94% of Websites Cannot Accept an AI Agent Connection

Ninety-four percent of the more than 1,500 organizations tested by Encore could not accept an AI agent connection at all, according to the company's Agent Readiness Index published as of Oct. 23. Another 26% actively blocked agents that declared what they were. The author of the findings argues that this is not security. It is self-erasure from a growing purchase channel.

The piece, which appeared as a Fortune commentary on Oct. 27, was written by an author who spent years building AI recommendation systems and now builds AI agents for revenue-generating interactions at Encore. The core claim is simple: for about 20 years, CAPTCHAs, bot walls, rate limits and phone trees rested on a sound assumption that software arriving without a person behind it was there to scrape, defraud or overload. That assumption has broken.

Who is knocking on the firewall now?

A growing share of automated traffic now belongs to the business's own customers, the author writes. People send personal AI assistants to book flights, pay bills, compare policies and wait on hold. Traditional defenses cannot tell these apart from hostile bots, so they end up treating the customer as the threat.

The author frames the problem as one of learning, not access. "The better question is not whether an agent gets in today, but what the agent learns when it does not."

What does a blocked agent actually record?

An agent does not experience a block like a person experiences a locked door. There is no indignation and no call to customer service. The agent records a failed trajectory — a sequence of attempted steps that did not reach its goal. The author says that record compounds in three places:

• Immediate loss. An agent that cannot complete a booking on your site finishes its task elsewhere. "The customer asked for a flight and received three options. Nobody told them your site offered a fourth."
• Personal memory. Assistants increasingly remember what worked for a particular user. One that failed twice at your site and succeeded at a competitor's will optimize toward that route again.
• Training-level exclusion. The systems behind agents are trained and evaluated on what the web allows, and rewarded for task completion. "The systems do not learn from businesses that are impossible to transact with, they ignore them completely."

The author draws a direct comparison to recommender systems. An item that never converts gets down-ranked. "There is no judgment nor intent in that. The system is doing what it was designed to do, which is stop spending attention on things that do not work."

Why the loss stays invisible?

The asymmetry makes the problem dangerous, the author argues. Frustrate a human and they call, email or post. Turn away an agent and there is no signal at all. The traffic never appears in the funnel. The loss never appears in reporting. "You are removed from consideration sets you cannot see by software your customers trust."

How did Encore measure this?

Rather than survey companies, Encore modeled the most popular personal AI assistants and sent them to visit more than 1,500 organizations across 25 industries. The agents identified themselves on arrival, read only public pages and never signed in. Encore publishes every check and weight behind the Ready Index at readyindex.ai, so anyone can recompute a score.

The findings expose what the author calls a filter for honesty rather than risk. An agent that announces what it is gets stopped at the door. Yet most personal assistants run an ordinary browser on their own machine, can open Chrome, move through a login page much as a person would, and pass right through once a user hands over credentials.

Only 1% of the organizations scanned offer a customer any way to approve an agent for a limited task with access they can withdraw.

What can banks already detect?

Banks identify undeclared agents after the fact by reading markers on every request: the address it came from, the device and browser it claims, and behavioral signals such as where a visitor clicked, how long they looked and where they paused. The author writes that this is how banks have spent the past two weeks finding agents operating inside active customer accounts.

What is the fix?

The author's answer is not permissiveness. It is legibility. Businesses should state in machine-readable terms what they accept and reject, offer agents a direct connection rather than an interface built for eyes and a mouse, and let customers delegate a narrow task for a limited time using existing open standards. "Legibility is better than permissiveness, because a business that declares its rules can enforce them, while a business that blocks indiscriminately can only hope."

The upside is concrete. An agent arrives carrying structured intent — a precise statement of what the customer wants — before the customer gets there. "No channel in the history of commerce has handed a business that." Once a business can work with agents safely, it can build offers they can act on and products they can complete in a single step.

The gap is organizational. Every company the author talks to has a mobile strategy and a social strategy. Almost none has an agent strategy, and in the Encore scan only 6% had published any position on AI agents at all. In the author's words, that is not a considered stance — it is the absence of one, enforced by infrastructure built for a web that no longer exists.