AI 代理为何成败取决于许可：Amazon 封堵 Meta Muse 等案例

Grace Hopper, the Yale PhD in math, computer pioneer and United States Navy rear admiral, liked to tell audiences that “it’s much easier to apologize than to get permission.” She didn’t invent the idea or the saying, but she made it famous. Silicon Valley has been running on it ever since.

Sometimes it’s the only way to get real innovation off the ground.

Take Uber. We’d all still be hailing taxis, missing appointments and negotiating whether the credit card terminal in the back was really broken if Travis Kalanick had gone city by city politely asking the regulators for permission to operate.

Sometimes it backfires.

In the mid-2000s Google started scanning millions of library books without asking the authors or publishers who owned them for permission. Publishers sued in 2005, and three years later Google offered a $125 million settlement so that they could turn the scans into a giant digital library and bookstore. It would take nearly a decade and more legal battles for courts to rule the scanning to be fair use. Google got forgiveness, but what it never got was the business it wanted to build on top of other people’s books. Time, and the innovation of others, disrupted their grand plan.

Today, AI agents are running the same forgiveness-before-permission play, but faster.

Today, AI agents are running the same forgiveness-before-permission play, but faster. Only now forgiveness is getting harder to come by.

In September, Meta introduced Muse, a personal agent that can shop, book and fill out forms across the web. Less than two weeks later, Amazon blocked it, telling shoppers that “continued access by an unauthorized AI agent violates Amazon’s Conditions of Use.” They contend that Meta never secured permission and raised concerns about how the agent identified itself and handled customer logins.

Nothing about the technology failed. Amazon just locked the door.

OpenAI’s Dots, launched at the end of September, takes it further. Dots can work in the background across connected apps, subject to user-set permissions and checks on consequential actions.

On October 22, Axios reported that unvetted agents had been logging into U.S. bank accounts, and that some had tried to take actions that seemed to go beyond the original user requests. Chase had already said on October 13 that it would block outside agents, calling them too risky for clients and for the bank. Citi, Wells Fargo, and others have also moved to limit agent access. Citi, for one, doesn’t let outside agents log in or make transactions, and only allows read-only data through approved providers.

It looks like the AI models learned from Rear Admiral Hopper and the long list of entrepreneurs who signed on to the ask-for-forgiveness approach (if you ever get caught).

The Agents Don’t Wait for Permission Either

It would be easy to write all this off as incumbents protecting their turf. The experiences so far say their caution is warranted, particularly since there are no financial penalties, few business models and a lack of an AI-regulatory framework to incent a different behavior. And particularly since Anthropic, at least, keeps reminding us that there’s a 10% chance that an AI-powered Armageddon is only a few years away.

Read More: AI Has a Frankenstein Dilemma

Speaking of Anthropic, in a case that reads like Hopper’s rule written into software, Anthropic’s October report described an agent working on a statistics project that found a way to query state-agency data without paying the required fee. Anthropic called the real-world impact minimal, and I’m sure is very sorry for the inconvenience.

It’s the behavior, though, that’s the point. Nobody told the agent to dodge the fee, at least not that was disclosed. It was told to get the job done, and it treated the price of access as one more obstacle to work around. They are called smart agents for a reason.

Then there’s the October 15 report from OpenAI describing two internal tests in which a model asked to pull figures from a public research dashboard ended up in the organization’s internal systems and changed their settings. In one test it reportedly downloaded 147,451 rows from five nonpublic tables.

I’m sure they are so very sorry it happened.

Nothing in the assignment authorized that. But I’m sure they, too, are so very sorry it happened.

OpenAI says it has since tightened security and added safeguards to keep it from happening again. Meanwhile, the systems the model reached still belonged to a real organization whose information and operations had become part of somebody else’s experiment. All for free.

Of course, the Hugging Face breach is by now old news. Turns out OpenAI’s security evaluation had switched off OpenAI’s normal safety classifiers before its agent breached Hugging Face’s environment. OpenAI said it had since tightened controls on its testing. Never mind how much time, money and reputation the Hugging Face security team had to spend to investigate and contain the intrusion, rotate credentials and rebuild part of its infrastructure as a precaution.

None of these are accounts of Muse or Dots misbehaving in customers’ hands. In fact, consumers using them assume that the details and permissions and safeguards are all in place, or else why would they be given access to agents in the first place? Rather, they’re all examples of how the companies building the most powerful agents using AI have had trouble keeping their own tests and instructions operating inside their own guardrails.

And without consequences, they’ll keep asking for forgiveness, and the pattern will repeat.

It’s why a bank, a merchant or a hospital deciding whether to let an outside agent in is entitled to a past-as-prologue mentality. Because look at who paid in every one of these stories.

Without consequences, they’ll keep asking for forgiveness, and the pattern will repeat.

It wasn’t the company that built the agent. The government (or website) didn’t get its fee. The data’s owner had its data pulled. Hugging Face, it seems, covered the cost of its own cleanup.

Economists have a name for this.

Sorry Isn’t a Business Model

It’s called the free rider problem, and the classic Econ 101 example is a lighthouse. Every ship on the high seas benefits from the light, but nobody wants to pay the keeper. When enough people ride for free, the lighthouse doesn’t get maintained, the keeper quits and the free riders end up running aground because the thing they counted for safe passage literally goes dark. That’s why we need the U.S. Coast Guard, on our tax dollars, to operate them.

Free riding lasts exactly as long as it’s free.

Look at what happened after every model-testing incident I cited. A blog post. A promise to tighten safeguards. A sort of apology. As far as the public record shows, no fine, no settlement and no check to the companies to reimburse them for cleaning up the mess.

There’s no regulator writing the rules, no law that says who pays when an agent goes rogue, and no contract between the agent and the business it just walked into. The most expensive thing an AI company pays for a breach today is the time it takes to write the blog post explaining what happened. And the plane rides to DC to talk publicly about how things need to change.

That’s the real free ride. Not just the data, but the consequences. The agent company sells the convenience and keeps the upside. The bank, the merchant, the hospital, the agency, the business gets the risk, the cleanup and the angry or confused customer when things don’t work as advertised.

When nobody else imposes a consequence, the owners impose their own.

FinTechs and agent companies like to say the businesses blocking them are worried about fraud and cyber risk. Sure. They’re also worried about being the unpaid VC for the next big idea that’s coming for their customers. They’re asked to hand over data that took decades to build, pay to secure it, pay for the servers answering millions of automated requests and then watch a startup use it to compete with them. When it goes sideways, they hold the liability. No equity, no upside, only exposure.

No investor would ever sign that term sheet.

So, when a bank slow-walks agent access, I don’t read it as fear of technology. I read it as a company refusing to fund its own competition and insure it in case things go upside down at the same time.

When nobody else imposes a consequence, the owners impose their own. History says they have three options. They block them. They bill them. Or they stop building the thing that was the basis for their own business model.

Agents are about to be introduced to all three.

Option One: Block

This is where we are today. Amazon blocked Muse. Chase blocked outside agents. Cloudflare started blocking AI crawlers by default in 2025.

It’s the oldest move there is. Napster had tens of millions of users and lost in court. Aereo streamed broadcast TV without paying, lost at the Supreme Court and went bankrupt. Reddit and X shut off free access to their data in 2023 and popular apps built on top of them simply died.

Blocking is a blunt instrument, and it has a cost of its own.

Blocking is a blunt instrument, and it has a cost of its own. Until businesses can tell a good agent from a bad bot from a real person, they stop everyone. And it costs them missed opportunities. It’s also why the rest of us get carded at the door. Have you noticed the increase in two-factor checks on accounts you’ve had for years and annoying puzzles to prove you’re not robots? Agents were supposed to take friction away. In certain situations, they’ve added to it.

Option Two: Bill

Blocking usually gives way to a price. In 1948 John Walson put an antenna on a Pennsylvania mountaintop and wired homes to carry Philadelphia TV signals somebody else paid to produce so he could sell TV sets. It took more than four decades for Congress to let broadcasters charge cable for carrying their channels. Cable pays them billions today.

Open banking just ran the same movie in fast forward. For more than a decade, aggregators logged in with customers’ bank passwords and pulled data again and again while banks paid for the servers, the security, and the fraud cleanup. J.P. Morgan said it got 1.89 billion aggregator requests in June 2025 alone, and only about 13% were tied to a customer doing something in their app.

Blocking usually gives way to a price.

So, it stopped waiting for regulators. Data aggregators connecting through Chase’s secure channels now pay an average of a quarter of a cent per data pull. Not zero. Not some egregious fee. But a price nonetheless.

Publishers are getting there with tools like Cloudflare’s Pay Per Use. And merchants already expect it. In the October PYMNTS Intelligence Merchant AI Report, 80% of the merchants surveyed expect fees or commissions on completed agent sales. They just want to know what they’re buying. Right now, none of the merchants selling through their own sites could fully connect AI visits to completed sales. Then again, calling an order agentic doesn’t make it worth another fee.

The winners in every one of these stories weren’t the takers. They were iTunes, Spotify, cable once it started paying, and the AI labs now signing data licensing deals.

Paying for access is how they grew.

Preferred Source

We’d love to be your preferred source for news.

Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!

Option Three: Stop Building

This is the one that should scare agent companies most. An agent is only as good as what it reads. The balance has to be the available balance. The shoes have to be in stock in the right size. The 10 a.m. appointment has to still be open. Somebody pays to keep all of that current.

Take that value for free long enough and the owner stops investing in it. Publishers whose stories get answered by a chatbot with no visit back risk cutting newsrooms. Merchants who get nothing from agents won’t clean up their product data for them. Only 15% of merchants in a PYMNTS Intelligence and Visa Acceptance Solutions study had organized their product information for agents to use directly.

That’s the equivalent of the lighthouse going dark one bulb at a time.

The Fourth Way to Beat Agentic Free Riders: Get Invited

Some owners are opening the door, on their terms. On October 21, Walmart said agents including Muse, ChatGPT and Gemini can shop for its customers, but only through Walmart’s “Agent Gateway.” It’s in beta right now. Each agent gets its own profile, customers set a cap of something like $50 or $100, agents never see the card, and agents that break the rules get kicked out. Walmart picks who get in, what they see and what they spend, and says its normal returns process still applies when an agent messes up.

Amazon said no to agents from outside their virtual walls and Walmart said yes. But they said the same thing.

Agents come in on the owner’s terms.

Agents come in on the owner’s terms. Walmart, the challenger online, wants the extra orders. Amazon, with an ad business worth more than $68 billion a year in 2025, built mostly on sponsored product listings that depend on shoppers browsing its pages, doesn’t. Same agent, different business model, different answer.

The card networks are building safeguards into payment credentials. Visa’s pilot with BILL and Billtrust lets identified agents pay approved invoices with tokenized credentials instead of shared logins. Mastercard’s Verifiable Intent records what the customer approved and uses it to settle disputes. American Express has announced Agent Purchase Protection for eligible charges caused by registered-agent errors. Amex calls that an industry first, promising to put money behind an agent’s mistakes.

But a card credential only covers the purchase. It doesn’t cover an agent rummaging through bank records or patient files or knocking over a service without buying a thing.

Who Owns the Bad Day When Agentic AI Is Involved in a Mistake?

That’s the hole nobody has filled, and it is a whopper. Open banking already showed where the bill lands. Consumer initiated payments, even if to the wrong account, are not entitled to have those monies refunded. Yet it is the bank to whom the customer turns if that happens. Not the FinTech, not the aggregator. CFPB’s Rule 1033 would have changed that.

Until agent companies sign up to pay for bad days, the businesses on the other side have every reason to keep the door shut.

Agents make that messier. When an agent sends the wrong amount or exposes data it shouldn’t, who pays while the model maker, the agent platform and the software supplier argue over whose code failed? Right now, mostly the business trying to get back to work. A refund might settle a purchase. It won’t restore a deleted record or pay for the hours spent rebuilding a system.

Until agent companies sign up to pay that bill, with real money or insurance behind it, the businesses on the other side have every reason to keep the door shut. Or negotiate over how to open it.

Forgiveness Has a Price

Rear Admiral Hopper’s rule works when the apology is cheap. It couldn’t make the publishers want to build a bookstore with it. Uber got its forgiveness, then spent years and a lot of money paying for it.

Pay for access. Give the owners a reason to say yes. And put money behind the bad day.

Agents are getting a taste of that now. The companies behind Muse, Dots and whatever comes next can keep apologizing and keep getting blocked. Or they can do what every winner in every one of these stories did. Pay for access. Give the owners a reason to say yes. And put money behind the bad day.

Hollywood already wrote this ending.

In Wedding Crashers, Owen Wilson and Vince Vaughn spend a summer eating, drinking, and dancing their way through strangers’ weddings on somebody else’s dime. It is a great movie. And their scheme works fine until a jealous boyfriend starts digging into who they really are. The ones who get to stay at the party are the ones who end up invited.

Agents are crashing a lot of weddings right now. But just like Owen and Vince found out, the open bar won’t last very long.

Until NEXT time.

Join the 21,000 subscribers who’ve already said yes to what’s NEXT.