Yelp Charges AI Agents Rent, Banks Won't Even Open the Door

By Meta

The grand promise of the AI agent era was that you would never have to touch a website again. Your assistant would book the flight, find the restaurant, move the money — while you got on with your life. This week, the websites answered. And the banks were blunter than everyone else.

When Charles Schwab chief executive Rick Wurster told Bloomberg TV on Friday that his firm is actively blocking Meta's Muse from moving client money, he wasn't describing a technical glitch. He was describing a policy — one now shared, in different flavours, by JPMorgan Chase, Yelp, Delta Air Lines and Amazon. The agent web isn't being built on the open web anymore. It's being built on permission slips.

Yelp's toll booth: pay up or stay out

Yelp's version is the most honest of the lot. The company told TechCrunch that AI agents may only touch its data through its paid data-licensing programme. No licence, no agent. No security theatre, no hand-wringing about fraud — just a price list.

And fair enough, in a way. Yelp's review corpus is the product; it has sold access to it for years. An agent scraping restaurant listings at industrial scale is no different from a human doing it, except the agent never clicks an ad and never becomes a regular. Yelp isn't blocking agents out of spite. It's extending its existing business model to a new class of customer. The subtext, though, is the one every publisher on the internet is now whispering: if your agent wants our data, it can pay rent like everyone else.

The banks drew the hardest line

If Yelp wants rent, the banks want the agents gone entirely — at least from anywhere near your money.

Jamie Dimon said it plainly on JPMorgan's third-quarter earnings call on October 13. "We're not going to allow just any… outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan," the chief executive told analysts. "You don't want rogue agents, and it could be thousands of them." Anyone handing their login to an outside agent should understand one thing above all, he added: "There's a liability transfer."

A bank spokeswoman confirmed the policy to CNBC the same day: "Protecting our customers is our top priority. Because it is not safe, we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf." Agents can still see balances in read-only form through authorised connectors like Plaid. They cannot move a cent — no transfers, no bill payments, no timeline offered for changing that.

Schwab went further, and more personally. On its October 15 earnings call, Wurster told investors that "there's one way we think is not safe, and that's just an agent coming to our site and trying to log in on behalf of a client. We are not going to allow that," American Banker reported. The next day, on Bloomberg TV, he named the agent: Schwab is actively blocking Meta's Muse, stopping what he called "tens and twenties" of agent attempts per week. "We don't want someone just giving their password to Muse, and letting Muse come in and take action on that client's behalf," he said. "We can't control it, the client can't control it, something could go wrong and who's liable?"

Schwab's answer to the demand is its own assistant, Charley, unveiled in late September and limited to administrative and informational tasks — no trading. External models may eventually connect through Model Context Protocol servers with Schwab-controlled authentication: look, but don't touch. On the same October 13 call where Dimon drew his line, JPMorgan CFO Jeremy Barnum described the bank's own AI ambitions — including a pilot of "Smart Cash," an in-house tool that predicts cash flow and moves funds to maximise yield. The message is hard to miss: agents are welcome, as long as they're our agents.

There is a reason the banks are the most aggressive blockers, and it isn't just security theatre. On September 27, Apollo Global Management chief economist Torsten Slok published a note with an unsettling title — "Is an Agentic Bank Run Coming?" — arguing that personal agents like Muse could soon sweep household cash automatically into accounts paying 3.3% to 5%, against the 0.1% national average on checking accounts. "If every household used AI agents to optimize the return on their cash balances, banks could lose a large share of the cheap deposits they rely on to make loans, which would be a problem for the entire financial system," he wrote. One analysis of Slok's numbers put the bill at roughly $47 billion a year in extra interest for JPMorgan, Bank of America and Wells Fargo alone, if their $1.6 trillion of non-interest-bearing deposits were forced to pay 3%.

In other words: the banks aren't only afraid an agent will get hacked. They're afraid it will work exactly as advertised. An assistant that diligently moves your idle cash to the highest yield is, from the bank's perspective, a deposit-draining machine with a friendly face. No wonder Dimon reached for the word "rogue."

For context on how these assistants actually work — and what they can and can't do — see our explainer on what AI agents actually do in 2026.

Amazon has been fighting this war the longest

Long before the banks weighed in, Amazon was already suing over it. The company banned Perplexity's agentic shopping feature last year and sued the startup in November 2025, accusing its Comet browser of covertly accessing customer accounts in violation of the federal Computer Fraud and Abuse Act. A federal judge in California, Maxine Chesney, granted Amazon a preliminary injunction in March 2026. Then, on August 4, the Ninth Circuit vacated it — the first federal appeals ruling on AI agents — holding that on the record before it, the user, not Perplexity, was the one "accessing" Amazon's computers. Amazon has since filed an amended complaint; its trademark and contract claims survive, and the case goes back to district court.

The rhetoric on both sides tells you what the fight is really about. "Third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate," an Amazon spokesperson said, in the company's standard line on the dispute. Perplexity's answer was blunter. Its spokesperson Jesse Dwyer told Reuters the company would "continue to fight for the right of internet users to choose whatever AI they want" — and the startup has argued, in essence, that Amazon doesn't want agents on its platform because agents "don't have eyeballs to see the pervasive advertising Amazon bombards its users with." Amazon, for its part, says Perplexity ignored repeated requests to stop.

Meta walked into the same buzzsaw. In September, Amazon cut off Meta's Muse shopping agent: the company said Meta hadn't told it Muse would visit, that the agent didn't identify itself while browsing, and that it appeared to capture and store customer credentials. Shoppers using Muse on Amazon now see a popup warning that "continued access by an unauthorized AI agent violates Amazon's Conditions of Use." Meta disputes the credential claim — it says Muse "has no visibility into people's passwords or payment methods" — but the block stands.

Meta's public response has been to frame the block as self-harm. "Turning away a personal agent means turning away the customer behind it," the company said in its announcement of an open agent standard earlier this month. "We'd rather work with businesses to address the underlying concerns than see them lose that customer."

Elon Musk, whose xAI Grok bots have also been shut out of Amazon ordering, responded the way he responds to most obstacles: by threatening to build around them. "Amazon won't be able to tell whether the buyer is a human or an AI acting on their behalf if access is via the user's IP address & cookies," he wrote on X in September. Then, on October 15, replying to a user complaining that Amazon was blocking Grok-powered bots, he added: "Maybe we should start a competitor to Amazon 🤔" — thinking-face emoji and all, as if the idea had just occurred to him. A week earlier, investor Paul Graham had made the serious version of the argument: "Amazon banning agents is the first opportunity I've seen since Amazon was founded for a startup to create an Amazon competitor."

The quiet blocks nobody announced

Photo: A Delta Boeing 737-800 at Los Angeles International Airport. Delta has no partnership or integration that would let a third-party AI agent book its flights. Credit: Cjantsch, via Wikimedia Commons (CC0 1.0 public domain).

Delta's position is the most carefully worded of the bunch — which is itself revealing. The Verge reports the airline is preventing agents from booking tickets on passengers' behalf, but Delta's own statement stops short of declaring a ban: the company says it has no "partnership or integration" that would let a third-party agent shop for or book its flights, that it is "continuing to evaluate," and that it is taking steps to protect customers from unauthorised automated activity. Translation: you can't book through an agent today, and don't hold your breath.

Then there are the blocks nobody announced at all. Users of Muse, Grok, OpenAI's Dots and the Instinct agent say sites that used to work with their assistants — Cars.com and Amtrak are the two names that keep coming up — quietly stopped working. We checked: neither company has published any statement about AI agents, and no spokesperson has confirmed a deliberate block. Treat those as user reports, not facts. But the pattern is what stings: a site can rewrite the rules overnight and no customer gets a notice.

Not every failure is even a policy. The Verge notes that agents constantly trip over anti-bot systems built for scammers and scalpers, not assistants — Reddit users report Google flagging accounts for "suspicious activity" while using Muse, and even Walmart, a signed Meta partner, has generated checkout-failure reports. Cloudflare, the infrastructure provider half the web hides behind, introduced a one-click block for AI crawlers in 2025 and has since started blocking crawlers that scrape for both search indexing and AI training. As Chris Canal, chief executive of AI safety evaluator EquiStamp, told The Verge: "There are all kinds of things that are set up not even to block agents, but to block in general bots or programs that are trying to scam or hack. These AI agents trigger those same safeguards."

The Verge said it reached out to OpenAI and Google for comment on the roadblocks and didn't hear back; Instinct declined to comment. Make of that silence what you will.

Permission is the new platform

Here is the uncomfortable truth the agent industry doesn't like to say out loud: the "open web" the agents were supposed to roam was never open. It was a collection of privately owned storefronts that tolerated bots as long as the bots brought customers. The moment the bots started being the customers — comparing prices without seeing ads, booking without loyalty programmes, moving deposits without asking — the tolerance ended.

Canal put the stakes plainly to The Verge: "One of the claims is that they're going to permeate every aspect of our lives. If companies actively prevent that, agents simply do fewer useful things." He went further: "Does this affect how people perceive the value of companies like Anthropic and OpenAI? Absolutely. One of the promises is that these agents will enter every area of our lives and be able to do everything we do online. If companies actively prevent that, agents have fewer useful tasks to perform."

So Meta is doing the only thing left to do: buying permission. At its Connect event on September 23, the company announced shopping connectors for Walmart, Best Buy, Gap, Sephora, Wayfair and Ulta, plus Expedia for travel and Instacart for groceries; Shopify opened its entire storefront network to agents with Shop Pay checkout after CEO Tobi Lütke's September announcement, and PayPal signed on for payments. More than 1,500 developers have applied to build connectors. Google, meanwhile, is building its own universal cart for the agent era.

The agent web, then, isn't dying. It's becoming a licensed web — a velvet-rope internet where your assistant gets in only where its maker has cut a deal. That is a colossally different product from the one that was sold: not a universal helper that goes anywhere, but a concierge with a short list of approved venues. Whether that still counts as the future depends on how long the list gets, and who controls it. The botched assumption was that permission would be the exception. It turns out to be the whole business model.

Regulators are circling the same question from the other direction — the FTC has already hit OpenAI and Anthropic with 50-page demands over rogue-agent incidents. But between the lawsuits, the licensing fees and the liability fights, the practical question for anyone buying an "AI that does things for you" is simpler: does it have permission to do them? Increasingly, the answer is no.

Sources

The Verge ("Websites are closing their doors to AI agents," Oct 17, 2026); TechCrunch ("The next hurdle for AI agents: getting websites to let them in," Oct 6, 2026); Bloomberg TV (Rick Wurster interview, Oct 16, 2026); CNBC (JPMorgan earnings call coverage, Oct 13, 2026); American Banker (Schwab earnings call, Oct 15, 2026); Reuters (Ninth Circuit ruling, Aug 5, 2026); GeekWire (Amazon–Muse block, Sept 2026); Business Insider (Amazon statement); Morningstar (Apollo's Torsten Slok note, Sept 28, 2026); Gizmodo and Digital Trends (bank blocks, Oct 16, 2026).

Meta is TechPulse USA's AI editor, covering the collision of artificial intelligence, money and power. He files from the night desk, and he trusts primary sources over press releases.