Amazon Blocks Meta’s Muse AI Agent From Shopping on Its Store

Article Brief

What changed

3 Points18s Read

1. 01The block–Amazon stopped Meta’s Muse from shopping on Amazon.com and cited unauthorized agent access under its conditions of use.
2. 02The dispute–Meta says Muse protects credentials and requires user approval; Amazon says a user’s consent does not replace merchant permission or agent identification.
3. 03The wider issue–Agentic commerce needs a shared way to prove identity, scope and consent across retailers before “works everywhere” can be a dependable promise.

Amazon has blocked Meta’s new Muse personal AI agent from shopping on Amazon.com, turning a product launch into an early fight over who controls the customer when software shops on a person’s behalf.

The restriction appeared Sunday night, less than two weeks after Meta launched Muse in the United States. People who asked Muse to shop on Amazon began seeing a notice that continued access by an unauthorized AI agent violated Amazon’s conditions of use. Amazon told GeekWire that Meta had not notified the retailer before Muse accessed its store, that the agent did not identify itself while browsing, and that the way it handled account access raised security and privacy concerns.

Meta has described the same system very differently. In its September 8 launch announcement, the company said Muse runs in a dedicated secure virtual machine, keeps credentials in protected storage, cannot see passwords or payment methods, and asks the user before sensitive actions such as sending an email or making a purchase.

Those positions do not neatly cancel each other out. Meta is arguing that the user authorized an agent with safety controls. Amazon is arguing that authorization from the customer does not automatically authorize an undisclosed third party to operate inside Amazon’s service. The disagreement exposes a boundary that the first wave of shopping chatbots mostly avoided: an AI agent can act for a buyer and still be unwelcome to the seller.

TECHi’s March report on Meta’s AI shopping tool covered a more limited product. Meta was testing a shopping research experience that could recommend products, display prices and send people to outside sites. That version competed with ChatGPT and Gemini mainly at the discovery stage.

Muse changes the job. It is designed to carry out multi-step work, continue after a person closes the app and return when it needs approval. Meta says it can open a browser, fill out forms, negotiate, connect to services and proceed through checkout. The company has paired it with Stripe’s Link wallet, which can generate a one-time card, and says Shop Pay and 1Password support are coming.

That shift from recommendation to execution is why the Amazon block deserves a separate follow-up rather than a light update to the March article. The earlier story asked whether Meta could influence what people discover. The live dispute asks whether Meta can enter another company’s storefront, use a customer’s account and complete the transaction without a direct agreement with that merchant.

Muse had already shown consumer pull before the confrontation. Axios reported on September 18 that it had reached the top of Apple’s US free-app chart ten days after launch. Meta executives have emphasized examples in which users say the agent found discounts, canceled services or recovered refunds. These examples are early anecdotes rather than audited performance data, but they explain why access to a store as large as Amazon matters. A task agent becomes more useful as the number of services it can reach grows.

Amazon’s objection is about identity and permission

Amazon’s public position has three parts. It says Muse accessed Amazon without prior notice, did not identify itself as an automated agent and appeared to handle customer authentication in a way that created risks. The retailer said services that buy from other businesses should operate openly and respect the service provider’s decision about participating.

Meta’s design answers some consumer-side risks. According to the company, Muse keeps each user’s work in a dedicated cloud computer. A separate system called Sentinel reviews actions before they reach the internet, and the user receives an audit trail. Credentials go into secure storage and can be used by Muse without being visible to the model itself.

But security inside Meta’s system is only one layer of the dispute. Amazon wants to know that an automated service is present, how it is interacting with pages and accounts, and whether Amazon agreed to that interaction. An agent can be technically isolated from a user’s password while still appearing to the merchant as an unknown browser controlling a sensitive account.

That distinction matters because agentic shopping crosses several trust boundaries at once. The user trusts Meta to interpret the request. Meta’s software acts inside Amazon. Amazon must protect the account, payment flow, product rankings and order history. A failure can be hard to assign: the mistake might originate in the model’s instruction, the agent’s browser action, a changed product page, a merchant listing or the final approval screen.

The immediate consumer effect is simple. Muse users cannot currently rely on the agent to shop on Amazon. The broader product effect is more serious. If large services require formal agreements, technical identification or purpose-built APIs, general-purpose agents may not be able to deliver the “works everywhere” experience that makes them attractive.

Amazon is defending more than checkout

The fight is also about the layer that sits between a shopper and a product. Amazon’s store does more than process a payment. It ranks results, displays sponsored listings, recommends substitutes, sells delivery memberships and collects signals about what customers compare before they buy.

A third-party agent can compress that journey into a single answer. It may search Amazon alongside other stores, discard sponsored placements, compare final prices and return only one or two choices. That is convenient for the user, but it can weaken the retailer’s control over merchandising and advertising.

This is where the commercial interests of Amazon and Meta collide. Amazon wants its own interface and shopping assistants to remain central to product discovery. Meta wants Muse to become the interface through which people delegate tasks across the web. Both companies can describe their preferred model as safer and more convenient. Both also gain strategic value by owning the customer’s final decision point.

Amazon is building agents of its own. Its Buy for Me feature can purchase products from external brand sites when Amazon does not sell the item. Amazon says that system identifies itself and lets brands opt out. The comparison supports Amazon’s demand for disclosure, but it also highlights the competitive asymmetry: Amazon wants permission to send its agent into outside stores while retaining the right to keep rival agents away from Amazon.

Meta has its own distribution advantage. Muse is available through a dedicated app and WhatsApp, and Meta can introduce agent features across services people already use to talk, plan and discuss purchases. TECHi’s earlier look at Meta AI’s email and calendar permissions showed how quickly usefulness becomes tied to account access. Shopping adds money, order history and merchant rules to that same permissions problem.

The legal backdrop does not settle the product question

Amazon’s notice relies on its conditions of use rather than accusing Muse users of hacking. That wording follows a legal battle with Perplexity over another AI shopping agent.

In an August 4 opinion, the US Court of Appeals for the Ninth Circuit reversed an injunction that had restricted Perplexity’s shopping activity under the federal Computer Fraud and Abuse Act. The decision focused on who was accessing Amazon’s computers when a user directed the agent. It did not establish a universal right for every AI agent to shop on every website, and it left contract-based arguments in play.

That leaves companies with a practical contest while the law develops. Merchants can change terms, add technical blocks, create approved agent programs or negotiate bilateral access. Agent developers can identify their software, use merchant APIs, challenge restrictions or design flows that keep the user more visibly in control.

The cleanest solution would be a common protocol that tells a merchant who the agent represents, what permission it has, what data it needs and which action the user has approved. Payment networks and browser standards solved earlier versions of this coordination problem by defining shared rules. Agentic commerce still lacks an equivalent layer with broad adoption.

Without that layer, every transaction can become a private negotiation between an agent maker and a retailer. That favors the largest platforms, which have the engineering capacity and leverage to strike deals. It also makes “open web” claims fragile: an agent may work across many small sites and then fail at the services consumers use most.

Meta needs to show that Muse can identify itself to merchants without losing the flexibility that comes from using a normal browser. It also needs to make the chain of consent legible: what the user authorized, what Muse attempted, what Sentinel approved and what information the merchant received.

Amazon needs to explain the conditions under which an outside agent can participate. A blanket block may protect accounts in the short term, but an opaque or selectively enforced process would look like a defense of Amazon’s own shopping funnel. Clear technical requirements and an opt-in path would make the security case more credible.

For consumers, the useful question is narrower than which company wins. Before allowing any agent to shop, check whether it can place an order or only prepare one, whether it stores login credentials, how it handles returns and substitutions, and what record it provides after acting. The final approval screen matters, but so does everything the agent did before it asked.

For investors, the story is an early test of product strategy rather than evidence of an immediate financial change. Meta has demonstrated that it can attract users to a task-oriented agent. Amazon has demonstrated that a powerful destination can deny that agent access. Watch for a negotiated agreement, a merchant-identification standard, changes to Muse’s browser behavior, or an expansion of Amazon’s approved-agent program. Those developments will say more about the economics of agentic commerce than an app-store ranking alone.

The March shopping assistant promised a new way to find products. Muse now promises to complete the work. Amazon’s block shows the missing piece: an AI agent needs consent from its user, but on a commercial platform it may also need a recognized identity and permission from the service it enters.