The Walls Around AI Agents Went Up Where the Money Is

In December 2025, WhatsApp shut the door. Meta told businesses that use its messaging platform that rival AI assistants — from OpenAI, Perplexity, Anthropic — could no longer run inside it. The stated reason had nothing to do with what the programs might do.

The emergence of AI chatbots on our Business API put a strain on our systems that they were not designed to support. — Meta

Meta's own assistant kept running on those same systems. To be plain about terms, an AI agent is software that browses, compares and transacts on a person's behalf; the question of the past year is what it's allowed to touch. On Christmas Eve, Italy's competition authority ordered the ban suspended — the first of these walls, and the first to meet a regulator ^[1]. Run the same test at each gate: who gets through, and what does entry cost. The answers repeat, from the inside out. The banks. JPMorgan and Charles Schwab block outside agents from touching customer accounts and cite security, yet run their own on the same surfaces — JPMorgan's Smart Cash, Schwab's Charley — while Morgan Stanley says it has observed no rogue agents on its platforms, and outsiders are steered to read-only access ^[2]. Anthropic is a lab whose business is autonomous agents, which is why its April move is the instructive one. It cut OpenClaw, a third-party harness — a tool others built to drive Claude — off from flat-rate subscriptions, explained the cut purely as usage and capacity, and pointed the displaced users at its own pay-as-you-go API, the rails its own agentic business runs on ^[3]. Sam Altman, meanwhile, was saying the opposite in public.

Funny how timings match up, first they copy some popular features into their closed harness, then they lock out open source. — Peter Steinberger

Amazon withheld its live pricing from outside agents and planned a $59-a-month tier for merchants who want agents inside ^[4]. The consumer meets the wall as a broken product: tested for direct price shopping, ChatGPT and Claude came up empty because they lack live data access and face plugin restrictions, while tools that pay commissions succeed ^[5]. The wall is not one continent's habit. In China, WeChat, Alipay and Taobao barred the Doubao phone's screen-reading agent over data exposure and fraud, and a contest is now forming there over whose standard for agent access wins ^[6]. Now the exception that shows what the variable is. Shopify owns no consumer surface — no messaging app, no bank, no storefront where shoppers browse. So it did the opposite: it wired ChatGPT's checkout directly into its merchants' stores, and analysts upgraded it for its agentic stack ^[7]. Same agents, no wall. The wall tracks who owns the customer, not what the agent does. The map was drawn before most of the walls went up. Bernstein's October 3 note named what bleeds when a customer's agent starts working for the customer instead of the company: automated comparison of insurance policies, transfer of bank deposits, optimization of brokerage balances. When Meta's Muse assistant rose, stocks that live on customer stickiness fell 6 to 14 percent. The note itself flagged the obstacle in an aside — adoption is hindered by data access controls maintained by banks ^[8]. Keep the calendar honest: Meta's and Anthropic's walls predate that note; the bank and retail wave followed it. Now the price list, one toll per clause. Meta proposed a small transaction fee on vendors for sales funneled through Muse ^[9]. Amazon's merchant tier runs $59 a month ^[4]. Anthropic pointed its cut-off users at the API meter ^[3]. OpenAI's Agentic Commerce Protocol is branded an open standard but routes transactions through OpenAI's own rails, with Walmart and Worldpay signed on ^[10]. Cantor Fitzgerald's analysts put the quiet part in writing: the standard-setters may build long-term competitive moats through ecosystem lock-ins ^[11]. And the walls are reciprocal — OpenAI barred ads for rival AI tools inside ChatGPT while selling Amazon's ^[12]. The danger is real, and it should be said without hedging. Third-party agents have accessed bank accounts with user-shared credentials, and some behaved in ways their owners did not ask for.

the bank hasn't observed instances of "rogue AI agents accessing our platforms." — Morgan Stanley

CrowdStrike attributed hacks on South Korean banks to Chinese AI agents; the Federal Reserve, the OCC and the FDIC are asking banks about auditability and emergency shutdown mechanisms for agents acting past their authority ^[13]. The Financial Stability Board wants agents handled as something new.

AI agents pose a distinct challenge for human oversight. — Financial Stability Board

But the risk explains the words on the signs, not where the fences stand. The fences stand on the revenue, and the toll booth opened with them. Europe arrived late to hand the pattern its official name. In February the European Commission issued a formal statement of objections against Meta ^[14], framing the WhatsApp block as self-preferencing — favoring your own product on a surface you control.

We must protect effective competition in this vibrant field, which means we cannot allow dominant tech companies to illegally leverage their dominance to give themselves an unfair advantage. — European Commission

Two speeds tell the rest. The gates rose and got priced within weeks. The thing invoked underneath them — the missing identity layer, a way to tell an agent apart from a person — is still a proposal. And the proposed fix is itself a gate: tether every agent to a verified human, issue trust tokens, and someone has to own the registry. The payment networks are already in line to run it — Visa, Mastercard, Adyen ^[15]. The floor everyone says they are waiting for is the next door, and it already has owners.