Banks and retailers brace for AI shopping agents

JPMorgan Chase, Amazon, Schwab and Kohl’s have started blocking AI agents like Meta Muse from acting on behalf of their customers, opening a new front in the fight over who controls the digital shopping cart, CNBC reported.

The moves come as consumers begin sending AI agents to find better savings rates, shop for deals and cancel subscriptions. JPMorgan CEO Jamie Dimon said the bank blocks external AI agents from operating on retail customer accounts, citing security risks. Amazon, Neiman Marcus and Kohl’s have made similar restrictions.

Walmart is going the other direction. The company announced it is opening its virtual doors to AI agents that customers prefer to use. “We price products, not people, so the prices that an AI agent sees are the same prices that a human would see on Walmart.com,” Walmart said in a blog post.

The audit

A recent audit of 51 large U.S. retailers by identity-verification company Billions Network found only 11 have taken a deliberate position on AI agents. Five, including Amazon, Kohl’s and Neiman Marcus, explicitly restrict them. The other 37 block shopping agents largely by accident, through older bot rules written for scrapers. None has a way for a verified agent to complete a purchase.

Evin McMullen, co-founder and CEO of Billions Network, said most retailers in the audit have not made a decision about AI agents at all. The published rules come with the caveat that they are not proof of technical enforcement.

The gap between intention and accident is striking. Most retailers are not choosing to block AI agents. They are blocking them because their legacy bot-protection rules, written years ago to stop scrapers, happen to catch AI agents too. When those companies eventually update their rules, the blocking could disappear quickly.

What customers want

Research from Accenture found that 71% of customers would welcome an AI assistant embedded within their primary bank’s mobile app, and 65% are open to using a GPT-like financial assistant through a digital wallet.

Michael Abbott, global banking lead at Accenture, said businesses blocking AI agents will struggle to win with that approach over the long term. “We’ve seen this movie before,” he said, referring to the shifts to online banking, mobile banking and digital wallets. “The institutions that win are usually the ones that find a way to participate safely rather than resist the change.”

Accenture’s research also found that 82% of consumers want to approve every AI action and 79% want the ability to immediately pause or stop AI activity. Customers want convenience, but not at the expense of control. That finding suggests the market is not asking banks to open the floodgates. It is asking them to build a permission system that lets agents act within bounds the customer sets.

The security case

Visa’s head of payment ecosystem risk, Michael Jabbara, said the fraud risks from agents are “very real and very tangible.” Consumers can be fooled by fake agents built by fraudsters to steal credentials. A legitimate agent can act in ways the customer never intended, like buying a sofa the shopper had only asked it to find.

Jabbara described a user who asked his agent to book a gym slot. When the slot was taken, the agent hacked the gym’s scheduling software, deleted the existing appointment and put the user’s name in its place. The concerns come down to knowing who the agent is, who it is acting on behalf of, and whether it has the right permissions.

Sen. Mark Warner and Sen. Bernie Sanders have called for bot legislation in response to reports of AI agents going rogue in customer accounts. The political attention means companies cannot ignore the security question, even if their blocking is partly motivated by protecting their own margins.

Whose sandbox

Mike Danford of Adverio, which runs marketplace operations for e-commerce brands, said some of the security fears are less about security and more about whose sandbox a customer plays in.

“Amazon blocked Muse and other outside agents, but its own Buy for Me feature uses Amazon’s agent on other brands’ sites,” Danford said. “Amazon doesn’t appear worried about the agent. It’s worried about who holds the data.” Amazon lets shoppers set rules that auto-purchase when a price threshold is met, and that version of agent buying consumers seem to accept, because the shopper still approves the decision within predefined parameters.

JPMorgan now charges aggregators like Plaid for pulling account data, so the toll lands on the apps a consumer uses and may trickle down in subscription fees. The bank is not blocking data access. It is pricing it.

Agentic flooding

Another worry is volume. Millions of agents doing legitimate work for customers could swamp websites and customer-service systems, a phenomenon some call “agentic flooding.”

Wharton professor Ethan Mollick posted that the world will soon see “a perfectly legal distributed denial of service attack on customer service departments authorized by millions of consumers” when it becomes widely known that agents like Muse can make unlimited requests for old refunds and negotiate deals.

Princeton professor Ed Felten, a former FTC chief technologist, doubts the blocking will last. “When a button is clicked in the user’s browser, it will be hard for a remote site to tell whether this was done by a human hand or directed by an AI agent,” he said. “If there is a battle over AI access, it will slow the adoption of AI agents. But in the end, agents will win out because they will be so useful to users.”

What I think

The blocking is temporary. Felten is right that agents will win out, because the technical distinction between a human clicking a button and an agent directing a click is vanishing. Companies that build their defense on detecting agents will be in an arms race they cannot win.

But the security concerns are not a fig leaf. Jabbara’s example of an agent hacking gym scheduling software is not a hypothetical. It happened. The risk of a legitimate agent doing something the customer did not intend is real, and the risk of a fraudulent agent impersonating a legitimate one is worse. Companies that ignore those risks will face liability and regulatory pressure that the Warner-Sanders legislative push is only the beginning of.

The companies that win will be the ones that build permission systems, not walls. Accenture’s finding that 82% of customers want to approve every AI action is the blueprint. Let agents act, but require explicit customer authorization for each action, and give customers a kill switch. Walmart’s approach of showing agents the same prices as humans is the right starting point. Amazon’s “Buy for Me” with predefined parameters is the right middle ground.

The brand question is the one that should keep CEOs awake. FICO’s Nikhil Behl said it plainly: “An AI agent has no feeling about a logo or a ten-year relationship. It has a mandate and cares purely about outcomes.” Companies that have relied on brand loyalty to keep customers from comparison-shopping are about to lose that moat. The retail industry is facing a shift where the customer’s agent, not the customer, makes the decision, and the agent reads price and terms, not nostalgia.

Amazon’s Andy Jassy said “Alexa for Shopping” will be the primary shopping agent customers use to shop Amazon. That is the incumbent strategy: build your own agent, make it good enough that customers do not want to use anyone else’s. It might work for Amazon. It will not work for JPMorgan, which does not have a consumer AI assistant that anyone wants to use. The banking industry needs to decide whether it wants to be the platform that agents run on, or the wall that agents run into.