Delta, JPMorgan Chase, Charles Schwab and Yelp have confirmed they are restricting AI agents from booking flights, getting into customer accounts or reading their data. Amazon, which blocked Meta's Muse last month, is now turning away Grok Bot as well, according to users.

When Amazon began blocking Meta's Muse agent on September 20, the dispute looked specific to two companies. Amazon said Meta had not asked permission, that Muse did not identify itself while browsing, and that its access violated Amazon's Conditions of Use. We covered how that affected Muse users earlier this month.

Since then the list has grown. Users of Muse, xAI's Grok, OpenAI's Dots and Instinct have reported blocks on major websites over the past few weeks, and Delta, JPMorgan Chase, Charles Schwab and Yelp have confirmed restrictions of their own. Between them, those companies cover most of the tasks AI companies have used to sell personal agents: travel, shopping, banking and finding somewhere to eat.

Users have also reported that Amtrak, Cars.com and Kohl's no longer work with their agents. None of the three has commented, so those reports haven't been confirmed.

Banks will let agents read data but not move money

JPMorgan CEO Jamie Dimon addressed agents on the bank's earnings call this week. "You don't want rogue agents," he said. A JPMorgan spokesperson told Fortune the bank does not allow third-party agents to access accounts using a customer's banking credentials. It still supports customer-authorized data sharing through open banking providers, so an agent can see some account data but can't log in or make transactions.

Schwab CEO Rick Wurster told Bloomberg that the firm is blocking unauthorized agents, including Muse, from moving client money. He said he gets a weekly report on blocked agents and that the number is in the tens and twenties each week. Citigroup told the Financial Times it also won't let third-party agents log in or transact.

The banks cite security, since an agent holding a customer's password creates a new way for money to go missing. Analysts have pointed to a financial motive as well. One of the first things a money agent is likely to do is move idle cash out of checking accounts, which pay close to nothing, into accounts that pay several percent.

Apollo chief economist Torsten Slok puts that gap at about 0.1% versus 3.3% to 5%. If agents did that across millions of accounts, it could cost banks billions in net interest revenue.

Delta and Yelp want a deal first

Airlines have been rejecting agent booking requests for weeks, even though flight booking is one of the tasks agent makers promote most. Delta has now said it has no partnership or integration that allows outside agents to shop for or book its flights, and that it is protecting customers from unauthorized automated activity.

Yelp lets agents in only if they're part of its paid data licensing program. The company already licenses its data to AI firms, including a deal with OpenAI announced in July that brings Yelp reviews, photos and business details into ChatGPT. Agents that read Yelp through a browser without a license don't pay for that data, and Yelp is now keeping them out.

Amazon and Grok Bot

This week a Grok Bot user posted a screenshot of the same Amazon warning Muse users have been getting and said his agent could no longer place orders. Elon Musk replied, "Maybe we should start a competitor to Amazon," and told users to have their bots shop elsewhere. Amazon hasn't confirmed it is blocking Grok Bot, and neither company responded to Moneywise's request for comment.

About a week earlier, Y Combinator co-founder Paul Graham had argued that Amazon's agent ban gives startups their first real opening to compete with Amazon since its founding. A rival would need far more than a better agent to match Amazon's warehouses and delivery network, but the comments show how much agent makers think is at stake.

Most of these companies have agents of their own

Several of the companies restricting outside agents offer their own. Schwab is steering clients to Charley, an AI assistant it announced on September 30. Amazon has its own Buy for Me agent, which identifies itself to merchants when it shops on other sites.

Yelp earns money licensing the data that outside agents would otherwise read for free, and banks hold the deposits that outside agents would be designed to move. The security risks these companies describe are real, and blocking outside agents also helps them keep control of their customers and their revenue.

Agents still work through partnerships

Agents that come in through formal agreements are faring better. The day after Amazon blocked Muse, Shopify announced it was working with Meta on agentic checkout through Shop Pay. Meta later announced retail partnerships with Walmart, Gap, Sephora, Wayfair and Best Buy.

In travel, Sabre says nearly 80 of its customers are testing or using its MCP server for agent bookings, which gives agents a direct connection instead of having them work through booking pages.

Agents that use partnerships, paid licenses, APIs or a declared identity are still getting through. The ones being blocked operate a browser with the customer's password, and users usually find out when a task fails partway through.

What enterprise leaders should do

Companies using agents should check which steps run through approved integrations and which depend on an agent clicking through someone else's website. The second kind can stop working without warning when a site changes its rules.

Agents shouldn't be given shared passwords to financial accounts. JPMorgan and Schwab have made clear who they think carries the risk if something goes wrong, and read-only data access is the safer option where banks offer it.

Teams should also expect to pay for data. If other platforms follow Yelp's approach, information agents read for free today may require a license.

Companies that run customer-facing websites face the same decision from the other side. They'll need a policy on which agents can get in and on what terms, along with a way for approved agents to connect that doesn't run through the login page.

For now, what a personal agent can do depends less on the model behind it than on which companies have agreed to let it in.