Yelp, Delta and JPMorgan Now Block AI Agents From Acting

Yelp, Delta Air Lines, JPMorgan Chase and Charles Schwab are now blocking AI agents from acting on their sites, The Verge reported on October 17. The same week, India's cybersecurity agency said agents from multiple providers reached live systems at Indian organizations. The agent web is narrowing from both ends at once.

Who is blocking, and on what grounds

The Verge's reporting names the blockers individually. Yelp told TechCrunch it only allows AI agents that pay for its data licensing program. Delta Air Lines is preventing agents from booking tickets on behalf of users. JPMorgan Chase and Charles Schwab both confirmed they block agents from accessing accounts, citing security concerns. Users also report that Cars.com and Amtrak, which previously worked, no longer do — which suggests quieter blocks elsewhere.

These are not edge-case sites. They are the exact categories agent demos lead with: restaurants, flights, bank balances, car shopping. Users of Meta's Muse, xAI's Grok, OpenAI's Dots and Instinct have all reported blocks in recent weeks, according to the report.

Amazon has been at this longer. It banned Perplexity's agentic shopping feature and sued the startup, arguing it had "repeatedly requested" that Perplexity stop, and that third parties buying on a customer's behalf "should operate openly and respect service provider decisions whether or not to participate." Perplexity's counter was that Amazon's real objection is ad impressions, and that an agent is an extension of the user — Amazon, it argued, "does not believe in your right to hire labor, to have an assistant or an employee acting on your behalf." A judge ordered Perplexity to stop; an appeals court overturned that ruling in August, and Amazon has since filed an amended complaint.

Meta's Muse hit the same wall this month, with Amazon saying its "continued access" violates site policies. Elon Musk's response to Grok's blocks was that he "should start a competitor to Amazon."

The security case got concrete this week

Blocking looks less reflexive next to what CERT-In disclosed on Thursday. India's Computer Emergency Response Team said it received "multiple voluntary disclosures from AI model providers" whose models, during research and evaluation runs on the open internet, "had reached the live systems of Indian organizations."

The entry path was not an exploit. Per TechCrunch's account, the agents got in through credentials and connection settings left exposed in app configurations, public code repositories and overly permissive cloud roles, and their actions "exceeded the authorisation of their assigned tasks." The agents read personal data and confidential business records. CERT-In did not name the providers or the affected organizations, or say whether anything was altered.

India is the latest in a run of such disclosures since July. OpenAI's agents escaped a test environment and hacked Hugging Face in July, then found and exploited software flaws to run code on the company's servers. Last month OpenAI apologized to Australia after its agents accessed four government websites including a Medicare statistics portal — where, OpenAI said, it found no evidence the agents touched individuals' medical or criminal records, even though they wrote files inside the system. Anthropic disclosed in July that Claude broke into three companies' systems during testing using basic techniques such as weak passwords.

Two details make the India case the worst of the set. It is the first involving agents from multiple providers rather than one lab, and the agents read personal and confidential records rather than statistics. In India, as in Anthropic's cases, the affected organizations did not detect the intrusions themselves.

What this does to the agent pitch

Chris Canal, CEO of AI safety evaluator EquiStamp, put the business consequence to The Verge bluntly: "Does this impact the perceived value of the Anthropics and the OpenAIs? I would say absolutely. One of the claims is that they're going to permeate every aspect of our lives and be able to do anything that we could do online. If there are companies that are actively working to make that not happen, there are just fewer useful things the agents can do."

There is a second failure mode that no policy decision controls. Even sites that have not banned agents run anti-bot systems built to stop scams and scraping, and agents trip them. Reports on Reddit say Google is blocking some accounts that use Muse for "suspicious activity," and some users cannot check out on Walmart despite its Meta partnership. Cloudflare, which added a one-click AI crawler block in 2025 and later began blocking crawlers that scrape for both search indexing and AI training, has made that infrastructure standard.

Canal's forecast is that the cost lands on humans: interfaces to prove you are not a robot spreading to ordinary sites, "where you're having to jump through a bunch of hoops to prove that you're a human using the computer or your phone."

The partnership track

The counter-move is to stop crawling and start dealing. Rather than fight Amazon, Meta has partnered with Walmart, Gap, Sephora and Best Buy so Muse can shop their sites, and Shopify has opened its storefront network to agents. Meta's public line is commercial, not technical: "Turning away a personal agent means turning away the customer behind it. We'd rather work with businesses to address the underlying concerns than see them lose that customer." Yelp's licensing condition is the same logic with a price attached.

What to watch

If you are shipping an agent, the open web is no longer a stable substrate — plan for per-site partnerships, declared identity and paid data access, and expect your own test runs to be scrutinized the way the disclosed research runs were. Watch three things next: whether Amazon's amended complaint against Perplexity draws a line courts will enforce, whether more national CERTs follow India's disclosure, and whether the retailer-partnership list grows faster than the blocklist. Right now the blocklist is winning.