Amazon Blocks AI Shopping Agents as Websites Draw New Battle Lines

Amazon is deliberately blocking Meta's Muse shopping assistant from its site, while Walmart's verification checks have stopped the same agent mid-order — a split that shows how unevenly the web is opening its doors to AI agents that act on users' behalf.

Walmart, one of Meta's retail partners for Muse, says the verification checks that interrupted the assistant were not intended to stop it, according to TechCrunch. Amazon took the direct route. The retailer has blocked the tool outright from shopping on its platform.

The stakes are straightforward. The entire appeal of personal AI agents like Meta's Muse is that they can navigate websites, fill shopping carts and book travel instead of handing users recommendations and leaving the execution to them. But giving an agent permission to act on your behalf does not mean a website has agreed to deal with it. Some restrictions are deliberate. Others come from security systems that cannot reliably distinguish legitimate agents from unwanted automated traffic. Either way, the user can end up back at the keyboard doing the very task the agent was supposed to handle.

What did JPMorgan's CFO say about agent security?

Security concerns sharpen considerably when money moves. During JPMorgan Chase's October earnings call, CFO Jeremy Barnum said some agents use shared login credentials and screen scraping — the practice of extracting data by reading a page's display rather than an official interface — to transfer funds. Barnum described those methods as "not secure."

The bank blocks those methods where it can. Barnum also warned that customers who hand over their credentials could be held responsible if an agent takes an unwanted action. A botched grocery order is an inconvenience. An unauthorized bank transfer is a different category of problem entirely.

How did Amazon and Perplexity end up in court?

Amazon is fighting a second front against Perplexity over its Comet AI browser. The retailer argues the agent violates its access rules and puts customer data at risk. Perplexity maintains that users have authorized it to act on their behalf.

A federal appeals court vacated a preliminary injunction against Perplexity in August 2026, but the underlying dispute remains unresolved. The litigation could set an early precedent for how platforms may enforce terms of service against autonomous browsers.

There is also a wrinkle that complicates Amazon's posture. The company operates its own Buy for Me feature, which can purchase products from other brands' websites — exactly the behavior it objects to when Perplexity does it.

Which other companies restrict AI agents?

Commercial motives reinforce the security ones. Several major businesses have written or spoken rules that limit automated access:

• eBay — its user agreement prohibits unauthorized buy-for-me agents unless the company grants explicit permission.
• Delta — the airline told TechCrunch it has no integration allowing third-party agents to book flights through its website, though it did not confirm whether it deliberately blocks specific agents.
• Amazon — beyond Muse, the retailer is litigating against Perplexity's Comet browser over access-rule violations.

The pattern is consistent: platforms want to control who transacts on their infrastructure, and they want a say in how that permission is granted.

Why can't agents pass a simple CAPTCHA?

Walmart's experience shows why a blocked agent is not necessarily evidence of a deliberate ban. Human-verification prompts can interrupt automated shopping sessions before checkout. Zillow has acknowledged that its anti-scraping defenses sometimes catch agents the company otherwise permits.

From the user's perspective, a deliberate block and a false positive look identical: an assistant that simply cannot finish the job.

The mechanics will feel familiar to anyone who has browsed through a VPN. Google explains that shared VPN networks can trigger reCAPTCHA challenges when their traffic resembles automated activity. AI agents can hit similar checks simply by navigating a website, even when they are following a person's explicit instructions. And switching on a VPN will not override a site's restrictions on automated access.

What is Cloudflare's new default policy?

Cloudflare, which previously introduced controls against AI web crawlers, now lets website owners distinguish between three categories of automated traffic: search crawlers, AI training bots and agents acting on behalf of users.

Since September 15, new domains using Cloudflare have defaulted to a specific configuration:

• Allowed: search crawlers
• Blocked: AI training bots
• Blocked: agents on pages displaying ads

Website owners can adjust those rules. The distinction matters for consumers: a site blocking AI training bots is not necessarily rejecting an assistant trying to buy something. Training-data disputes and transactional access are now separable policy decisions, not one blanket setting.

Is anyone building agent-friendly checkout?

Some platforms are taking a more controlled approach rather than building higher walls. Shopify's checkout tools let compatible browser agents update checkout details and submit orders after buyer confirmation, with control handed back to the shopper for required authentication steps.

That model splits the difference. The agent handles the tedious work — filling forms, updating details, submitting the order — while the human remains the gatekeeper for identity verification and payment authorization. It is the closest thing in the current landscape to a negotiated settlement between platforms and agents: automation with handoffs.

What comes next for agent access?

The current picture is a web in flux. Amazon is blocking rivals in court and in production. JPMorgan is warning customers about credential sharing. Cloudflare has made agent-blocking a default for ad-displaying pages. Shopify is running the experiment in the opposite direction.

For AI agent developers, the lesson from Muse's first outings is that consumer permission does not equal platform permission. Until authentication standards, court rulings or commercial agreements catch up, an ordinary CAPTCHA will remain one of the most effective stop signs an AI agent can encounter.