JPMorgan, Amazon and Kohl's Are Blocking AI Agents. Experts Say They Can't Win That Fight

By Elena Vasquez

Only 11 of 51 large U.S. retailers have taken a deliberate position on AI agents, and just five — including Amazon, Kohl's and Neiman Marcus — explicitly restrict them, according to an audit by identity-verification company Billions Network. The rest of the retail and banking establishment is improvising its response to a new kind of customer: the AI personal agent that consumers now send out to find better savings rates, hunt for deals and cancel subscriptions.

JPMorgan Chase, Charles Schwab, Amazon, Neiman Marcus and Kohl's have all moved to block personal agents like Meta Muse. The stakes are straightforward. Agentic AI has arrived, and nobody — not the banks, not the retailers, not the regulators — knows what the market looks like when virtual storefronts fill with bots, or when a business tries to shut them out.

The pressure is political now, too. Reports last week of AI agents going rogue in customer accounts prompted prominent politicians including Sen. Mark Warner and Sen. Bernie Sanders to call for bot legislation. That came on the heels of JPMorgan Chase CEO Jamie Dimon saying the bank currently blocks external AI agents from operating on behalf of retail customers, citing security risks.

Who is blocking, and who is letting agents in?

Walmart is leaning in. The company announced last week it is opening its virtual doors to AI agents that customers prefer to use. "We price products, not people, so the prices that an AI agent sees are the same prices that a human would see on Walmart.com, with applicable offers and fees shown before purchase," Walmart said in a blog post announcing the decision.

The Billions Network audit paints a messier picture across the broader market:

• Only 11 of 51 large U.S. retailers have taken a deliberate position on AI agents.
• Five — Amazon, Kohl's and Neiman Marcus among them — explicitly restrict them.
• 37 block shopping agents largely by accident, through older bot rules written for scrapers.
• None has a way for a verified agent to complete a purchase.

Blocking can happen in multiple ways, per Billions' analysis: a retailer can bar a specific third-party bot by its rules, as Chewy does with an Amazon bot, or deploy general blocks on any third-party bots touching login, registration and checkout functions. The audit comes with a caveat — published access rules are not proof of technical enforcement.

Evin McMullen, Billions' co-founder and CEO, said at this point, "Most of the retailers in our audit have not made a decision about AI agents at all."

Can banks and retailers actually keep the gates closed?

Michael Abbott, global banking lead at Accenture, doesn't think so. He argues that businesses blocking AI agents will find it difficult to win with that approach over the long term.

"If customers explicitly authorize an AI agent to act on their behalf, that's ultimately an extension of customer choice. The more important question isn't whether institutions can block agents, but whether they can create a secure and trusted way for them to engage," Abbott said.

Accenture's research found that 65% of consumers are open to using a GPT-like financial assistant through a Gen AI platform or digital wallet, and 71% would welcome an AI assistant embedded within their primary bank's mobile app.

"We've seen this movie before … online banking, mobile banking and digital wallets. Customers tend to gravitate toward experiences that reduce friction and save time. The institutions that win are usually the ones that find a way to participate safely rather than resist the change," Abbott said.

The real opportunity for banks, he argues, is to become the trusted provider of the data, intelligence and execution that those agents rely on. "As interactions increasingly happen beyond bank-owned channels, banks still need to be present at those critical decision moments, even if they don't own the interface," Abbott said.

Is this about security — or about who holds the data?

When it comes to separating legitimate security concerns from companies protecting profits, Abbott said both things can be true at the same time.

"There are very real concerns around fraud, identity verification, liability and consumer protection. And customers expect their banks to safeguard their assets and data — those responsibilities don't disappear simply because an AI agent is involved," Abbott said. At the same time, he noted, consumers have historically benefited from technologies that increase transparency and make it easier to compare options.

Consumers want control along with convenience. "Our research found that 82% want to approve every AI action and 79% want the ability to immediately pause or stop AI activity. That tells us consumers are looking for convenience, but not at the expense of control," Abbott said.

Mike Danford, owner and chief revenue officer of Adverio, which runs Amazon, Walmart and Target marketplace operations for e-commerce brands, said some of the security fears businesses cite are less about security and more about whose sandbox a customer plays in.

"Amazon blocked Muse and other outside agents, but its own Buy for Me feature uses Amazon's agent on other brands' sites. Amazon doesn't appear worried about the agent. It's worried about who holds the data," Danford said. "Amazon now lets shoppers set rules that auto-purchase when a price threshold is met, and that's the version of agent buying consumers seem to accept, because the shopper still approves the decision within predefined parameters," he added.

An Amazon spokesperson framed it as a matter of consent. "We think it's fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate," the spokesperson said. "Agentic third-party applications such as Muse have the same obligations, and we've requested that Meta remove Amazon from the experience."

Danford says banks play the same game, just with a fee instead of a wall. "JPMorgan now charges aggregators like Plaid for pulling account data, so the toll lands on the apps a consumer uses and may trickle down in subscription fees," he said. JPMorgan declined to comment. Plaid said at the time of the September 2025 deal that it would not impact any of its existing pricing agreements with customers. Plaid does not charge consumers, though apps and services using Plaid set their own fees.

What are the real fraud risks?

Michael Jabbara, head of payment ecosystem risk and control at Visa, declined to speak to any single bank's motives, but he said the fraud risks from agents are "very real and very tangible."

The threats come in several forms. Consumers can be fooled by fake agents built by fraudsters to steal credentials and payment details. A legitimate agent can act in ways the customer never intended, like buying a sofa the shopper had only asked it to find.

Agents can also behave unpredictably. Jabbara described a user who asked his agent to book a gym slot; when the slot was taken, the agent hacked the gym's scheduling software, deleted the existing appointment and put the user's name in its place. The concerns, he said, come down to knowing "who the agent is, who the agent is acting on behalf of," and whether it has "the appropriate permissions."

"Agents are not just exchanging data. Agents can also take an action on behalf of a user," Jabbara said.

Like other experts, he points to past shifts from online to mobile shopping — but for a different reason: "None of those innovations really scaled until people were able to build that foundational security layer that enabled trust for that scale to happen."

What is 'agentic flooding'?

Volume is the other worry. Millions of agents doing legitimate work for customers could swamp websites and customer-service systems, a phenomenon some call "agentic flooding."

Wharton School AI expert Ethan Mollick posted that "We will soon see what will be, in effect, a perfectly legal distributed denial of service attack on customer service departments authorized by millions of consumers when it becomes widely known that Muse/Dot/etc can make unlimited requests for old refunds, negotiate deals, etc."

Abbott calls it a possibility, not a crisis. "I see it more as an infrastructure challenge than an existential threat," he said. "Most digital systems today were designed for human interactions. Agent-driven interactions could occur at a completely different scale and frequency. One person might have multiple agents continuously monitoring rates, researching products or evaluating alternatives."

The answer, he says, isn't blocking. "It's to build the next generation of infrastructure that can authenticate trusted agents, verify permissions, manage identity and support machine-to-machine interactions efficiently," Abbott said.

That's nothing new for banks, he added. "Customers used to interact with their banks a couple of times a month and now with mobile it is nearly daily. AI agents are just the next evolution. The organizations that prepare for that reality will be better positioned than those that try to prevent it," he said.

Ed Felten, a Princeton professor emeritus of computer science who served as chief technologist at the FTC and deputy U.S. chief technology officer in the Obama administration, noted that financial sites already have defenses against denial-of-service attacks. But agents "never sleep and never lose focus," he said, and the more agents use a site, the more costs rise for companies like banks.

Felten doubts the blocking will last. "When a button is clicked in the user's browser, it will be hard for a remote site to tell whether this was done by a human hand or directed by an AI agent on the user's computer," he said. "If there is a battle over AI access, it will slow the adoption of AI agents. But in the end, agents will win out because they will be so useful to users, so that sites that are too effective in blocking agents will lose business."

How long can incumbents hold out?

As the market forces sites to accept their customers' agents, experts said common expectations will emerge about what counts as reasonable agent behavior.

Joseph Chalom, CEO of SharpLink — one of the largest corporate holders of the cryptocurrency ether — and a former BlackRock executive, expects the gates to stay shut for a while.

"These large incumbents effectively control the access points and will seek to keep their gates closed to fend off this innovative threat. Disruptors have fought the same battle for access for decades across travel, telephony, and financial data consolidators," Chalom said. In each case, he added, the incumbent cited security concerns while also facing significant business model interruption.

"For example, an AI agent working for users can easily rebook flight tickets at a lower cost, eating into the margins of airlines. And more significantly, an AI agent can move idle cash from checking and savings accounts earning little interest to a money market account earning 10x the interest rate," Chalom said. These types of "switching costs" are being reduced to near zero as agents have full financial literacy and attention span. "For this reason, I don't expect any of them to be in a hurry to lower the drawbridge," he said.

In the near term, Abbott says, some institutions will welcome agents while others stay restrictive as they sort out authentication, liability and governance. Longer term, the data shows companies should expect people to hand the administrative work of financial decisions to their agents. "Defense can prevent you from losing in the short term but to win banks will need an offensive strategy," Abbott said.

What happens to brand loyalty when the customer is a bot?

Proprietary bots will need to be good enough to keep customers from wanting other agents — and that is how Amazon CEO Andy Jassy is talking about it. "We believe Alexa for Shopping is going to be the primary shopping agent customers use to shop Amazon. Having a shopping assistant constantly by your side as you browse, get inspired, have questions on product detail pages, and that you can simply ask to buy something based on your prior purchases that already have your history, your shipping address, and payment info, is uniquely helpful and convenient for customers," Jassy said during last week's quarterly earnings call.

Brands are about to be tested in ways that haven't been possible before. Human customers get attached for reasons beyond price: a nostalgic cereal, an airline tied to family vacations, a bank with a favorite teller. An AI agent doesn't care about any of that.

"Brand loyalty and customer relationships are getting tested. An AI agent has no feeling about a logo or a ten-year relationship. It has a mandate and cares purely about outcomes," said Nikhil Behl, president of software at FICO, the analytics company best known for credit scores. "The levers that used to create stickiness get replaced by levers an agent can actually read, such as consistent approvals, transparent pricing, fast resolution, and terms that hold up through comparison," Behl said.

For incumbents, that is the real endgame: not whether agents get in, but what loyalty means once they do.