Why AI Agents Keep Getting Banned From the Platforms They Use

Someone recently tried to book a dinner reservation using their AI agent. The platform didn’t just block the booking — it banned the user’s entire account.

The agent wasn’t doing anything malicious. It was doing exactly what the user wanted: finding an open table and booking it. But to the platform’s infrastructure, an automated request that isn’t a human clicking buttons looks like a bot attack. And the system’s response to bot attacks is simple: block and ban.

Zach Meltzer, CEO of VeryAI — a company building palm biometric verification that works from any smartphone camera — has been watching this collision unfold in real time. His team recently launched AG9, an identity layer for AI agents, because the problem isn’t going away. It’s about to get much worse.

The Infrastructure Paradox

For decades, the internet has invested heavily in one goal: keeping bots out. CloudFlare, CAPTCHA, rate limiting, behavioral analysis — the entire defensive stack is designed to identify and block non-human traffic.

That made sense when “non-human” meant “malicious.” Scrapers, spammers, credential stuffers. The system learned to equate automated behavior with bad intent.

Now the equation has flipped. Millions of people are building or using AI agents to handle routine tasks — booking travel, managing finances, monitoring prices. These agents need to interact with the same platforms that were built to reject them.

“The entire internet was built today on the assumption that we know there’s a human behind this interaction,” Meltzer says. “And that’s actually proving to not be true now. For decades, we’ve been using tools like CloudFlare and CAPTCHA, where you have to check the box that you are a human, not a bot. But the situation has actually become the opposite now.”

The Rezzy Problem

The dinner reservation story captures the gap perfectly. Meltzer describes it as a real incident: “Someone tried to book a dinner reservation on Rezzy using their agent. And not only was the transaction blocked because they thought it was a bot, but his entire account was banned because it looked like a malicious action.”

That’s not a bug — it’s the system working exactly as designed. The platform detected non-human behavior and responded accordingly. The problem is that the system has no way to distinguish between a scraper trying to grab reservation inventory and a legitimate user whose agent is booking dinner on their behalf.

Meltzer acknowledges this is still an edge case. “It is possible that this is the only person on the planet trying to book a dinner reservation with their agent. So it’s still pretty niche today. But over the next few months or the next year, we’re gonna see this expand rapidly.”

What Know Your Agent Actually Means

The proposed solution isn’t to make agents better at pretending to be human. It’s to give them their own identity layer. VeryAI’s AG9 product is part of an emerging category called KYA — Know Your Agent — modeled after KYC (Know Your Customer) for financial compliance.

The mechanics work like this: a user builds or deploys an agent, then links their verified palm biometric to it. When the agent interacts with a third-party platform, that platform can verify the agent is owned by a real human and authorized to take specific actions. The user receives push notifications for approval — scan your palm to authorize a $500 trade, for example.

“A third party platform like Robinhood or Coinbase or JP Morgan knows that you’re giving approval to this agent and then you don’t have to remove agents entirely from a platform,” Meltzer explains. The alternative is what’s already happening: platforms simply blocking all agent traffic.

The Race to Define Agent Identity

Several companies are building KYA infrastructure, each with a different approach. Some focus on the agent’s financial history and transaction patterns. VeryAI focuses on the human behind the agent — connecting agent actions to a verified person through biometric proof.

The regulatory landscape is catching up, too. The EU AI Act is introducing requirements around agent identification. But the technology is moving faster than the regulation. Developers building agents today face a practical question: do they build with identity and authorization in mind now, or retrofit it later when platforms start requiring it?

Meltzer’s advice is direct: “If you don’t build your infrastructure, whatever you’re building, personal agents, agents as a service for other people, if you don’t build that with this aspect of verification or authenticity in mind, you will likely run into issues down the line.”

The dinner reservation ban is a mild version of what’s coming. When agents start handling higher-stakes actions — financial trades, healthcare scheduling, legal filings — the cost of being blocked or banned goes up dramatically. The infrastructure to prevent that needs to exist before the volume arrives.

FAQ

Why do AI agents get blocked or banned from online platforms?

Most internet infrastructure — CAPTCHA, CloudFlare, behavioral detection — was built to block non-human traffic. AI agents trigger the same automated defenses as malicious bots. Platforms can’t distinguish between a scraper and a legitimate agent acting on a user’s behalf, so they block both.

What happened when someone tried to use an AI agent to book a restaurant?

A user’s agent tried to book a dinner reservation on Rezzy. The platform flagged the automated request as a bot attack, blocked the transaction, and banned the user’s entire account. The agent was doing exactly what the user wanted — the system just couldn’t tell the difference.

What is KYA — Know Your Agent — and how does it work?

KYA is an emerging verification standard for AI agents, similar to KYC for humans. It links agents to verified human owners so platforms can confirm the agent is authorized to act. VeryAI’s AG9 product uses palm biometrics — users scan their palm to approve or revoke agent actions via push notification.

Which platforms are already preparing for AI agent identity verification?

Some neo-banks already show separate login methods for humans and agents. Financial platforms, exchanges, and booking services are evaluating agent verification infrastructure. VeryAI cites Robinhood, Coinbase, and JP Morgan as the types of platforms that need this capability.

Should developers building AI agents think about identity and verification now?

Yes. VeryAI’s CEO warns that developers who build agents without verification infrastructure will face issues as platforms begin requiring proof of human ownership. The EU AI Act is introducing agent identification requirements. Building with KYA compatibility early avoids costly retrofitting.

How does VeryAI’s AG9 connect an AI agent to its human owner?

Users link their palm biometric to their agent through AG9. When the agent attempts an action on a third-party platform, the user receives a push notification and scans their palm to approve or revoke. The platform receives cryptographic proof that a verified human authorized the action.

What is the difference between a malicious bot and an authorized AI agent?

Intent and ownership. A malicious bot operates without human authorization, usually to scrape data, stuff credentials, or commit fraud. An authorized agent acts on behalf of a verified human for a specific purpose. Current infrastructure can’t distinguish between them — which is why agents get banned.

How many AI agent transactions are expected in the coming years?

The volume of agentic transactions is projected to increase by millions or even billions as agents handle routine tasks like trading, booking, and account management. VeryAI is building infrastructure for that scale before demand arrives, since retrofitting identity at volume is significantly harder.

Will AI agents eventually need government-issued IDs?

Probably not as a blanket requirement. VeryAI’s CEO expects agents will remain fairly open and developer-focused for most use cases. Certain high-stakes scenarios involving large financial institutions may require additional verification, but spinning up a basic agent will likely stay accessible.