The biggest names in banking and retail are starting to fight the tech titans, and one another, over a new kind of customer: the AI personal agent.
JPMorgan Chase, Charles Schwab, Amazon, Neiman Marcus and Kohl’s have moved to block personal agents like Meta Muse just as consumers start sending them out to find better savings rates, shop for deals and cancel subscriptions.
The era of agentic AI has arrived, but there is uncertainty about what the landscape will look like when virtual storefronts become flooded with AI agents or when a business tries to block them.
Reports last week of AI agents going rogue in customer accounts — and prominent politicians including Sen. Mark Warner and Sen. Bernie Sanders calling for bot legislation in response to the headlines — come on the heels of JPMorgan Chase CEO Jamie Dimon saying the bank currently blocks external AI agents from operating on behalf of retail customers, citing security risks.
Some other retailers are leaning in. Walmart announced last week it is opening the virtual doors to AI agents that customers prefer to use. “We price products, not people, so the prices that an AI agent sees are the same prices that a human would see on Walmart.com, with applicable offers and fees shown before purchase,” the company said in a blog post announcing the decision.
A recent audit of 51 large U.S. retailers’ published access rules by identity-verification company Billions Network and affiliated company AmanTrue, found only 11 have taken a deliberate position on AI agents. Five, including Amazon, Kohl’s and Neiman Marcus, explicitly restrict them, while 37 block shopping agents largely by accident, through older bot rules written for scrapers. None has a way for a verified agent to complete a purchase.
Based on Billions Network’s analysis, blocking an agent can occur in multiple ways: blocking a specific bot from a third-party by its rules (e.g. as Chewy does with an Amazon bot), and employing more general blocks on any third-party bots attempting to access login, registration and checkout functions. Its analysis of published access rules comes with the caveat that those rules are not proof of technical enforcement.
Evin McMullen, Billions Network and AmanTrue co-founder and CEO, said at this point, “Most of the retailers in our audit have not made a decision about AI agents at all.”
Michael Abbott, global banking lead at the consulting firm Accenture, thinks that businesses blocking AI agents will find it difficult to win with that approach over the long term.
“If customers explicitly authorize an AI agent to act on their behalf, that’s ultimately an extension of customer choice. The more important question isn’t whether institutions can block agents, but whether they can create a secure and trusted way for them to engage,” Abbott said.
Abbott said that Accenture research found that 65% of consumers are open to using a GPT-like financial assistant through a Gen AI platform or digital wallet, and 71% would welcome an AI assistant embedded within their primary bank’s mobile app.
“We’ve seen this movie before … online banking, mobile banking and digital wallets. Customers tend to gravitate toward experiences that reduce friction and save time. The institutions that win are usually the ones that find a way to participate safely rather than resist the change,” Abbott said.
The real opportunity for banks is to become the trusted provider of the data, intelligence and execution that those agents rely on.
“As interactions increasingly happen beyond bank-owned channels, banks still need to be present at those critical decision moments, even if they don’t own the interface,” Abbott said.
Giving customers control over AI agents
When it comes to distinguishing legitimate security concerns from companies protecting profits by making it harder to move money or comparison-shop, Abbott said both things can be true at the same time.
“There are very real concerns around fraud, identity verification, liability and consumer protection. And customers expect their banks to safeguard their assets and data — those responsibilities don’t disappear simply because an AI agent is involved,” Abbott said, adding that at the same time, consumers have historically benefited from technologies that increase transparency and make it easier to compare options.
“Our research found that 82% want to approve every AI action and 79% want the ability to immediately pause or stop AI activity. That tells us consumers are looking for convenience, but not at the expense of control,” Abbott said.
Mike Danford, owner and chief revenue officer of Adverio, which runs Amazon, Walmart and Target marketplace operations for e-commerce brands, said that some of the security fears businesses, including banks, cite are less about security and more about whose sandbox a customer plays in.
“Amazon blocked Muse and other outside agents, but its own Buy for Me feature uses Amazon’s agent on other brands’ sites. Amazon doesn’t appear worried about the agent. It’s worried about who holds the data,” Danford said. “Amazon now lets shoppers set rules that auto-purchase when a price threshold is met, and that’s the version of agent buying consumers seem to accept, because the shopper still approves the decision within predefined parameters,” he added.
“We think it’s fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate,” an Amazon spokesperson said. “Agentic third-party applications such as Muse have the same obligations, and we’ve requested that Meta remove Amazon from the experience,” the spokesperson added.
Danford says banks are similar, just with a fee instead of a wall.
“JPMorgan now charges aggregators like Plaid for pulling account data, so the toll lands on the apps a consumer uses and may trickle down in subscription fees,” he said.
JPMorgan declined to comment.
Plaid said at the time of the September 2025 deal that it would not impact any of its existing pricing agreements with customers. Plaid does not charge consumers, though apps and services that use Plaid determine their own customer fees and subscription prices.
Michael Jabbara, head of payment ecosystem risk and control at the payments network Visa, declined to speak to any single bank’s motives for blocking agentic AI, but he said the fraud risks from agents are “very real and very tangible.”
Consumers can be fooled by fake agents built by fraudsters to steal their credentials and payment details, he said, and a legitimate agent can act in ways the customer never intended, like buying a sofa the shopper had only asked it to find.
Agents can also behave unpredictably: Jabbara described a user who asked his agent to book a gym slot, and when the slot was taken, the agent hacked the gym’s scheduling software, deleted the existing appointment and put the user’s name in its place. The concerns, he said, come down to knowing “who the agent is, who the agent is acting on behalf of,” and whether it has “the appropriate permissions.”
“Agents are not just exchanging data. Agents can also take an action on behalf of a user,” he said.
Like other experts, Jabbara says past shifts from online to mobile shopping are instructive, but for another reason: “None of those innovations really scaled until people were able to build that foundational security layer that enabled trust for that scale to happen.”
‘Agentic flooding’
Another worry is volume. Millions of agents doing legitimate work for customers could swamp websites and customer-service systems, a phenomenon some call “agentic flooding.”
Amid the sudden rise of personal agents like Muse, Wharton School AI expert Ethan Mollick posted, “We will soon see what will be, in effect, a perfectly legal distributed denial of service attack on customer service departments authorized by millions of consumers when it becomes widely known that Muse/Dot/etc can make unlimited requests for old refunds, negotiate deals, etc.”
Abbott calls it a possibility, not a crisis. “I see it more as an infrastructure challenge than an existential threat,” he said. “Most digital systems today were designed for human interactions. Agent-driven interactions could occur at a completely different scale and frequency. One person might have multiple agents continuously monitoring rates, researching products or evaluating alternatives.”
Nevertheless, he says the answer isn’t to block them. “It’s to build the next generation of infrastructure that can authenticate trusted agents, verify permissions, manage identity and support machine-to-machine interactions efficiently,” he said.
Which, he added, is nothing new for banks.
“Customers used to interact with their banks a couple of times a month and now with mobile it is nearly daily. AI agents are just the next evolution. The organizations that prepare for that reality will be better positioned than those that try to prevent it,” he said.
While many financial sites already have defenses against overuse, to protect against the types of mechanized denial-of-service attacks that have long been possible, agents “never sleep and never lose focus,” said Ed Felten, a Princeton professor emeritus of computer science who served as chief technologist at the Federal Trade Commission and deputy U.S. chief technology officer in the Obama administration. And the more agents use a site, the more the costs could rise for companies like banks.
But Felten doubts the blocking will last. “When a button is clicked in the user’s browser, it will be hard for a remote site to tell whether this was done by a human hand or directed by an AI agent on the user’s computer,” he said. “If there is a battle over AI access, it will slow the adoption of AI agents. But in the end, agents will win out because they will be so useful to users, so that sites that are too effective in blocking agents will lose business,” he added.
How long can incumbents keep ‘the gates’ closed?
As the market forces sites to accept their customers’ agents, common expectations will emerge about what is reasonable behavior by agents, experts said.
But Joseph Chalom, CEO of SharpLink, one of the largest corporate holders of the cryptocurrency ether, and a former BlackRock executive, expects the gates to stay shut for a while.
“These large incumbents effectively control the access points and will seek to keep their gates closed to fend off this innovative threat. Disruptors have fought the same battle for access for decades across travel, telephony, and financial data consolidators,” Chalom said, adding that in each case, the incumbent has cited security concerns, but in fact they also face significant business model interruption.
“For example, an AI agent working for users can easily rebook flight tickets at a lower cost, eating into the margins of airlines. And more significantly, an AI agent can move idle cash from checking and savings accounts earning little interest to a money market account earning 10x the interest rate,” Chalom said, noting that these types of “switching costs” are being reduced to near zero as agents have full financial literacy and attention span.
“For this reason, I don’t expect any of them to be in a hurry to lower the drawbridge,” Chalom said.
In the near term, Abbott says, some institutions will welcome agents while others stay restrictive as they sort out authentication, liability and governance. Longer term, he says, the data shows that companies should expect people to hand the administrative work of financial decisions to their agents. “Defense can prevent you from losing in the short term but to win banks will need an offensive strategy,” Abbott said.
Proprietary bots will need to be good enough to not only keep customers but keep them from wanting to use other agents, and that is how CEOs like Amazon’s Andy Jassy are talking about it. “We believe Alexa for Shopping is going to be the primary shopping agent customers use to shop Amazon. Having a shopping assistant constantly by your side as you browse, get inspired, have questions on product detail pages, and that you can simply ask to buy something based on your prior purchases that already have your history, your shipping address, and payment info, is uniquely helpful and convenient for customers,” he said during last week’s latest quarterly earnings call.
Ultimately, brands are about to be tested in ways that haven’t been possible before. Human customers become attached to brands for reasons beyond price: a nostalgic cereal that evokes warm fuzzy childhood memories, an airline soaked in the nostalgia of family vacations, or a bank with a favorite teller. An AI agent doesn’t care about any of that.
“Brand loyalty and customer relationships are getting tested. An AI agent has no feeling about a logo or a ten-year relationship. It has a mandate and cares purely about outcomes,” said Nikhil Behl, president of software at FICO, the analytics company best known for credit scores. “The levers that used to create stickiness get replaced by levers an agent can actually read, such as consistent approvals, transparent pricing, fast resolution, and terms that hold up through comparison,” Behl said.
