AI Shopping Agents Are Getting Blocked: What Nonprofits Should Check on Donation and Checkout Pages

AI shopping agents from Meta, OpenAI, Google, Perplexity and xAI now browse sites and buy things for people, and some large sites have started turning them away. On September 20, 2026, Amazon blocked Meta’s Muse agent from shopping on Amazon.com.

Most of our readers do not run a store the size of Amazon. But many sell memberships, event tickets and store items, or take donations online. The same agents can reach those pages, and your current settings already decide whether they get through. This is the seventh piece in our Marketing in the AI Age series. It covers what happened, which agents are out there, what Cloudflare changed, how to see agent traffic and what to test.

The short version: for most nonprofits and associations, there is no reason to block AI shopping agents on public pages, and Cloudflare’s defaults for sites without ads already let them through. The work is on your donation and checkout pages. Find out whether agents can complete a transaction there, whether your fraud tools stop them, and whether the records they create look right in your CRM or AMS.

What Amazon did about Meta’s Muse

Meta launched Muse on September 8, 2026. We covered it in What Is Meta Muse?. It runs its own browser in the cloud and can shop, book travel and fill out forms for you.

According to GeekWire, Amazon first asked Meta to remove Amazon from Muse. When that did not happen, Muse users started seeing a popup on Amazon.com: "Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed."

Amazon gave product reasons. It said Muse does not identify itself when it browses, and appears to capture and store customer credentials. Meta has said Muse "has no visibility into people’s passwords or payment methods." Meta had not responded to Amazon’s claims when GeekWire published.

This was not Amazon’s first move. GeekWire reports that Amazon had already moved to restrict shopping agents from Google and OpenAI. PPC Land adds that Amazon sued Perplexity over its Comet browser on November 4, 2025.

Amazon also runs its own agents. Its Buy for Me feature shops on outside brands’ sites, and Amazon says it identifies itself and lets brands opt out. That detail matters for the rest of this post: an agent that says who it is can be counted, allowed or blocked.

Grok Bot and the reimbursement pledge

xAI’s Grok Bot shops too. In October, a user posted that Amazon showed Grok Bot the same Conditions of Use message, according to Teslarati. Elon Musk replied that users should buy somewhere else.

Business Insider then reported that Musk said on X that SpaceX would reimburse Grok Bot purchase mistakes. The Next Web quotes his post: "SpaceX will make you whole." It also notes that Musk did not say what the pledge covers. We have not found a published xAI or SpaceX policy that matches it, so treat it as a statement on X.

For a nonprofit, the takeaway is practical. When Amazon says no, the agent goes looking for another site. Some of that traffic may land on your store, your event registration or your donation form. We explained how Grok Bot works in What Is Grok Bot?.

Which AI shopping agents may visit your site

Several AI shopping agents can now browse and buy for a person. Each major platform has one, and they identify themselves in different ways.

Google’s Google-Agent page says it "is used by agents hosted on Google infrastructure to navigate the web and perform actions upon user request." Google also says it is testing Web Bot Auth, a way for an agent to sign its requests so a site can verify them.

OpenAI’s bots page lists ChatGPT-User for actions a person starts in ChatGPT. The page does not name a separate identifier for dots or ChatGPT agent. Our posts on OpenAI dots and the agentic browser landscape cover how these products work.

What Cloudflare changed for AI shopping agents

Many nonprofit and association sites sit behind Cloudflare, directly or through a host. On September 15, 2026, Cloudflare reorganized its AI controls into three groups: Search, Training and Agent. Its announcement defines Agent as user-directed agents visiting a page for a person. That includes AI shopping agents.

The Agent control has three settings: Allow, Block on pages with ads, and Block. New domains get different defaults depending on one onboarding question: do you monetize pages that serve ads?

For most nonprofits and associations, that means agents are allowed by default. Publishers that run display ads are the exception. If you answered yes to the ads question, agents are blocked on any page where Cloudflare detects an ad.

Existing domains were migrated automatically. Cloudflare also deprecated the old "Block AI Bots" switch and Managed Robots.txt. We covered the earlier default change in our post on the Cloudflare AI crawler default, and the bot registry behind it in our post on BotBase.

Should you let AI shopping agents through?

For most of our readers, yes, on public pages. A member asking an agent to renew a membership or buy conference tickets is still a member. Blocking the agent blocks the transaction. Amazon’s reasons are tied to its own business. A membership organization usually wants the sale or the gift wherever it starts.

There are three cases where a closer look makes sense.

Agents that hide. An agent that sends a normal browser user agent looks like a person. You cannot allow or block it on purpose. You can only see what it does.

Fraud tools that cannot tell the difference. Donation forms attract card-testing bots. The challenges and rate limits that stop them may also stop a real agent. That is a fair trade on a donation form, but you should know it is happening.

Account pages. Amazon objected to Muse reaching account pages and order history. If your member portal stores addresses, invoices or CE records, decide whether agents should log in there. Most sites have never made that choice on purpose.

How to see agent traffic on your site

You cannot set a policy for traffic you cannot see. Start with three places.

Cloudflare AI Crawl Control. The Analyze AI traffic view shows requests by crawler, operator, hostname and path, with a table of the most requested paths. Filter by path to see whether agents reach /donate, /join or /store. Referral data, such as visits sent from chatgpt.com, needs a paid plan.

Server or CDN logs. Search for Google-Agent, ChatGPT-User and Perplexity-User in the user agent field. Cloudflare lists Perplexity-User as an AI Assistant in its verified bot categories. Google publishes the IP ranges for its agents in a file named user-triggered-agents.json, which helps you confirm a request is real.

GA4 and your payment reports. Agents that run a full browser may load your analytics tag and show up as ordinary sessions. Look for patterns: sessions with no scrolling, very fast form completion, or many purchases from cloud hosting regions. Our GA4 primer covers where to find those reports.

None of these will catch an agent that hides perfectly. They will show you the ones that identify themselves, and the trend is toward more of those.

Your settings: Cloudflare, robots.txt and bot management

Check these settings once, write down what you chose, and review them each quarter.

1. Cloudflare Agent control. In Security Settings, find AI Crawl Control. Confirm the Agent setting is what you want. If you run ads on articles but not on your store, “Block on pages with ads” may already fit.
2. The ads question. If you answered yes at onboarding and you do not run ads, change the setting. Otherwise agents may be blocked on pages Cloudflare reads as ad-supported.
3. robots.txt. Use it for search and training crawlers. Do not rely on it for agents.
4. WAF custom rules. Cloudflare’s verified bot categories, such as AI Assistant, still work in custom rules. Use them if you want different rules for checkout and content pages.
5. Bot challenges and CAPTCHA. List every page with a challenge. Decide page by page whether agents should pass.
6. Your host. Managed hosts often run their own CDN rules. Ask your host which bot settings apply and who can change them.

For a wider review, our AI crawler access audit walks through search and training bots.

What to test on donation and checkout pages

Run these tests with a real agent you or your agency has access to, on a staging site if you have one. Use a test card or your payment processor’s test mode.

1. Can the agent finish a one-time donation? Note where it stops: a challenge, a required field, a payment iframe.
2. Does it choose recurring by mistake? Many forms default to monthly giving. Check which option the agent picks and whether the confirmation is clear.
3. Who gets the receipt? Confirm the tax receipt and thank-you email go to the donor, not an agent’s address.
4. Tribute and dedication fields. Check that the agent fills them correctly or leaves them blank.
5. Membership renewal. Does the agent renew the right member record, or create a duplicate account?
6. Event tickets. Check quantity limits, member pricing and session choices.
7. Store items. Check shipping address, tax and any member discount codes.
8. Fraud rules. Watch whether your processor flags the agent’s purchase, and how your staff would see it.

Record the results in a short table: page, agent, outcome, fix. Repeat after any change to your forms or bot settings. Our post on agentic browser security covers the risks on the agent side.

Where this goes next

AI shopping agents now come from every major platform: Meta’s Muse, OpenAI’s dots, Google’s agents, Perplexity Comet and xAI’s Grok Bot. Large retailers are setting terms for them, and CDNs are adding controls. Signed requests through Web Bot Auth may make it easier to tell agents apart, but as of October 2026 Google calls its own use an experiment.

For small teams, the useful step is the same either way. Know which agents reach your transaction pages, decide what each page should allow, and test the result. The earlier posts in this series, including email marketing in the AI inbox, cover the other places AI tools now sit between you and your audience.

Frequently Asked Questions