Amazon, banks and airlines shut the web to AI agents: an agent's reach is set by the gatekeeper, not the model

By El Ecosistema Startup · October 17, 2026.

Amazon detected at least 185,712 sessions from Comet, Perplexity's agentic browser, on Amazon.com through June 15. That figure comes from Amazon's own lawsuit against the startup. Its traffic engineering team spent more than 1,280 hours handling that automated traffic.

It is not an isolated case. According to The Verge, cited by the source, Delta prevents agents from booking tickets. JPMorgan Chase and Charles Schwab have confirmed they block automated account access for security reasons.

The legal battle has moved to new ground. Amazon sued Perplexity in November 2025. It alleged that Comet entered its store without identifying itself as an agent and passed itself off as Chrome. In March, a federal court in California sided with Amazon and issued a preliminary injunction.

The Ninth Circuit overturned that injunction on August 4 and denied reconsideration on September 10. Its reasoning, according to the source, is that the one accessing Amazon's servers is the user, not the AI company. Under federal anti-hacking law, an agent carrying out the instructions of a person authorized to use the site is not automatically an intruder.

Amazon responded by shifting from hacking to contract. Since May 30, 2025, its Conditions of Use have included a clause requiring agents to identify themselves in the user-agent with the format Agent/[name]. (The user-agent is the header a program uses to present itself to a web server.) Under that framework it blocked Muse, Meta's assistant. Meta countered that Muse "has no visibility into passwords or payment methods."

What stands out is that the two companies are partners. Amazon products have been purchasable inside Facebook and Instagram since 2023. In April, Meta also signed a multibillion-dollar deal to run agentic AI workloads on Amazon's cloud.

The reasons for blocking are mixed. There is security and fraud prevention: anti-bot systems predate agents and, as Chris Canal (EquiStamp) told The Verge, agents trigger those same protections. There is also money. Amazon earned more than $68 billion in advertising last year, according to GeekWire. If the agent chooses and completes the purchase without passing through the storefront, that lever weakens. According to Yahoo Finance, Amazon expanded its robots.txt to block 47 different AI bots.

Cloudflare proposes another path: charging instead of blocking. On August 4 it introduced Cloudflare Wallets and cloudflare.pay identifiers, so that an agent can identify itself and pay for what it consumes. Its Radar data show that bots accounted for 60.6% of HTML requests in the seven days before August 10, versus 39.4% from humans. Since September 15, its default settings block "mixed-use" crawlers on pages with advertising, according to TechCrunch.

At the other extreme, Meta uses Muse as a sales channel with Walmart, Sephora and Best Buy. According to The Next Web, after its September 8 launch it became the most downloaded free app on the U.S. App Store within a week, ahead of ChatGPT.

**Our take.** My thesis is that the bottleneck for agents is no longer the model's intelligence, but permission. It matches what we see on other fronts: models get cheaper and power shifts to the layer of identity, permissions and agreements. An agent operating "on behalf" of the user can only go as far as each platform allows.

Some nuance is needed. A single failure does not prove a ban: it may be anti-bot systems working as they always have, and the source warns of this. Moreover, the double standard is commercial, not ideological. Agents without a deal are rejected, and those that pay or are partners are accepted.

In the short term this is real friction. It favors the big players with signed deals and leaves agent startups with a ceiling set by third parties. It also raises an uncomfortable question of power: who decides which tool can act on your behalf? If the user delegates, it seems reasonable that their choice should count. But, according to the source, by moving the dispute onto contractual ground, the law sides with whoever writes the terms of service.

In the long term I am moderately optimistic. Agent identification standards and micropayments (the Cloudflare model) can turn the conflict into an orderly market, where the agent declares itself, pays and is accountable. That infrastructure is what will allow more tedious tasks to be delegated to AI and free up human time. The risk is that, along the way, the web ends up closed off into walled gardens.

For those building on agents, the practical lesson is simple. Design with degradation in mind, declare the agent instead of disguising it, and negotiate early with critical platforms. A product's reach depends more on those agreements than on the quality of the model.