For about 20 years, the smart engineering decision was to keep automated traffic off your website. CAPTCHAs, bot walls, rate limits, and phone trees were all built on a sound assumption: that software arriving without a person behind it was probably there to scrape, defraud, or overload you. For the most part, this assumption was correct, but it’s the wrong approach for today.
Both technology and the people using it have changed. A growing share of the automated traffic hitting a business now belongs to their own customers, who have started sending personal AI assistants to book flights, pay bills, compare policies, and sit through hold music on their behalf. Traditional website defenses cannot tell the difference, and end up treating the customer as the threat.
Most of the discussion about this has centered around access, which is the wrong frame. The better question is not whether an agent gets in today, but what the agent learns when it does not.
An agent does not experience a block the same way a person experiences a locked door. There is no moment of indignation and no complaint to customer service. What the agent records is a failed trajectory, or a sequence of attempted steps that did not reach its goal. That record does not disappear when the session ends, and it compounds in three places:
- The first impact is immediate. Within a single task, an agent that cannot complete a booking on your site will finish its task somewhere it can, and the answer it gives the customer simply does not include you. The customer asked for a flight and received three options. Nobody told them your site offered a fourth.
- The second is personal. Agents increasingly carry memories of what has worked for a particular user. An assistant that failed twice at your site and succeeded at a competitor’s has learned something specific about which route serves its user well, and it will optimize and take that route again.
- The third is the one worth taking seriously. The systems behind these agents are trained and evaluated on what the web actually allows, and they are rewarded for task completion. Training environments are built from sites where tasks can be completed. The systems do not learn from businesses that are impossible to transact with, they ignore them completely.
I spent years building AI recommendation systems, and the pattern is familiar. In a recommender, an item that never converts gets down-ranked. There is no judgment nor intent in that. The system is doing what it was designed to do, which is to stop spending attention on things that do not work.
The asymmetry here is what makes it dangerous. When you frustrate a human customer, you usually find out. They call, they email, they post. When you turn away an agent, there is no signal at all. The traffic does not appear in your funnel, the loss does not appear in your reporting, and the customer never learns that you were an option. You are removed from consideration sets you cannot see by software your customers trust.
At Encore, we build AI agents for revenue-generating interactions, and we wanted to know how widespread this is. So rather than survey companies, we modeled the most popular personal AI assistants today, and sent them to visit more than 1,500 organizations across 25 industries.
They identified themselves on arrival, read only public pages, and never signed in. We publish the results as the Agent Readiness Index, including every check and weight, so anyone can recompute a score. As of Oct. 23, 94% of sites could not accept an agent connection at all, and 26% blocked agents that declared themselves. What gets rejected there is a label, not a capability. Most personal assistants run an ordinary browser on a machine of their own. They can open Chrome and move through a login page much as a person would, and by getting login credentials from their users they pass right through.
That is the real failure. The defenses now in place filter for honesty rather than for risk. An agent that announces what it is gets stopped at the door. The ones using a customer’s password have to be identified afterwards, from the trail they leave. Banks do that by reading the markers on every request, the address it came from, the device and browser it claims, and behavioral signals such as where a visitor clicked, how long they looked and where they paused. That is how banks have spent the past two weeks finding agents operating inside active customer accounts. Only 1% of the organizations we scanned offer a customer any way to approve an agent for a limited task with access they can withdraw.
The fix is not to let everything in, it’s to become legible. State in machine-readable terms what you accept and what you do not. Offer agents a direct connection rather than an interface built for someone with eyes and a mouse. Give customers a way to delegate a narrow task for a limited time, using the existing open standards. Legibility is better than permissiveness, because a business that declares its rules can enforce them, while a business that blocks indiscriminately can only hope.
What does the experience look like after this is fixed? An agent arrives carrying structured intent, which is a precise statement of what the customer wants, before the customer gets there. No channel in the history of commerce has handed a business that. Once you can work with agents safely, you can build offers they can act upon and products they can complete in a single step.
Every company I talk to has a mobile strategy and a social strategy. Almost none has an agent strategy, and in our scan only 6% had published any position on AI agents at all. That is not a considered stance. It is the absence of one, enforced by infrastructure that was built for a web that no longer exists.
The opinions expressed in Fortune.com commentary pieces are solely the views of their authors and do not necessarily reflect the opinions and beliefs of Fortune.
This story was originally featured on Fortune.com