Why AI Shopping Agents Get Blocked by CAPTCHAs and Websites

The pitch for a personal AI agent is simple: hand it the tedious browser work. Ask it to refill a grocery cart, compare products, put together a travel booking, or complete a checkout, and let it handle the clicks. In practice, the web is increasingly responding with the digital equivalent of a locked door and a tiny sign reading: select every square containing a traffic light.

Meta’s Muse has run into human-verification checks while working with Walmart, despite Walmart being a retail partner. Walmart has indicated that those checks were not designed specifically to exclude the assistant. Amazon, by contrast, has deliberately blocked the tool from shopping on its site. The contrast matters: an agent that fails to finish a task may have been singled out by a site’s rules, or it may simply have stumbled into automated defenses built to stop harmful or unwanted traffic.

For the person who asked for help, the result is the same. The agent gets stuck, and the supposedly automated task returns to the human player for an awkward quick-time event: log in again, pass a CAPTCHA, approve an authentication request, or finish the order manually.

User permission is not the same as website permission

The central tension is easy to describe. A user may authorize an AI tool to act for them, but the website on the other side may not agree to accept that tool. A browser agent is not merely offering a recommendation or summarizing a page. It may navigate multiple screens, enter information, access an account, add items to a cart and attempt to submit an order. Those are consequential actions, particularly when an account, payment method or travel itinerary is involved.

That distinction is at the heart of Amazon’s dispute with Perplexity over the Comet AI browser. Amazon’s position is that the agent breaks its access rules and could endanger customer data. Perplexity’s position is that the agent is operating with the user’s authorization. A federal appeals court vacated a preliminary injunction against Perplexity in August 2026, but the wider dispute has not been resolved.

There is an important wrinkle in Amazon’s stance. The company also has a Buy for Me feature intended to buy products from other brands’ websites. The issue, then, is not as simple as a retailer being categorically opposed to agent-led commerce. Control matters: who built the agent, what technical route it uses, what data it accesses, and which party is accountable when something goes wrong.

Other services are establishing their own boundaries. eBay’s user agreement bars unauthorized buy-for-me agents unless eBay grants permission. Delta has said there is no integration for third-party agents to book flights through its website, while not confirming whether it intentionally blocks individual agents. These policies show why an assistant cannot safely assume that a normal browser page is an open API.

What screen scraping means

Screen scraping is a broad term for software extracting information from what a website displays, or automating interaction with an interface designed for people. Rather than using a formal, approved connection between services, the tool effectively reads pages and presses buttons through the front end.

That can be useful for automation, but it also creates problems for websites. The site may not be able to reliably determine whether it is dealing with a customer-directed assistant, a fraud attempt, a data harvester, or a bot attempting high-volume activity. It also may not know whether the automation will obey expected limits, understand the consequences of a button click, or correctly cope with a changed page layout.

In a game analogy, user permission is like giving a co-op partner your controller. It does not automatically persuade every server in the world to recognize that partner as a valid player. The service still has its own rules for accounts, sessions and actions.

Why financial tasks are a much bigger risk

The stakes rise sharply when an agent can move money. During JPMorgan Chase’s October earnings call, CFO Jeremy Barnum warned that some agents use shared credentials and screen scraping for transfers, describing those methods as insecure. The bank blocks such methods where it can. He also warned that customers who provide their credentials could be responsible for an unwanted action taken by an agent.

That is the difference between an annoying wrong grocery substitution and an unauthorized transfer. An AI agent may be expected to interpret a request, make choices in an unfamiliar interface and proceed through a login flow. But a financial institution has to assess more than whether the customer originally asked it to act. It must also consider whether the action is properly authenticated, whether the credentials have been exposed, and whether the request can be trusted as it moves through the system.

For users, the practical takeaway is that convenience does not erase responsibility. Giving an agent access to an account can create exposure if the tool misunderstands instructions, is manipulated by bad information, or takes an action the user did not intend. The fact that an assistant can see the same interface as a person does not mean it has the same safeguards, judgment or legal standing.

Not every block is an intentional rejection

A site can welcome an AI assistant in principle and still accidentally shut it out in practice. Walmart’s Muse experience is one example. Zillow has also acknowledged that its anti-scraping measures can catch agents that it otherwise allows. For an end user, both scenarios look identical: the task does not finish. Behind the scenes, though, one is a policy decision and the other is a defensive system making an imperfect guess.

CAPTCHA is shorthand for a human-verification challenge. It is designed to separate legitimate human browsing from automated behavior. These challenges may appear because a system detects traffic patterns it considers unusual, not because it has proved that a visitor is malicious.

Anyone who has browsed via a shared VPN connection may recognize this. Google explains that traffic from a shared VPN network can trigger reCAPTCHA prompts if it resembles automation. AI agents face a similar problem: their navigation patterns can look bot-like because, technically, they are automated even when they are following a person’s request.

A VPN is therefore not a magic workaround. It may alter where traffic appears to come from, but it does not create permission to use an agent where a service forbids it. In some cases, it can cause additional verification because the network itself is shared or has developed a suspicious traffic profile.

This is a broader reliability lesson for delegated digital tasks. Automation is only as smooth as the identity, access and security checks around it. The same kind of friction can affect other connected technology when systems lose a trusted connection or fail to recognize a device; troubleshooting basics still matter in that world, as with smart-home devices that keep dropping off Wi-Fi.

Websites are starting to distinguish different kinds of bots

One complication is that “AI bot” covers several very different activities. A search crawler indexes pages for search results. An AI training bot may collect material for model training. An agent acting for a user may attempt a task such as filling a cart or arranging a reservation. Those behaviors can have different effects on a website, and site owners may want different rules for each.

Cloudflare now gives website owners tools to separate those categories. Since September 15, newly created domains using Cloudflare have defaulted to allowing search crawlers while blocking AI training bots and user-directed agents on pages that show advertising. Site owners can modify those settings.

The practical implication is significant: a website blocking a training crawler is not necessarily rejecting a shopping assistant, and a site allowing a search engine crawler is not necessarily granting a browser agent authority to transact. “AI access” is not one setting with one consequence. It is a collection of choices about discovery, data collection, account access and delegated actions.

That distinction also helps explain why a person can still view a page normally while their agent fails. The service may permit humans, conventional search indexing and perhaps approved partners, while refusing automation that resembles scraping or that does not use an authorized connection.

The more workable route: controlled handoffs

Shopify offers a more structured model for agent-assisted checkout. Its checkout tools let compatible browser agents update checkout information and submit orders after buyer confirmation, then hand control back to the shopper for authentication steps that require it.

This kind of design does not treat the agent as a fully independent customer. Instead, it defines where automation is allowed and where a human must re-enter the process. That is especially useful at the moments with the greatest consequence: confirming a purchase, verifying identity or completing payment-related authentication.

For shoppers, this is likely to be a more realistic expectation than total hands-off automation. An agent may be helpful at the low-risk stages: finding an item, assembling a cart, comparing options, or entering routine details. A site may then require explicit confirmation and human authentication before the final action. It is less flashy than an autonomous assistant completing everything unseen, but it gives services clearer controls and keeps the customer involved when it matters most.

What users should expect from AI agents right now

Expect uneven compatibility. An agent can work on one retailer or service and fail on another, even for an ordinary task.
Do not mistake a CAPTCHA for a definitive ban. It may be an anti-bot system reacting to automated behavior rather than a deliberate policy against that particular assistant.
Do not mistake a normal webpage for an approved integration. A page available in a browser is not necessarily designed for third-party agents to operate.
Keep a human in the loop for sensitive actions. Authentication, payment and money movement are the points where websites are most likely to demand direct user participation.
Be cautious with credentials. Shared logins and screen-scraping arrangements can carry meaningful security and liability risks, particularly in financial contexts.

AI agents are trying to turn the web from a place where people click into a place where software completes errands. The web’s existing defenses were largely built around a simpler split: humans are welcome; suspicious automation is not. As services develop approved pathways for legitimate assistants, that split may become more nuanced. Until then, an agent reaching a CAPTCHA, a login wall or a blunt platform restriction is not a weird exception. It is one of the main limits of what “do this for me” currently means online.