On October 18, a short post from @trikcode listed four doors closing at once: Delta blocking AI agents from booking flights, JPMorgan Chase and Charles Schwab blocking agents from customer accounts, Yelp requiring paid data licensing, and Amazon blocking shopping agents. It closed with "the internet is starting to block AI agents that were supposed to do everything for us." Within three days the post passed 4.7 million views, which tells you how many people had quietly assumed the opposite.
The reporting behind it holds up. The Verge's October 17 story found that users of Meta's Muse, xAI's Grok, OpenAI's Dots and Instinct had been hitting blocks across major sites, and that several companies confirmed the restrictions. For an owner running a 5 to 75 person service business, this is not a story about Silicon Valley rivalries. It changes two practical decisions: how you build the agents that work for you, and how you treat the agents that will show up on your own website on behalf of customers.
TL;DR
- Major sites are closing to outside AI agents: Delta on bookings, JPMorgan Chase and Charles Schwab on account access, Yelp unless the agent pays for data, Amazon on shopping agents.
- An agent that depends on logging into someone else's website with a shared password is fragile. Build on official connectors and APIs instead.
- Your own site will get agent visitors too. Decide what they can read, what they can request, and what always needs a person.
- The rule that survives all of this: AI drafts, your team approves.
Who is blocking AI agents, and why
Each company gave a different reason, and the reasons matter more than the headline.
| Company | What it restricts | Stated reason | Source |
|---|---|---|---|
| JPMorgan Chase | Outside agents acting inside customer accounts | Risk to clients and the bank | CEO Jamie Dimon on the earnings call, confirmed to CNBC |
| Charles Schwab | Agents logging in on a client's behalf | Control and liability | CEO Rick Wurster to Bloomberg |
| Delta Air Lines | Agents booking tickets for users | Not spelled out publicly | The Verge |
| Yelp | Agents that do not pay for its data licensing program | Commercial | Yelp to TechCrunch |
| Amazon | Third-party shopping agents | Site policy | Amazon statements and litigation |
The bank quotes are the clearest. Dimon said JPMorgan is "not going to allow just any… outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan," per The Verge. Schwab's Wurster was more specific about the mechanism: "We don't want someone just giving their password to Muse, and letting Muse come in and take action on that client's behalf. We can't control it, the client can't control it, something could go wrong and who's liable?" (The Verge).
Read that second quote twice. The objection is not to automation. It is to an agent holding a person's password and acting with nobody in a position to stop it. That distinction is the whole lesson for a small business.
There is also a quieter cause. Chris Canal, CEO of the AI safety evaluator EquiStamp, told The Verge that many blocks are not aimed at agents at all: anti-bot systems built to stop scrapers and fraud fire on agents because agents click like bots. So even sites with no anti-agent policy can break an agent workflow without warning.
Side one: the agents that work for you
It is tempting to picture an AI assistant as something that logs into the same websites they do and clicks through them. This month shows why that is the weakest way to build. A browser agent using your login can stop working the day a site changes its bot detection, and nobody will email you about it. You find out when the invoices did not get pulled or the booking never happened.
The sturdier pattern is to connect through doors the vendor built on purpose. A good example arrived the same week. On October 15, Mercury let ChatGPT and Claude request payments and transfers through its official connector, and the Mercury docs are explicit that the AI tool "cannot approve the request or move money on its own." The bank did not block agents. It gave them a narrow, permissioned door with a human approval step on the other side.
That is the shape to look for in any tool your team relies on:
- An official connector or API. It survives website redesigns and bot-detection updates because it is not pretending to be a person.
- Scoped permissions. The agent gets read access, or the ability to create a request, not your full login.
- A separate approval step. The agent prepares the work, and a named person on your team approves it in the vendor's own app.
- A log. You can see what the agent asked for and who said yes.
If a workflow you care about only works by having an agent log in with someone's password, treat it as a prototype, not a process. Keep a manual fallback, and check whether the vendor offers a connector before you build more on top of it.
Side two: the agents that visit your website
The other half of this story gets less attention. If customers start sending agents to book appointments, request quotes or compare providers, those agents will land on your site too. Meta's position, quoted by The Verge, is that "turning away a personal agent means turning away the customer behind it." The banks' position is that an agent acting with a customer's credentials is a liability. Both are reasonable, and a service business sits somewhere in between.
A plumbing company, a dental office or a CPA firm rarely needs to block agents from reading the website. You want your services, service area, hours and pricing ranges to be easy for any assistant to read and repeat accurately. What you should not do is let an outside agent commit you to something without a person on your side confirming it.
A simple way to set your stance:
| What an outside agent wants | Sensible default for a service business |
|---|---|
| Read services, hours, areas, pricing ranges | Allow. Make it plain text and current. |
| Ask a question through your contact form | Allow. Route it to the same inbox a human request goes to. |
| Request an appointment or a quote | Allow the request. A person confirms the slot or the price. |
| Change or cancel an existing job | Require the customer to confirm through a channel you already trust. |
| Pay, refund, or access account details | Not through an outside agent. Use your payment provider's own flow. |
This mirrors what the banks did, scaled down. Reading is cheap and helps you get found. Acting on money or commitments needs a known person and a known channel.
The approval step is the part that does not change
Look across every example in this story and one design holds up. The Mercury connector lets an agent ask, then waits for a person. The banks' complaint is about agents acting with no one able to intervene. The Yelp and Amazon fights are about who controls access and on what terms.
For a small business, that boils down to a working rule SpiAI builds every client workflow around: AI drafts, your team approves. The agent can read the request, pull the customer's history, draft the reply, fill in the quote and prepare the payment. A named person on your team presses the button that commits money, time or your reputation.
Teams that work this way lose very little when a website changes its policy, because the agent was never the thing holding the keys. Teams that let an agent act on shared logins lose the whole workflow the day a site flips a switch.
What to do this week
You do not need a policy document. You need a short audit:
- List every AI tool or automation that logs into another website. Note whether it uses an official connector or a shared password.
- For each password-based one, check for an official connector. Many banks, CRMs, scheduling tools and accounting systems now offer one.
- Add an approval step anywhere money or customer commitments move. If the tool cannot do that, the step is a person reviewing a draft before it goes out.
- Read your own website the way an agent would. Are services, areas, hours and pricing ranges written in plain text, or locked in images and PDFs?
- Decide what an outside agent can request. Write two sentences your front desk can follow when a booking or quote request looks automated.
None of this requires new software. It requires knowing which of your workflows depend on a door someone else can close.
FAQ
Which websites are blocking AI agents right now?
As of mid-October 2026, Delta restricts agents booking tickets, JPMorgan Chase and Charles Schwab block outside agents from customer accounts, Yelp only admits agents that pay for its data licensing program, and Amazon blocks third-party shopping agents, according to reporting in The Verge.
Why are banks blocking AI agents?
Both banks cited security and liability. Schwab's CEO said the firm does not want clients handing their password to an agent that neither the client nor the bank can control.
Will this break the AI tools my business already uses?
It can break tools that log into websites with a shared password and click through pages. Tools that connect through an official API or connector are much less exposed, because the vendor built that access on purpose.
Should my small business block AI agents from its website?
Usually not from reading it. Let agents read your services, hours, areas and pricing ranges so assistants describe you accurately. Keep commitments, changes and payments behind a person or your payment provider's own flow.
What is the safest way to let an AI agent handle payments?
Use a provider whose connector lets the agent create a request that a person approves in the provider's app. Mercury's October 2026 release works this way, and the AI tool cannot approve or move money on its own.
Does blocking happen on purpose or by accident?
Both. Some companies have explicit policies, while anti-bot systems built for scrapers and fraud can also stop agents without any policy aimed at them.
What does "AI drafts, your team approves" mean in practice?
The agent prepares the work, such as a reply, a quote or a payment request, and a named person reviews and approves it before anything is sent or committed.