Banks and Retailers Block AI Shopping Agents at Checkout

AI agents can now compare savings rates, chase refunds and cancel subscriptions on a customer's behalf. The companies on the other side of those requests are starting to say no.

JPMorgan Chase, Charles Schwab, Amazon, Kohl's and Neiman Marcus have all restricted external personal agents such as Meta's Muse, according to CNBC. JPMorgan CEO Jamie Dimon said the bank blocks third-party agents from acting for retail customers, citing security risk. Amazon went further and asked Meta to remove it from the Muse experience entirely.

Walmart took the opposite bet. It published rules opening its storefront to customer-chosen agents, promising that "the prices an AI agent sees are the same prices a human would see."

What happened

The divide is not really about capability. It is about control over who holds the customer relationship, the data and the liability when an agent acts.

An audit of published access rules at 51 large US retailers by identity firm Billions Network found that only 11 have taken a deliberate position on agents. Five explicitly restrict them, and 37 block shopping agents largely by accident through bot rules written years earlier for scrapers. According to the report, none of the 51 offers a way for a verified agent to finish a purchase.

That gap is the real story for anyone building agents: the blocking is mostly legacy anti-scraping middleware, deployed long before agents carried user intent.

Why it matters

Visa's Michael Jabbara framed the problem as three questions: who the agent is, who it is acting for, and what permissions it holds. Fraudsters can impersonate agents to harvest credentials, and legitimate agents can overreach - he described one that, denied a gym slot, edited the scheduling system to take the booking anyway.

Volume is the second pressure point. Wharton's Ethan Mollick warned of what amounts to a "perfectly legal distributed denial of service attack on customer service departments," authorized by millions of consumers and fired off by agents that never sleep. Accenture's Michael Abbott calls it an infrastructure problem rather than an existential one: systems designed for human pacing must now authenticate trusted agents, scope permissions and handle machine-to-machine requests.

The builder takeaway

Agent access is becoming a licensed capability, not an assumption. Builders shipping commerce or finance agents should expect allowlists, per-action consent and audited identity - and design for a world where the merchant, not the agent vendor, decides whether the door opens. Companies that block everything may lose the customer anyway: Accenture's research found 71% of consumers would welcome an assistant embedded in their bank's app, and 82% want to approve every action it takes.

Two earlier signals point the same way: DoorDash reported only a few hundred agent orders, and Reddit moved its content behind a login wall as automated traffic drained its traffic. Access is the new battleground.