Amazon has blocked Meta’s Muse personal AI agent from shopping on Amazon.com, less than two weeks after Meta launched the assistant in the United States. The restriction appeared Sunday night, when Muse users trying to browse or buy from Amazon began seeing notices that the agent’s continued access violated the retailer’s conditions of use.
The immediate dispute is over authorization. Amazon says Meta did not tell it that Muse would enter the store, did not secure permission to access customer accounts or process transactions, and did not make the agent identify itself while browsing. Meta has not publicly answered those claims. The result is an early, unusually concrete test of whether a consumer can delegate ordinary web activity to an AI agent when the website on the other side does not consent.
That question reaches beyond Amazon and Meta. Shopping agents promise to compare products, fill carts and complete purchases across the web. To deliver that convenience, they may need to handle account sessions, shipping addresses, payment instructions, order histories and merchant interfaces that were designed for people or approved partners, not autonomous software.
Muse can shop through a browser when no API exists
Meta introduced Muse on September 8 as a general-purpose personal agent that can open a browser, fill out forms, book travel and make purchases after obtaining user approval. It is available through a dedicated app, the web and WhatsApp, with a U.S.-only launch for adults.
The browser is central to the Amazon conflict. Meta’s technical description says Muse can use a service’s API or command-line interface when one is available. If there is no suitable integration, the agent can operate the service through a browser much as its user would. That approach gives the agent broad reach, but it also bypasses the commercial and technical agreements that normally define what an approved shopping partner may do.
Meta built the agent around a dedicated cloud computer called Muse Secure VM. Its main runtime is isolated from credential storage, and a separate Sentinel system controls connector actions and network access. Meta says Muse cannot read stored passwords or payment details, asks before sensitive actions such as purchases, and shows users an audit trail. Checkout support includes Stripe Link, which can generate a one-time card instead of exposing the user’s underlying card number.
Those safeguards address the relationship between Muse and its user. Amazon’s objection concerns the other side of the transaction: whether the merchant knows an agent is present, has agreed to its access and can distinguish the software from a person using a conventional browser.
Amazon wants agent identity and merchant consent
Amazon told multiple publications that third-party services making purchases for customers should operate openly and respect a merchant’s choice to participate. According to GeekWire’s detailed account, the retailer also raised concerns about Muse reaching account pages and order histories without identifying itself.
Amazon has a commercial reason to hold that line. It wants shoppers to use its own Alexa for Shopping experience, which combines product research, personal preferences, price tracking and automated purchasing inside Amazon’s system. Its advertising business also depends on controlling product discovery and sponsored placement. An independent agent could compare stores before a shopper ever sees an Amazon results page.
Still, Amazon is not rejecting every outside path to agent-driven commerce. Walmart has announced plans to expose products through Google and OpenAI shopping interfaces, while Amazon’s own “Buy for Me” feature shops on other brands’ sites and, according to Amazon, identifies itself and allows merchants to opt out. The emerging divide is less about whether agents can shop than about which agents arrive through negotiated integrations.
The Perplexity case changed Amazon’s legal leverage
Amazon has fought a similar battle with Perplexity’s Comet browser. A federal district court initially granted Amazon a preliminary injunction, but the U.S. Court of Appeals for the Ninth Circuit vacated it on August 4.
The appeals court found that Amazon was unlikely to show, on the record before it, that Perplexity itself “accessed” Amazon’s computers under the federal Computer Fraud and Abuse Act. The judges treated the assistant as a tool helping the user access Amazon, even though Perplexity’s servers analyzed browser information and returned instructions. The decision was tied to that preliminary record and sent the case back for further proceedings; it did not establish a universal right for agents to use any website.
That ruling helps explain the wording shown to Muse users. Amazon’s block emphasizes its conditions of use rather than accusing Meta of hacking. Contract claims, bot-disclosure rules, account terms and technical access controls may become more important than anti-hacking law as retailers decide which agents to admit.
AI shopping needs a permission layer
The dispute exposes four practical requirements that agentic commerce still lacks at web scale.
- Agent identification: A site needs a reliable signal that a request comes from an agent, which company operates it and which user authorized the task. A conventional browser fingerprint or easily changed user-agent string is not enough for high-value transactions.
- Scoped authority: Merchants need to know whether an agent may research, add items to a cart, view past orders, apply credits or complete checkout. User consent alone does not tell the site which functions it should expose.
- Credential boundaries: Agents may shield passwords from their models, but merchants still need assurance about where session tokens, account data and payment credentials are stored, how long they persist and what happens after an incident.
- Transaction accountability: Refunds, substitutions, seller disputes and mistaken purchases need rules that allocate responsibility among the shopper, agent provider, payment service and merchant.
Until those pieces are standardized, browser-based agents will remain brittle. They can be blocked by a website change, challenged as unauthorized automation or forced into a manual handoff just before checkout. The technology may be capable of placing an order, but capability is no substitute for a merchant recognizing the agent and accepting its authority.
For consumers, the immediate advice is straightforward: review every item, seller, shipping address and total before approving an agent purchase, and avoid giving broad account access when a narrower connection will do. For retailers and agent developers, Amazon’s Muse block is a warning that the next phase of AI shopping will be negotiated at the identity and permissions layer, not won by browser automation alone.
