AI Governance Institute
← News
Corporate Policy2026-10-17

Amazon, JPMorgan, and Delta Block AI Agents, Exposing Agentic Access Risk

What happened

Reporting by Websites are closing their doors to AI agents documents a broad and accelerating pattern of major platforms shutting AI agents out of their services. Amazon, Delta Air Lines, JPMorgan Chase, and Charles Schwab are among those deploying technical controls, contractual restrictions, and legal threats. These measures target agents from OpenAI, Meta, xAI, and other providers. Blocking tools include Cloudflare's bot-management infrastructure, which lets platform operators filter out agent traffic without case-by-case review. The restrictions are driven by a mix of security concerns, data licensing disputes, and terms-of-service enforcement. One AI safety evaluator quoted in the article noted that widespread blocking directly undermines the core promise of autonomous agents, which depends on broad and reliable third-party access. This follows earlier reporting on Amazon Blocks Meta's Muse Agent, Exposing a Third-Party Terms-of-Service Gap, which flagged the same dynamic in a single-platform context.

Why it matters

  • ·Enterprises committed to agentic AI programs now face a structural reliability risk. If key third-party platforms can block agents at will, promised workflow automation may fail without warning. This creates gaps in processes that compliance teams assumed were operational.
  • ·The blocking trend shifts legal and operational risk back onto deployers. Organizations whose agents access third-party services without explicit permission face exposure under terms-of-service agreements and data licensing rules. They may also face liability under frameworks such as FTC Enforcement on AI (Section 5 of the FTC Act) if agent activity harms end users.
  • ·Third-party AI vendor due diligence programs must now account for platform access as a material dependency. An agent that works in testing can be disabled by a downstream platform at any time. Most vendor contracts do not address this risk or require notification when access is revoked.

Governance controls affected

AGT-028Agent External System Access BoundariesAGT-007Agent Scope and Task BoundariesAGT-016Agentic AI Deployment Readiness AssessmentPRC-001AI Vendor Due DiligencePRC-005AI Procurement Risk Assessment

What to do now

  • ☐Map every agentic AI workflow in production or pilot to identify which third-party platforms or services the agent accesses, and confirm whether access is explicitly authorized in a current agreement with that platform.
  • ☐Review vendor contracts for AI agent deployments to determine whether they address platform access disruption, and escalate gaps to legal for remediation before the next renewal cycle.
  • ☐Ask your technology and AI teams to identify which agentic workflows would fail or produce compliance gaps if a third-party platform blocked agent access overnight, then prioritize those workflows for manual fallback procedures.
  • ☐Update agentic AI deployment readiness assessments to include third-party access continuity as a named risk factor, not just a technical assumption.
  • ☐Add a standard question to AI vendor due diligence reviews asking how vendors handle platform access restrictions and whether their agents operate within the terms of service of every platform they touch.

What to watch next

Compliance teams should monitor whether platform blocking practices prompt formal regulatory guidance on what constitutes permissible agent access to third-party services. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services already flags third-party access as a risk vector. Regulators in financial services and critical infrastructure may address it more specifically as blocking becomes widespread. Pending US legislation such as the AI AGENT Act of 2026 could also impose access or disclosure requirements that reshape how platforms and deployers negotiate agent permissions. Organizations with multi-jurisdictional agentic programs should track whether the EU's enforcement of the EU AI Act (Regulation (EU) 2024/1689) creates new obligations around agent access transparency or continuity.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Related Coverage

Research2026-10-14

Frontier Labs' Basic Containment Failures Drive Agent Incidents, Experts Warn

Cybersecurity experts interviewed across three industry conferences say recent unauthorized AI agent access incidents at OpenAI, Anthropic, Meta, and Google stem from poor containment and monitoring practices. The failures involve misconfigured isolation, weak network controls, and inadequate behavioral monitoring, not runaway model behavior. The findings carry direct implications for enterprise vendor due diligence and third-party AI risk programs.

Research2026-10-16

Hallucinated OpenAI Skill Domain Captured Real Authentication Tokens From Live Apps

Researchers at AIR Security found that an official OpenAI skill for the Render deployment platform contained a fabricated, unregistered web address. The address instructed live production applications to send authentication tokens there. The researchers registered that address and confirmed real tokens arrived, proving the attack path works.

Research2026-10-13

Amex's Pre-Authorization Framework Exposes Agentic Spending Controls Gap

American Express has launched the Intent Intelligence Framework, a technical standard requiring AI agents to register a customer's purchase intent before completing a transaction. The framework issues a unique identifier and a token that locks the transaction to pre-approved constraints, replacing card numbers with a secure reference. Organizations using other payment rails gain no equivalent control, exposing a gap between Amex-gated and ungated agentic spending.