine resembles the experience of browsing through a virtual private network (VPN). Google explains that shared VPN networks frequently trigger reCAPTCHA challenges when their traffic closely resembles automated activity. AI agents can encounter identical security checks simply by navigating a standard website, even when strictly following user instructions.

A man using an AI assistant on his phone. — Image related to the report from Engadget · Source: Engadget

Infrastructure Solutions and Platform Approaches

Infrastructure providers are beginning to offer more nuanced controls for website owners. Cloudflare, which previously introduced specific controls against AI web crawlers, now allows website operators to clearly distinguish between search crawlers, AI training bots, and agents acting on behalf of users.

Under Cloudflare settings, new domains default to allowing search crawlers while blocking AI training bots and agents on pages displaying ads, though website owners can adjust these rules independently. Other platforms are pursuing collaborative integration; Shopify's checkout tools allow compatible browser agents to update checkout details and submit orders after buyer confirmation, safely handing control back to shoppers whenever authentication steps are required.