Key points
- In October, JPMorgan Chase said it will not let outside agents inside, Bank of America put liability on customers who share logins, and Walmart announced separate agent profiles.
- Walmart's Agent Profiles launch within a month of October 21, with per-purchase approval or customer-set spending limits such as $50, $100 or $200.
- DoorDash CEO Tony Xu said outside agents have placed maybe several hundred orders, against 993 million total orders in the quarter.
- Sierra and Meta are drafting the Personal Agent Protocol, which on October 30 added a recommendation that agents sign requests with Web Bot Auth.
Why it matters for marketers: Agent traffic is still tiny, so marketers and site owners have a window to decide how to detect, identify and treat agents before platforms or vendors decide for them.
As consumers start sending AI agents to buy groceries, book flights or check balances, businesses have to decide how to respond when an agent arrives. A Search Engine Journal analysis by Slobodan Manic describes three approaches that surfaced in October.
The first is blocking. JPMorgan Chase CEO Jamie Dimon said on the Q3 earnings call that the bank will not let just any outside agent come inside. The Verge reported that Charles Schwab and Delta also block agents. The second is doing nothing, which means the agent signs in as the customer. Bank of America warned customers that sharing a login with an agent makes them responsible for resulting activity. The third is Walmart's: a dedicated agent profile inside the customer's account, with approval for each purchase or a spending limit the customer sets. Walmart says agents see the same prices as people, and rule breakers get blocked.
For marketers, the point is visibility. When agent and customer share one login, their activity is blended together, which Walmart itself cites as the reason for its change. If a business cannot tell an agent from a person, it cannot treat them differently in analytics, personalization or fraud checks.
There is time. DoorDash's Tony Xu said outside agents have placed maybe several hundred orders, while the company handled 993 million in the quarter. Identity standards are still a draft: Sierra and Meta are writing the Personal Agent Protocol, and DataDome says Meta's Muse agent has signed some requests with Web Bot Auth since around October 12.
The author suggests three steps: test what your bot protection does to an agent today, choose and document your policy, and ask your web team to watch for agents that sign their requests.
Sources
This brief is our own summary. Read the full reporting at the source.