Amazon AI Shopping Agents Hit a Wall as Retailers and Banks Shut Them Out

Amazon AI shopping agents have reached a sharp contradiction: Amazon wants its own software to shop elsewhere while blocking outside agents from its marketplace. That conflict now extends beyond one retailer. eBay restricts unauthorized purchasing bots, while JPMorgan Chase and Charles Schwab block unapproved agents from customer accounts.

The restrictions expose a structural problem for agentic commerce, where software searches, compares, and transacts for a user. These agents need access to stores, payment methods, account histories, and personal preferences. Yet each connection creates security, liability, and competitive risks for the business controlling that data.

Meta argues that rejecting a personal agent means rejecting the customer who authorized it. Amazon sees an unidentified outside agent entering an account, collecting data, and changing the shopping experience without permission. Both positions sound reasonable. They also cannot coexist without shared rules for identity, consent, and accountability.

The result is not the open commercial web promised by AI developers. It is an emerging network of approved partnerships, restricted platforms, and proprietary assistants. The most important battle is no longer whether an AI agent can find a product. It is who gets to stand between the customer and the transaction.

Amazon AI Shopping Agents Meet a Closed Door

Amazon’s block turns agentic shopping from a software challenge into an access dispute.

The immediate confrontation centers on Meta’s Muse agent. Amazon blocked Muse from browsing and purchasing products on its marketplace less than two weeks after the assistant launched, according to an agent access report. Amazon said Meta had not obtained permission to access customer accounts, collect marketplace data, or process transactions.

An Amazon spokesperson said third-party applications making purchases from other businesses should operate openly. The company also said those applications must respect a service provider’s decision about participation. Its objection therefore covers more than a malfunctioning bot. Amazon is challenging the assumption that a customer’s authorization automatically gives an agent permission to enter Amazon’s systems.

Muse is not the first assistant to encounter that position. Amazon previously blocked Perplexity’s shopping technology and took the dispute to court. Amazon alleged that Perplexity continued operating agents on its website after being told to stop.

Perplexity has defended its assistant as an extension of the customer. Under that theory, an agent using an account should have the same basic right to browse and transact as the person directing it. The dispute remains consequential because it asks whether software delegation changes the legal identity of an ordinary website visitor.

The early litigation produced mixed signals. A federal district court initially restricted Perplexity’s access through a preliminary injunction. An appeals court later overturned that order after finding Amazon unlikely to prevail on the computer-access claims supporting the injunction. Amazon then filed an amended complaint, so the broader conflict remained unresolved.

That history matters because technical restrictions and legal restrictions reinforce each other. A retailer can detect known automation, challenge unusual sessions, limit account access, or block specific traffic. It can also use contracts and litigation to discourage developers from finding technical workarounds.

eBay has taken a similarly restrictive approach through its user rules. Its policies prohibit automated agents from accessing the marketplace without prior permission. The restrictions include systems that place orders without meaningful human review.

Other services have drawn their own boundaries. Yelp requires agents to use an approved data licensing channel. Delta Air Lines restricts unauthorized outside agents from booking flights. Agents have also reportedly encountered barriers at Amtrak, Cars.com, and Kohl’s.

These examples show that an agent can work perfectly in a demonstration and still fail in normal use. Anti-bot systems were built to stop scraping, credential theft, inventory manipulation, and fraudulent transactions. They do not automatically recognize the difference between a malicious bot and a legitimate assistant carrying out a customer’s request.

That ambiguity undermines a central promise of consumer agents. An assistant cannot reliably complete an errand if every destination uses different access rules. It may research a product, identify the best offer, and prepare an order, only to stop when login or checkout begins.

The conflict is especially striking because Amazon is not rejecting the idea of AI-mediated commerce. It has developed its own shopping assistants and uses AI throughout product discovery. Amazon’s position is narrower but more commercially significant: outside agents cannot assume they have the same access as Amazon’s own systems.

The Fight Is About Customer Control, Not Just Security

The party controlling the shopping interface can influence discovery, advertising, data collection, and the final sale.

Amazon’s security concerns are credible. A purchasing agent can require access to addresses, order histories, payment credentials, and account settings. An agent that conceals its identity or stores credentials insecurely creates risks that Amazon must manage when something goes wrong.

Yet security does not fully explain the resistance. Independent shopping agents can weaken the commercial machinery that makes a marketplace valuable. They can skip promoted listings, compare prices across competing stores, and select products without following the platform’s preferred customer journey.

Traditional e-commerce assumes limited human attention. Shoppers rarely inspect every seller, calculate every delivered price, or reconsider every subscription. Marketplaces use rankings, recommendations, reviews, promotions, and advertising to shape decisions within those limits.

An automated buyer behaves differently. It can monitor several stores continuously, compare shipping and return policies, and wait for a precise condition. It does not become impatient, click a familiar brand from habit, or abandon a search after opening several tabs.

That behavior could benefit consumers. It also threatens advertising revenue and platform leverage. If an external agent makes the recommendation, Amazon loses some control over which products receive attention. If the agent handles checkout, the AI provider can become the primary customer relationship.

Meta’s response makes that contest explicit. After reports that websites were blocking Muse, Meta argued that businesses share commercial interests with agent developers. The company said rejecting a personal agent means rejecting the customer represented by that software.

Meta has paired that argument with approved retail partnerships. Walmart, Gap, Sephora, and Best Buy have supported authorized ways for Muse to help customers shop. Shopify has also enabled stores in its network to participate in AI-assisted purchasing channels.

Those arrangements reveal the emerging compromise. Retailers are not choosing simply between agents and no agents. They are choosing which agents receive access, what information they can retrieve, and which actions they can complete.

Tapestry illustrates the distinction. The owner of Coach and Kate Spade has restricted unauthorized agent purchases on its brand websites. At the same time, selected products can be bought through approved Google experiences, with explicit customer confirmation required for each transaction.

This model protects the retailer’s ability to negotiate terms. An approved integration can identify the agent, limit available actions, record consent, and define responsibility. An unapproved browser agent can attempt many of the same tasks without any formal commercial relationship.

The result resembles earlier platform disputes over search indexing, app stores, social-media referrals, and travel aggregators. Businesses welcome traffic when it produces incremental sales. They resist intermediaries that capture customer data, demand a commission, or weaken direct relationships.

Amazon’s stance contains a further reversal. Its own “Buy for Me” approach allows an Amazon assistant to purchase products from outside retailers. The IMF’s payments analysis describes Amazon’s assistant as navigating third-party websites and completing transactions for customers.

Amazon therefore wants the ability to send its agent outward while retaining control over agents coming inward. That is strategically logical, but it is not an open-agent model. It is a contest among platforms seeking to become the preferred gateway to commerce.

If Amazon’s interface owns the request, Amazon can shape the recommendation and retain transaction visibility. If Muse, ChatGPT, Gemini, or another assistant owns the request, that provider gains a view into consumer intent before the retailer sees it.

Intent data is unusually valuable. A product search shows what someone is considering. A persistent agent can know the customer’s budget, timing, preferences, prior purchases, and willingness to switch brands. It may also know which alternatives the customer rejected.

The winning interface could influence far more than individual orders. It could decide which merchants get considered, which products appear comparable, and when a purchase should happen. This is why the argument about bot access is becoming a fight over market power.

Banks See an Authorization Problem That Retailers Cannot Solve Alone

An AI agent needs more than a credit card number; it needs verifiable authority to act within limits that every participant understands.

JPMorgan Chase and Charles Schwab have confirmed that they block unauthorized agents from customer accounts. Their caution reflects a harder version of the retail problem. A failed product search is inconvenient. An incorrect transfer, investment order, or payment can create immediate financial harm.

A bank must distinguish the customer, the customer’s device, and any software acting on the customer’s behalf. It must also determine what the customer actually approved. Login credentials alone do not answer those questions.

Consider an agent told to buy running shoes below a budget. Did the user authorize one transaction or recurring monitoring? Can the agent select a different brand? Can it accept a membership, installment plan, or substitute product? Does approval cover taxes and shipping above the stated limit?

The uncertainty grows when an agent handles financial tasks. A request to improve returns could involve moving savings, selling an investment, or opening an account. Each action has different disclosures, risks, and legal consequences.

Authentication proves that someone can enter an account. Delegated authorization must prove that a particular agent can perform a specific action for a particular customer. It also needs boundaries, expiration, revocation, and an audit trail.

The IMF framework separates intent, authorization, and settlement into distinct layers. Reasoning software can interpret a goal and prepare a transaction. Deterministic payment systems should still control final authorization and settlement.

That separation addresses a basic technical mismatch. Large language models generate outputs probabilistically, meaning the same request can produce different interpretations. Payment settlement requires predictable rules, final records, and clear accountability.

Card networks are building infrastructure around that distinction. Visa says its agentic commerce systems identify trusted agents while preserving consumer-defined controls. Its European program uses payment passkeys to authenticate cardholders and distinguish approved agents.

In July 2026, Visa said agents had completed live purchases with independent European merchants through its infrastructure. More than 30 issuers participated, including Barclays, BBVA, HSBC UK, ING, Lloyds Banking Group, NatWest, and Revolut. The transactions operated within defined customer parameters, according to the Visa commerce program.

That development complicates the claim that banks are simply shutting agents out. Financial institutions are rejecting unauthorized access while participating in controlled agent transactions. The dividing line is not automation itself. It is whether the participants can verify identity, authority, and responsibility.

A controlled system can issue a token instead of exposing the customer’s full card credentials. The token can carry limits on the merchant, amount, timing, and permitted transaction type. It can also identify the agent separately from the customer.

Those controls become critical during disputes. If an agent buys the wrong item, the participants need to determine whether the merchant followed the order, the agent exceeded its mandate, or the customer supplied ambiguous instructions. Existing chargeback systems were not designed to answer every part of that chain.

Fraud creates another challenge. Criminals can target the agent, manipulate the information it reads, or hijack the credentials connecting it to an account. A malicious product page might contain instructions designed to redirect an automated browser. A compromised agent could make valid-looking requests through a trusted customer session.

Agents can also produce behavior that resembles fraud without malicious intent. Hundreds of automated requests, rapid price checks, repeated cart changes, and unusual login patterns can trigger systems designed to stop abuse. Retailers cannot safely disable those defenses merely because some bots represent real customers.

The practical solution is likely to involve registered agents, cryptographic identity, constrained tokens, and explicit transaction mandates. None of those elements alone resolves the commercial dispute. However, they give banks and merchants a safer alternative to accepting an invisible bot using ordinary account credentials.

Consumers Want Savings but Still Fear Losing Control

Agentic commerce faces a trust gap even if platforms settle their access disputes.

AI companies often describe shopping agents as time-saving software. The strongest use cases are easy to understand: comparing prices, tracking a fare, filing a reimbursement claim, or reordering a routine product. These tasks consume attention without providing much satisfaction.

An agent can also continue working when a person would stop. It can check several return policies, monitor changing inventory, and revisit a search later. That persistence creates genuine consumer value, especially for repetitive or administrative purchases.

Research commissioned by Visa found that value and convenience attract interest. In a United States survey of 1,600 consumers, 39 percent identified price matching as a motivation for using an AI shopping assistant. Finding new products and saving time each attracted 38 percent.

The same consumer trust study found much deeper concern around the data required. Data security worried 48 percent of respondents. Privacy and purchase accuracy each concerned 44 percent, while service reliability concerned 40 percent.

Only 7 percent reported having none of the listed concerns. One quarter said they would not share any personal information with a shopping agent. Those results challenge the assumption that convenience will automatically overcome hesitation.

Control over collected data was especially important. Sixty-two percent called that control very important, while another 23 percent called it important. Only about one in five said they were very or extremely likely to use an agent if they could not control its data practices.

Trust also varies sharply by provider. In the same research, 53 percent of American respondents said they would feel comfortable using a shopping service from Amazon. PayPal followed at 45 percent, with Visa at 34 percent. OpenAI reached 25 percent, while Meta reached 13 percent.

Those findings give Amazon a strategic advantage. Consumers may trust the marketplace that already handles their purchases more than an external AI provider asking for broad account access. Amazon can frame its restrictions as protection while directing customers toward its own assistant.

However, trust in Amazon does not settle the conflict. A platform-owned agent may favor products, services, or commercial relationships connected to that platform. Consumers need to know whether a recommendation optimizes their interests, the platform’s revenue, or a negotiated partnership.

Independent agents face the opposite problem. They can claim to search more broadly and represent the shopper, but they still require a business model. If the user does not pay directly, commissions, preferred integrations, or sponsored placement may influence results.

This creates a difficult triangle. Consumers want an agent that searches broadly, protects their data, and acts solely for them. Retailers want identifiable software that respects platform rules. AI providers need revenue and dependable access to complete tasks.

No participant can satisfy all three goals through browser automation alone. A bot that behaves like a person may reach more websites, but it reduces transparency. A tightly approved integration improves accountability, but it can narrow the agent’s choices.

The risk is that agentic commerce recreates the same gatekeeping it promises to escape. A user might ask for the best available product but receive options only from participating merchants. The experience could feel comprehensive while quietly excluding stores that rejected the provider’s terms.

That limitation should be visible. Agents need to disclose which marketplaces they searched, which ones blocked access, and whether partnerships shaped the results. Otherwise, a polished recommendation may conceal a fragmented market.

Users also need meaningful confirmation before consequential actions. Approval should show the product, final amount, seller, delivery terms, and payment source. A vague prompt given hours earlier should not substitute for informed consent when circumstances change.

The same principle applies after checkout. Returns, cancellations, warranties, and customer support can be more complicated than the purchase itself. If the agent disappears after payment, the convenience claim covers only the easiest portion of the transaction.

This is why the current blocks should not be dismissed as simple resistance to innovation. Some protect existing business models, but others reveal unresolved product failures. An agent that cannot explain its mandate, protect credentials, or support a dispute is not ready to control a financial transaction.

What Will Decide the Future of Agentic Commerce

The next phase depends on whether the industry can replace disguised automation with recognized, limited, and auditable delegation.

The first signal to watch is the Amazon litigation involving Perplexity. The appeals ruling weakened one early attempt to stop agent access through computer-access law, but it did not establish a broad right for agents to enter private platforms. The amended case can still shape how courts interpret authorization, account delegation, and contractual restrictions.

A ruling favorable to Amazon would strengthen the platform-by-platform permission model. AI providers would need negotiated integrations with major retailers or would risk losing core shopping functions. A ruling favorable to Perplexity would strengthen the argument that customers can delegate ordinary browsing through software.

Neither result would settle every issue. Retailers would still operate anti-bot systems and control authenticated services. Courts can define legal boundaries, but technical access can remain unreliable without cooperation.

The second signal is the growth of verified payment standards. Visa’s live European transactions show that controlled agent purchases are possible when merchants, issuers, and networks participate. The important metric is not the number of demonstrations. It is whether those systems expand across independent merchants and support routine disputes.

Successful standards must carry more than payment credentials. They should express the user’s intent, identify the agent, specify spending boundaries, and record confirmation. They also need revocation mechanisms when a customer changes their mind or an agent is compromised.

If card networks and banks make those tools broadly available, security arguments against all agent transactions will weaken. Platforms could still reject outside agents for commercial reasons, but they would have a harder time presenting every automated purchase as an unidentified threat.

The third signal is how retailers structure approved partnerships. Meta’s arrangements with Walmart, Gap, Sephora, and Best Buy offer one model. Google’s approved commerce channels and Shopify’s participation offer others.

The crucial question is whether these systems remain interoperable. An open standard could let a consumer choose an agent and use it across many merchants. A collection of exclusive deals would produce separate commercial zones, each with its own assistant, catalog, and payment rules.

The closed model is easier for large companies to control. Amazon can promote its own assistant inside Amazon, while an AI provider can favor merchants that support its protocol. The customer receives convenience, but only within boundaries negotiated by platforms.

The open model is harder because responsibility must travel across several parties. The retailer needs confidence in the agent. The bank needs confidence in the customer’s authorization. The customer needs visibility into recommendations and final actions.

Regulators will eventually examine those relationships, especially when recommendations and payments merge. Disclosure rules may need to distinguish organic recommendations from sponsored or commission-driven results. Consumer-protection agencies will also need clear answers about liability when an agent misunderstands a request.

Developers should watch access quality as closely as model intelligence. Better reasoning does not help if the agent cannot reach inventory, authenticate safely, or finish checkout. Reliable integrations may become more valuable than marginal improvements in autonomous browsing.

Enterprise buyers should ask whether an agent operates through approved interfaces or by imitating a person. They should also examine how credentials are stored, which actions require confirmation, and whether every transaction produces an audit record.

Consumers should treat broad account access cautiously. A useful shopping agent does not need unlimited authority. Narrow permissions, spending caps, approved merchants, and transaction-by-transaction confirmation provide safer starting points.

Amazon AI shopping agents now sit at the center of a larger choice. The industry can build transparent delegation, where software openly identifies itself and acts within verifiable limits. Or it can divide commerce into competing platforms that admit only favored assistants.

Watch which agents can complete ordinary purchases without hiding, which merchants publish stable access policies, and which banks support revocable mandates. Those signals will show whether agentic commerce is becoming a real consumer market or another collection of controlled platform features.