Amazon and Walmart went opposite ways with the same visitor: the AI agent that works the web on people’s behalf. In September, Amazon blocked Meta’s agent, Muse, from its store. On October 21, Walmart opened a dedicated entrance where agents like it can come in and shop. The same day, Anthropic unveiled Claude Duet, an agent that keeps working on its own computer in the cloud after you walk away. As more of these visitors arrive, everyone who runs a service has to decide: let them in, or keep them out? This post looks at the four agents launched in the past two months, how services have received them, and the court ruling that came down in between.
Four agents in two months
xAI released Grok Bot in beta on August 11. Meta followed with Muse on September 8, OpenAI with ChatGPT Dots on September 29, and Anthropic with Claude Duet on October 21. A chatbot answers and stops; these take a goal and keep at it. They carry on after you close your laptop, and once you connect your email, calendar and payment methods, they make bookings, buy things and send messages for you. Meta’s launch post says Muse “can open a browser, fill out forms, and negotiate on their behalf.”
All four reach a service in much the same way. They first use whatever connection the app offers: a connector, an API, or MCP (Model Context Protocol), an open standard that lets an agent call an app’s functions. Where there’s no such connection, they go in through their own browser in the cloud. Anthropic’s help page says, “For sites that don’t have a connector, Claude Duet uses its own browser in the cloud.” xAI’s docs say Grok Bot uses “connectors where available and computer use for everything else.” So which way an agent comes in depends on whether the service has built an entrance for agents. If it hasn’t, the agent uses the pages built for people, clicking around like a person.
How they identify themselves on the way in varies. Only OpenAI documents it publicly: ChatGPT’s cloud browser signs each request with Web Bot Auth, a cryptographic signature that proves the agent comes from chatgpt.com. No document says yet that Dots uses that browser. Google says it is experimenting with the same signatures for its own agent. Anthropic says only that Duet “aims to follow the rules sites set for agents.” xAI says Grok Bot goes out through static IP addresses shared across customers, but it doesn’t publish the ranges; customers get them from their account team. Meta hasn’t published how Muse identifies itself, and Amazon says Muse “doesn’t identify itself when it browses.”
The blockers: say who you are
Amazon made the biggest move. From the evening of September 20, US time, people who sent Muse to Amazon saw a notice: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.” Amazon said “third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly,” and asked Meta to remove Amazon from the experience. It added that Meta hadn’t told it beforehand, that Muse doesn’t identify itself, and that it appears to store customers’ login credentials. Meta says the Muse model can’t see users’ passwords or payment methods, and that credentials are kept in secure storage without being exposed to the model.
Amazon’s Conditions of Use include a separate set of Agent Terms. An agent must identify itself in every request by putting “Agent/[agent name]” in its user-agent string. It must not mimic “the speed or pattern of human keystrokes,” and must not solve or get around CAPTCHAs meant to tell people from computers. Amazon also reserves the right to limit agents “by technical measures.” Its robots.txt, the file where a site tells robots which parts to stay out of, blocks user-driven agents by name, including ChatGPT-User, Claude-User and Perplexity-User. Amazon runs its own agent that buys from other stores, Buy for Me, and points out that it identifies itself to those retailers and lets them opt out.
Amazon isn’t alone. eBay’s user agreement bans “buy-for-me agents, LLM-driven bots, or any end-to-end flow that attempts to place orders without human review” unless eBay gives prior express permission. When TechCrunch asked around in early October, Yelp said it admits only agents that pay through its data licensing program. Delta said it “does not currently have a partnership or integration.” United pointed to terms that bar “any robot, spider, other automatic device.” Banks are firmer still. JPMorgan says it will block outside agents that log in with customers’ banking credentials, while keeping open-banking data sharing in place. Per the FT, Citi doesn’t let outside agents sign in, and Bank of America has limited them while it works out who would be liable for payments they authorize. Charles Schwab is blocking unauthorized agents while it prepares a separate connection that shares information but can’t move money.
You don’t want rogue agents, and there could be thousands of them.
Jamie Dimon, JPMorgan CEO, Q3 earnings call (via Banking Exchange)
Korea is heading the same way. Muse hasn’t launched there, but Naver told Newsis on September 30 that it does not allow outside AI agents to search its products or access its data, and has no plans to change that. Korea Economic TV reported on October 1 that Coupang blocks outside AI from paying inside its app, and that Kakao won’t let outside AI hook into its KakaoTalk Gifts service without permission. The report carries no direct statement from either company. Newsis noted that while Naver keeps outside agents out, it is expanding its own shopping-agent features.
Between August 11 and October 21, a little over two months, four agents arrived.
All four work for their users from their own computers in the cloud.
Meanwhile, Amazon, Naver and US banks shut agents out.
In court, Amazon’s fight with Perplexity went on, and the appeals court lifted the injunction Amazon had won.
In the same two months, Shopify and Walmart built separate entrances for agents.
The blockers and the openers moved at the same time.
The court said the user is the one who gets in
One weapon the blockers relied on has been blunted. In November 2025, Amazon sued Perplexity, alleging that its agentic browser, Comet, poses as a person to get into Amazon accounts, in violation of the federal Computer Fraud and Abuse Act (CFAA) and a California law. The district court granted a preliminary injunction against Comet in March 2026. On August 4, the Ninth Circuit vacated it. The law punishes the person who accesses a computer, the court reasoned; the one getting into the Amazon account is the user, and Comet is just a tool in the user’s hands. In the opinion’s words, “It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant.” Amazon’s petition for rehearing was denied on September 10.
However advanced the Assistant currently is, it is a tool, not a person for statutory purposes.
US Court of Appeals for the Ninth Circuit, Amazon v. Perplexity (August 4, 2026)
The opinion also drew limits. “We do not establish a new legal regime governing agentic AI,” it says, and it applies only to the technology as presented in the case’s filings. A footnote adds: “This outcome does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users.” In other words, computer-fraud law is a hard way to keep agents out, but terms of service and technical blocking remain the service’s call. On September 21, Amazon amended its complaint to add tortious interference with contract. It alleges that the Comet iOS app copied users’ Amazon cookies to Perplexity’s cloud, where a virtual browser connected to Amazon directly; as the complaint puts it, “No user device touches Amazon’s servers.” Perplexity temporarily switched that feature off for Amazon. All four agents above also work from their own computers in the cloud, so however this fight ends, the outcome matters to them too.
The openers: an entrance just for agents
Walmart went the other way. Agent Gateway, announced October 21, is an MCP server that lets approved agents connect to Walmart, search its inventory and buy for the shopper. The first time you shop with a given agent, it gets its own profile in your account, which you authorize and link. You can approve each purchase, or let the agent buy within a spending limit you set. Walmart compares it to adding an authorized user to a credit card. Agents can’t see payment details and get only the information a task needs. If an agent buys the wrong thing, Walmart’s usual returns apply, and agents that don’t follow its terms get blocked. Walmart had already announced a partnership with Muse and offers integrations with ChatGPT and Gemini. Agent Profiles roll out in November.
Shopify has opened up too. Since September 28, agents working in a shopper’s browser can use a standard called WebMCP to read and update checkout on Shopify stores and place the order. Instead of reading screenshots, they call checkout tools the store provides (get_checkout, update_checkout and complete_checkout), and an order goes through only after the buyer approves it. Payments are moving the same way. Stripe’s Link gives an agent a separate card number instead of the user’s real one, with a spending limit the user sets. The number of agents using it has grown from about 70 to around 200, Muse and Grok Bot among them, though Stripe hasn’t disclosed how many purchases or how much money that involves. In October 2025, Visa and Mastercard announced that they would use the Web Bot Auth signatures mentioned above to verify agents in payments.
Turning away a personal agent means turning away the customer behind it.
Meta, to TechCrunch (October 6, 2026)
Opening up isn’t free
So is opening up all upside? Walmart has tried it. It put about 200,000 products into Instant Checkout, which lets people buy without leaving ChatGPT, and shoppers who bought in the chat converted at about a third the rate of those who clicked through to Walmart’s own site. A Walmart executive called the experience “unsatisfying.” OpenAI has since begun phasing out Instant Checkout in favor of checkout that merchants control. My read is that Walmart inviting agents to its own counter this time, rather than selling inside a chat window, follows from that experience: let agents help with finding products, but keep checkout and the customer relationship on your side.
Security brings two more problems. The first is prompt injection, where an agent mistakes text on a page for an instruction. OpenAI’s security chief has called it “a frontier, unsolved security problem,” and Anthropic writes that “no browser agent is immune to prompt injection.” If your service publishes text that users write, that text can steer someone else’s agent. The second is bots dressed up as agents. When the bot-defense company DataDome tested 21,491 popular sites in June, “spoofed AI agents walked past more than seven sites in 10.” Let something through because of the name it gives, and every bad bot that borrows the name gets through with it.
Decide this before you decide to block or open
Here’s my view. Sorting traffic into agents and humans doesn’t get you an answer: as the court said, there’s a person behind the agent, and there are bots pretending to be agents. It works better to sort by what the agent is trying to do. Reading a public page, changing something inside an account, and doing something you can’t undo, like paying or deleting, carry very different risks. Reading can usually be open. Allow actions inside an account only when you know whose agent it is, and irreversible actions only when a person confirms them. Mastercard’s developer guide for merchants makes a similar point: “Think of it like a physical store: anyone can walk in and browse, but payment requires identification.” The figure below compares the same agent coming in through the pages built for people and through an entrance built for agents.
Ask agents to say who they are. Have them put their name in the user-agent (like Amazon’s “Agent/name”), and check Web Bot Auth signatures where you can. Cloudflare and AWS WAF already verify them. The standard is still an IETF working-group draft, so it may change.
Build an entrance for agents. Offer the jobs worth handing to an agent through an API or MCP. Without one, agents click through the pages built for people, and an agent doing that is hard to tell from a person.
Give each agent narrow permissions. Don’t make agents take over a user’s password or login cookie; issue a token or profile just for the agent. Set its scope, such as read-only or within a spending limit, and make it revocable at any time.
Ask a person before anything irreversible. Have a human confirm payments, transfers, deletions and messages sent on someone’s behalf. All four agents above already ask their users before doing these things, and the UK’s Competition and Markets Authority (CMA) recommends mandatory confirmation for high-risk actions.
Keep a separate record. Show what an agent did apart from what the person did. If there’s a dispute over a wrong purchase, that record is your evidence.
Don’t let your pages become commands. User posts, reviews and text hidden from view can read as instructions to an agent. The more of other people’s writing you publish as-is, the more this matters.
None of this is exotic. Google’s web.dev guide, “Build agent-friendly websites,” recommends real buttons and links, a label on every input, no transparent overlays over controls, and layouts that don’t shift. These are things you should already be doing for people who use screen readers. As the authors put it, “Everything we suggest to make a site ‘agent-ready’ also makes sites better for humans.”
How Tabple lets agents in
Tabple has an entrance for agents too. Tools such as Claude, Cursor and Codex can read and update your Tabple tasks and wiki over MCP. The connection uses a personal access token made only for that purpose, and it can’t touch billing or account settings. Issue it as read-only and the 10 tools that create, change or delete things are blocked. Calls are capped at 30 a minute, 300 an hour and 5,000 a day. You can revoke a token at any time, and once you do, no request with it gets through. The guide “Connect AI tools to Tabple” explains how to connect.
Amazon and Walmart moved in opposite directions, but they seem to want the same thing: to know whose agent is coming in, and to decide how far it can go. Amazon couldn’t tell, so it shut the door. Walmart built an entrance where it could. Turn an agent away and the customer behind it leaves too. Before deciding whether to block or open, I think it pays to build a way in where an agent says who it is and can do only what it’s allowed to.
Sources (as of October 22, 2026)
Anthropic, Introducing Claude Duet · Get started with Claude Duet
Meta, Introducing Muse · OpenAI, Connect computers and apps to your dot
xAI, Introducing Grok Bot · Grok Bot docs · Grok Bot security
OpenAI, ChatGPT cloud browser allowlisting · Google, user-triggered fetchers
The Register, Amazon shows Meta’s Muse AI shopping agent the door
Amazon, Conditions of Use (Agent Terms) · eBay, User Agreement
TechCrunch, The next hurdle for AI agents: getting websites to let them in
Banking Exchange, US Banks Restrict AI Agents From Accessing Customer Accounts
Newsis (Korean), on Naver and Muse · Korea Economic TV (Korean), on Coupang, Naver and Kakao
Ninth Circuit, Amazon.com Services v. Perplexity AI (No. 26-1444) · Amazon’s amended complaint
TechCrunch, While Amazon blocks AI agents, Walmart rolls out the welcome mat
TechCrunch, Shopify opens checkout to browser-based AI agents · The Decoder, Stripe says AI agent purchases are adding up
MarTech, Walmart says ChatGPT checkout converted 3x worse than its own website
Cloudflare, Your site, your rules: new AI traffic options · Cloudflare, Securing agentic commerce with Visa and Mastercard · AWS WAF, Web Bot Auth support
Simon Willison, OpenAI CISO on Atlas · Anthropic, Mitigating the risk of prompt injections in browser use
SiliconANGLE, DataDome report · UK CMA, Agentic AI and consumers · web.dev, Build agent-friendly websites
Mastercard, Developer Playbook on Preparing for Agentic Commerce