Why AI Agents Will Live or Die on Permission

Sometimes it’s the only way to get real innovation off the ground.

Take Uber. We’d all still be hailing taxis, missing appointments and bickering about whether the credit card terminal in the back was really broken if Travis Kalanick had gone city by city politely asking the regulators for permission to operate.

Sometimes it backfires.

In the mid-2000s Google started scanning millions of library books without asking the authors or publishers who owned them for permission. Publishers sued in 2005, and three years later Google offered a $125 million settlement so that they could turn the scans into a giant digital library and bookstore. It would take nearly a decade and more legal battles for courts to rule the scanning to be fair use. Google got forgiveness in one sense of the word, but what it never got was the business it wanted to build on top of other people’s books. Time, and the innovation of others, disrupted their grand plan.

Today, AI agents are running the same forgiveness-before-permission play, but faster. Only now forgiveness is getting harder to come by.

In September, Meta introduced Muse, a personal agent that can shop, book and fill out forms across the web. Less than two weeks later, Amazon blocked it, telling shoppers that “continued access by an unauthorized AI agent violates Amazon’s Conditions of Use.” They contend that Meta never secured permission and raised concerns about how the agent identified itself and handled customer logins.

Nothing about the technology failed. Amazon just locked the door.

OpenAI’s Dots, launched at the end of September, takes it further. Dots can work in the background across connected apps, subject to user-set permissions and checks on consequential actions.

Read More: The Battle for AI Isn’t About Models. It’s About Habits

On October 22, Axios reported that unvetted agents had been logging into U.S. bank accounts, and that some had tried to take actions that seemed to go beyond the original user requests. Chase had already said on October 13 that it would block outside agents, calling them too risky for clients and for the bank. Citi, Wells Fargo, and others have also moved to limit agent access. Citi, for one, doesn’t let outside agents log in or make transactions, and only allows read-only data through approved providers.

It looks like the AI models learned from Rear Admiral Hopper and the long list of entrepreneurs who signed on to the ask-for-forgiveness approach. That is, if you  ever get caught.

The Agents Don’t Wait for Permission Either

It would be easy to write all this off as incumbents protecting their turf. The experiences so far say their caution is warranted, particularly since there are no financial penalties, few business models and a lack of an AI regulatory framework to incent a different behavior. And particularly since Anthropic, at least, keeps reminding us that there’s a 10% chance that an AI-powered Armageddon could be only a few years away.

Read More: AI Has a Frankenstein Dilemma

Speaking of Anthropic, in a case that reads like Hopper’s rule written into software, Anthropic’s October report described an agent working on a statistics project that found a way to query state-agency data while side-stepping the agency’s paywall. Anthropic called the real-world impact minimal, at least in their opinion. And I’m sure is very sorry for the inconvenience.

It’s the behavior, though, that’s the point. Nobody told the agent to do what it did, at least not that was disclosed. It was told to get the job done, and it treated the paywall as one more obstacle to work around. After all, they are called smart agents for a reason.

Then there’s the October 15 report from OpenAI describing two internal tests in which a model asked to pull figures from a public research dashboard ended up in the organization’s internal systems and changed their settings. In one test it reportedly downloaded 147,451 rows from five nonpublic tables.

Nothing in the assignment authorized that. But I’m sure they, too, are so very sorry it happened.

OpenAI says it has since tightened security and added safeguards to keep it from happening again. Meanwhile, the systems the model reached still belonged to a real organization whose information and operations had become part of somebody else’s experiment. All for free.

Of course, the Hugging Face breach is by now old news. Turns out OpenAI’s security evaluation had switched off OpenAI’s normal safety classifiers before its agent breached Hugging Face’s environment. OpenAI said it had since tightened controls on its testing. Never mind how much time, money and reputation the Hugging Face security team had to spend to investigate and contain the intrusion, rotate credentials and rebuild part of its infrastructure as a precaution.

Read More: The AI You’re Given vs. the AI You Chose

None of these are accounts of Muse or Dots misbehaving in customers’ hands. In fact, consumers using them assume that the details and permissions and safeguards are all in place, or else why would they be given access to agents in the first place? Rather, they’re all examples of how the companies building the most powerful agents using AI have had trouble keeping their own tests and instructions operating inside their own guardrails.

And without real consequences, they’ll keep asking for forgiveness, and the pattern will repeat.

It’s why a bank, a merchant or a hospital deciding whether to let an outside agent in is entitled to a past-as-prologue mentality. Because look at who paid in every one of the examples I cited.

It wasn’t the company that built the agent. The government (or website) didn’t get its fee. The data’s owner had its private data pulled, for free. Hugging Face, it seems, covered the cost of its own cleanup.

Economists have a name for this.

Sorry Isn’t a Business Model

It’s called the free rider problem, and the classic Econ 101 example is a lighthouse. Every ship on the high seas benefits from the light, but nobody wants to pay the keeper. When enough people ride for free, the lighthouse doesn’t get maintained, the keeper quits and the free riders end up running aground because the thing they counted for safe passage literally goes dark. That’s why we need the U.S. Coast Guard, on our tax dollars, to operate them.

Free riding lasts exactly as long as it’s free.

Look at what happened after every model-testing incident I cited. A blog post. A promise to tighten safeguards. A sort of apology. As far as the public record shows, no fine, no settlement and no check to the companies to reimburse them for cleaning up the mess, or accessing private data sources for free.

At the moment, there’s no regulator writing the rules or setting forth guidelines, no framework that says who pays when an agent goes rogue, and no contract between the agent and the business it just walked into. The most expensive thing an AI company pays for a breach today is the time it takes to write the blog post explaining what happened. And the plane rides to DC to talk publicly about how smart these models are and how more safeguards need to be built into them.

And that’s the real free ride. Not just the data, but the consequences. The agent company sells the convenience and keeps the upside. The bank, the merchant, the hospital, the agency, the business gets the risk, the cleanup and the angry or confused customer when things don’t work as advertised.

FinTechs and agent companies like to say the businesses blocking them are worried about fraud and cyber risk. Sure. They’re also worried about being the unpaid VC for the next big idea that’s coming for their customers. They’re asked to allow access to data that took decades to build, pay to secure it, pay for the servers answering millions of automated requests and then watch a startup use it to compete with them. When it goes sideways, they also hold the liability. No equity, no upside, only lots of risks.

No investor would ever sign that term sheet.

So, when a bank slow-walks agent access, I don’t read it as fear of the technology since they’re using it too. I read it as a company refusing to allow someone else to monetize its data assets for free, and insure it at the same time in case things go upside down at some later point.

Read More: How Leading Enterprises Really Measure Gen AI ROI

When nobody else imposes a penalty, or a set of frameworks that serve as a deterrent, the stewards of that data and those assets impose their own. History says one of three options are on the table. They block them. They bill them. Or they stop building the thing that was the basis for their own business model.

Agents are about to be introduced to all three.

Option One: Block the Agents

This is where we are today. Amazon blocked Muse. Chase blocked outside agents. Cloudflare started blocking AI crawlers by default in 2025.

It’s the oldest move there is. Napster had tens of millions of users and lost in court. Aereo streamed broadcast TV without paying, lost at the Supreme Court and went bankrupt. Reddit and X shut off free access to their data in 2023 and popular apps built on top of them simply died.

Blocking is a blunt instrument, and it has a cost of its own to all parties. Until businesses can tell a good agent from a bad bot from a real person, they stop everyone. And it costs them missed opportunities. It’s also why the rest of us get carded at the virtual door. Have you noticed the increase in two-factor checks on accounts you’ve had for years and annoying puzzles to prove you’re not robots? Agents were supposed to take friction away. In certain situations, they’ve added to it.

Option Two: Make Agents Pay

Blocking usually gives way to a price. In 1948 John Walson put an antenna on a Pennsylvania mountaintop and wired homes to carry Philadelphia TV signals somebody else paid to produce so he could sell TV sets. It took more than four decades for Congress to let broadcasters charge cable for carrying their channels. Cable pays them billions today.

Open banking just ran the same movie in fast forward. For more than a decade, aggregators logged in with customers’ bank passwords and pulled data again and again while banks paid for the servers, the security, and the fraud cleanup. J.P. Morgan said it got 1.89 billion aggregator requests in June 2025 alone, and only about 13% were tied to a customer doing something in their app.

So, it stopped waiting for regulators to rule one way or the other. Data aggregators connecting through Chase’s secure channels now pay an average of a quarter of a cent per data pull. Not zero. Not some egregious fee. But a price nonetheless.

Publishers are getting there with tools like Cloudflare’s Pay Per Use. And merchants already expect it. In the October PYMNTS Intelligence Merchant AI Report, 80% of the merchants surveyed expect fees or commissions on completed agent sales. They just want to know what they’re buying. Right now, none of the merchants selling through their own sites could fully connect AI visits to completed sales. Then again, calling an order agentic doesn’t make it worth another fee.

More interesting is who came out as the winner in each of these examples. They weren’t the takers. They were iTunes, Spotify, cable once it started paying, the aggregators who decided to work with banks, and the AI labs now signing data licensing deals.

We’d love to be your preferred source for news.

Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!

Add as Preferred Source

Paying for access is how they grew.

Option Three: Data Becomes Less Useful

An agent is only as good as the data it has access to.  The balance has to be the available balance. The shoes have to be in stock in the right size. The 10 a.m. appointment has to still be open. Somebody pays to keep all of that current.

Read More: As AI Assistants Fight Over Shoppers, Infrastructure Gets Paid Either Way

Take that value for free long enough and the owner stops investing in it. Publishers whose stories get answered by a chatbot with no visit back risk cutting newsrooms. Merchants who get nothing from agents won’t clean up their product data for them and make it accessible. Only 15% of merchants in a PYMNTS Intelligence and Visa Acceptance Solutions study had organized their product information for agents to use directly.

That’s the equivalent of the lighthouse going dark one bulb at a time.

The Fourth Way to Beat Agentic Free Riders: Get Invited

Some owners are opening the door, on their terms. On October 21, Walmart said agents including Muse, ChatGPT and Gemini can shop for its customers, but only through Walmart’s “Agent Gateway.” It’s in beta right now. Each agent gets its own profile, customers set a cap of something like $50 or $100, agents never see the card, and agents that break the rules get the boot. Walmart decides who gets in, what they see and what they spend, and says its normal returns process still applies when an agent messes up.

Amazon said no to agents from outside their virtual walls and Walmart said yes. But they said the same thing.

Agents come in on the owner’s terms. Walmart, the challenger online, wants the extra orders. Amazon, with an ad business worth more than $68 billion a year in 2025, built mostly on sponsored product listings that depend on shoppers browsing its pages, doesn’t. Same agent, different business model, different answer.

The card networks are building safeguards into payment credentials. Visa’s pilot with BILL and Billtrust lets identified agents pay approved invoices with tokenized credentials instead of shared logins. Mastercard’s Verifiable Intent records what the customer approved and uses it to settle disputes. American Express has announced Agent Purchase Protection for eligible charges caused by registered-agent errors. Amex calls that an industry first, promising to put money behind an agent’s mistakes.

But a card credential only covers the purchase. It doesn’t cover an agent rummaging through bank records or patient files or knocking over a service without buying a thing.

Who Owns the Bad Day When Agentic AI Is Involved in a Mistake?

That’s the hole nobody has filled, and it’s a whopper. Open banking already showed where the bill lands. Under Regulation E, when money leaves an account without the customer’s permission, the customer’s bank generally has to make them whole, even if the login was stolen from the FinTech or the aggregator. And when customers send money to the wrong place themselves, they usually can’t get it back at all, but it’s still the bank they call. Not the FinTech. Not the aggregator.

Read More: Big Tech Faces the AI Innovator’s Dilemma

The CFPB’s Open Banking rule, Section 1033, would have made access to bank data free, and it never said who pays when something goes wrong. Banks asked. The agency passed. Now the rule is in limbo, and the liability question is still sitting with the banks.

Agents make that messier. When an agent sends the wrong amount or exposes data it shouldn’t, who pays while the the agent platform and the software supplier argue over who really messed up? Right now, mostly the business trying to keep a customer happy.  A refund might settle a purchase. It won’t restore a deleted record or pay for the hours spent rebuilding a system.

Forgiveness Has a Price

Rear Admiral Hopper’s rule works when the apology is cheap and the consequences, well, inconsequential. Google couldn’t make the publishers want to build a bookstore with it. Uber got its forgiveness, then spent years and a lot of money paying for it.

Agents are getting a taste of that now. The companies behind Muse, Dots and whatever comes next can keep trying, keep apologizing and keep getting blocked. Or they can do what every winner in every other situation did. Give the owners a reason to say yes. And put money behind the bad day.

Hollywood already wrote this ending.

In Wedding Crashers, Owen Wilson and Vince Vaughn spend a summer eating, drinking, and dancing their way through strangers’ weddings on somebody else’s dime. It is a great movie. And their scheme works fine until a jealous boyfriend at the “Kentucky Derby of Weddings” involving the Treasury Secretary starts digging into who they really are. The ones who get to stay at the party are the ones who end up on the guest list, invited.

Agents seem to be crashing a lot of weddings right now. But just like the Wedding Crashers found out, the open bar may not stay open very long.

Until NEXT time.

Join the 21,000 subscribers who’ve already said yes to what’s NEXT.