Websites are locking out AI agents. They have a point.

12 November 2026 · from the person building Bowser

In the last two months the web got a door policy for AI.

On 20 September, Amazon blocked Meta's new Muse agent, less than two weeks after it launched. People who sent Muse shopping saw a notice instead: “Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed.”

In mid October, people using xAI's Grok Bot said their bots could no longer place Amazon orders. Amazon hasn't confirmed that one. Elon Musk's reply was “Maybe we should start a competitor to Amazon.”

The same week, JPMorgan and Charles Schwab told investors they block outside agents that sign in as a customer to move money. eBay's user agreement has said since January that nobody may use “buy-for-me agents, LLM-driven bots, or any end-to-end flow that attempts to place orders without human review”. People report agents failing on Walmart, Delta, Yelp, Zillow and Adidas too, sometimes on purpose and sometimes because an old anti-bot check can't tell an assistant from a scraper.

The usual reading is that big companies are protecting their turf. Partly, yes. Amazon has an agent of its own. But read the reasons they give and three complaints come up again and again.

  1. The agent doesn't say what it is. It arrives looking like a person.
  2. The agent holds the customer's password. Somewhere on another company's servers.
  3. Nobody looks before it buys. The order is placed, or the money moved, with no person in between.

I think two of those three are fair. And they are choices the people building agents made.

What I see from the other side

I'm building a tool that turns a website into something an AI assistant can call. This month I pointed it at ten websites it had never seen, with nothing written for any of them. On seven it made 25 working tools. The other three turned its browser away before it read a page: one behind Akamai, one behind Cloudflare, and one with a “verify you are human” page.

An earlier look at 22 Indian websites went worse. Fourteen refuse an automated browser.

So an assistant working from a data centre is locked out of a large share of the sites people actually use. There are two ways to respond.

One is disguise: fake a real browser's fingerprint, send traffic through home internet connections, pay a service to solve the CAPTCHA. That is a race against companies paid to win it, and it is the behaviour sites sue over.

The other is to stop pretending.

Where the agent runs turned out to matter

In August a US appeals court threw out the order Amazon had won against Perplexity's Comet browser. The reasoning was about plumbing. Comet works inside the person's own browser, and that browser is what talks to Amazon. In the court's words, “At no point do Perplexity's servers directly communicate with Amazon's servers.” So the one accessing Amazon was the customer, who is allowed to be there.

The ruling is narrow. It didn't decide whether a site can enforce its terms against an agent, and the case goes on. But it draws the line in a useful place. An agent that is a stranger's server holding your password is one thing. Your own browser doing what you just approved is another.

What I chose

Where a site turns robots away, the tool runs in your own Chrome. Your session, your connection, you at the keyboard. Nothing is disguised and no CAPTCHA is solved. If the site wants to check you're a person, you are one, and you answer.

The AI never sees a password. Where a sign-in is needed, it is encrypted and typed only on the website itself. The model works with a placeholder and never learns what is behind it.

Looking is kept apart from doing. While the tool learns a website, anything that would buy, send, save or delete is stopped before it leaves the browser. Afterwards, an action such as “add to cart” waits for your yes. It never presses a payment button.

No clicking around on every request. The site is explored once, and what comes out is a small tool that reads the site's own data. A call takes about a second and gives the same answer every time, with no AI model in the loop.

Here is what that looks like. I asked my assistant what 15 tablets of Telma 40, a blood-pressure medicine, cost that day. It called three pharmacies' tools and came back with ₹99.70 at 1mg, ₹76.94 at PharmEasy and ₹108 at Apollo, read from the sites as I asked, in a few seconds.

What this doesn't solve

The first complaint is still open, for me as much as anyone. In your own Chrome the website sees you, because the request really is yours. But a site whose terms say “no agents” has not agreed to anything, and Amazon's terms now say exactly that.

I don't think the answer is blocking, and I don't think it's disguise. It's a standard way for a personal agent to say “I'm acting for this signed-in customer, and they approved this step”. Meta, Walmart, Stripe and others have started on one. Until it exists, the honest version is a person in the loop: your browser, your yes, your payment.

The tool is called Bowser. I think of it as a gateway: a way for AI agents to discover websites and web apps and use them, with the person whose account it is in charge. It works with Claude today and speaks MCP, so other assistants can follow. It isn't open yet. I'm letting people in a few at a time.

If you've built an agent that got locked out, or you run a site that does the locking, I'd like to hear how it looks from where you are.

Where the facts come from

Bowser is opening to a few people at a time.

It turns the websites you're signed in to into tools your AI assistant can call. It asks before it acts, and it never sees your password. See how it works.

One email, when your invite is ready. Nothing else.