Banks and retailers block AI traffic while companies improvise with agents: the 'organized chaos' of year one

By GovInfoSecurity (ISMG) · November 6, 2026.

The weekly editors' panel at ISMG, the cybersecurity media group that owns GovInfoSecurity, has zeroed in on a paradox. Companies are stepping up their experiments with AI agents, while at the same time some major banks and retailers are blocking all AI traffic for fear of what those agents might do inside their systems.

According to the panel's summary, many security leaders describe current efforts as fragmented, or “organized chaos.” ISMG also says that banks, retailers, auction sites and others are restricting or outright blocking AI traffic, despite growing interest in agents from both businesses and consumers. An AI agent is a system that doesn't just respond but takes actions on its own (browsing, making purchases, operating accounts).

The panel, made up of Mathew Schwartz, Tom Field, Emilia David and Tiffany Wang, also took up a second topic. According to ISMG, advances in quantum computing architecture could make it possible to break the encryption widely used across the internet in days, and blockchain encryption in just one hour. That is the panel's claim; the available write-up does not detail the technical sources or conditions, so it should be treated with caution until the specific studies are available.

The material is a summary of a video, with no adoption figures or company names, so we cannot gauge how many organizations are blocking AI traffic or which ones.

Our take: blocking is the logical reaction when a company cannot tell a legitimate agent from a hostile bot or attribute its actions. For industry context, this is the identity problem highlighted by various industry studies, which find that machine identities already far outnumber human ones. Without verifiable, revocable and auditable agent credentials, the security team's default answer is no.

That comes at a cost. Blocking all AI traffic offers protection in the short term, but it shuts out consumers who already delegate purchases or errands to assistants, and it leaves companies losing ground to those who solve agent authentication first. We will probably see a shift from “block everything” to “allow what's verified,” with identity standards for agents and liability rules, in line with regulatory efforts around “know your agent.”

This is the awkward phase to be expected with any new technology: organized chaos is a stage, not a destination. If the industry builds the trust plumbing, agents will be able to automate tedious tasks at scale, and that is the path toward freeing up human time that we advocate for in the long run. But today the bottleneck is not model capability; it is trust.