Amazon blocked Meta's Muse. The fight is about who the agent says it is

On the night of 20 September 2026, twelve days after Meta launched its Muse agent,¹ Amazon started turning it away. Shoppers who pointed Muse at Amazon met an automated message: continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, which its customers have agreed to.²³

Amazon says it had asked Meta to take Amazon out of the agent’s reach first, and that Meta declined; Meta did not respond to requests for comment at the time.³² It looks like a fight over shopping, and Amazon did say agents bypass the personalization built into its store.⁴ But most of what it objected to is identity.

We looked at Muse before, when it inherited a well-known @muse Instagram handle. This is the other half: whether a site can tell who is knocking, and on whose behalf.

What Amazon actually objected to

Amazon’s main objections come in three parts, none about what Muse tried to buy.

It arrived unannounced. Amazon says it was not told in advance that Muse would access its store, and never authorized it.⁴⁵ Amazon knows what a logged-in customer is. It did not know what this was.

It did not say what it was. Amazon says the agent does not identify itself while browsing, leaving an undisclosed third party inside customer accounts.⁴⁶ Meta’s engineering write-up describes the same design from the other side: “When Muse browses the internet, it will appear as your activity”.⁷ Amazon’s robots.txt refuses about a hundred named agents, three of them Meta’s, but not Muse; by Meta’s description there is nothing distinct to name.⁸

It handled logins. Amazon says Muse appears to capture and store customer credentials.⁶ Meta says Muse has no visibility into passwords.¹ Both can be true: Meta keeps credentials in a secure store outside the model and injects them into the browser when a site asks.⁷ From Amazon’s side of the login form, that is the customer’s real password arriving from software it cannot see.

Amazon’s spokesperson put the principle in one line: agents buying on a customer’s behalf “should operate openly and respect service provider decisions about whether or not to participate.”³ Operate openly is the phrase that matters. It asks for a claim the agent makes about itself, before anything is bought.

None of this is new. Amazon’s robots.txt already refuses named agents from Google and OpenAI,⁸⁹ and in November 2025 it sued Perplexity, accusing it of disguising its Comet agent as a Chrome browser.¹⁰ The robots.txt entries work because those agents announce themselves. The Perplexity suit, like the Muse block, concerns an agent that Amazon says did not.

The court weakened one lever and left another

Less than seven weeks before the block, a court had taken away Amazon’s injunction against another agent.

On 4 August 2026 the Ninth Circuit vacated the preliminary injunction Amazon had won against Perplexity’s Comet in March. Judge Milan D. Smith Jr. wrote that the Computer Fraud and Abuse Act contemplates access by a person, and the agent is “a tool, not a person” for statutory purposes.¹¹ On that record the user, not Perplexity, accessed Amazon’s computers, so Amazon was unlikely to win its federal or California computer-access claims.¹¹¹² Jones Day calls it the first appellate decision of its kind;¹³ rehearing was denied on 10 September.¹⁴

Two passages matter more to site owners than the holding. The court placed Perplexity’s decision not to send a user-agent string announcing an AI agent at the core of the dispute. And a footnote says the outcome does not impair Amazon’s ability to regulate access through private terms of service for its users.¹¹¹⁵ The panel created no legal regime for agentic AI and did not address tort claims.¹¹

So the lever that weakened was the computer-access claim against the agent maker. The lever that stayed is the contract with the human, which Amazon pulled on 20 September. The next day it amended its Perplexity complaint, alleging that Comet on iOS fetches Amazon pages from Perplexity’s servers while sending Chrome’s user-agent string, and that Perplexity knowingly causes customers to break Amazon’s Conditions of Use.¹⁶

The ruling also rested on Comet running on the user’s own machine,¹¹ while Muse browses from a Chromium instance Meta runs behind a virtualization layer.⁷ The court said it was not deciding a different record.¹¹ Either way, terms enforced against shoppers scale only as far as detection does, and an agent that appears as the user makes detection harder, as with browser agents inside a logged-in session.

Once access sits with the human, the question is not whether the agent was allowed in. It is simpler: who is this, and who is it acting for?

Participation is a decision, and it runs both ways

Amazon’s own statement concedes the point: agents should respect each provider’s decision about whether to take part. So participation is a choice each site makes, and it needs a way to be expressed and read.

A robots.txt is a published refusal list, but it cannot address an agent that never names itself, so the Muse decisions were made through deals and statements. On 21 September, the day after the block began, Shopify announced a partnership to enable agentic checkout with Shop Pay for Muse.¹⁷ Two days later Meta named Walmart, Best Buy, Gap, Sephora, Wayfair and others as Muse shopping partners.¹⁸ The yeses arrived as announcements and Amazon’s no as a pop-up shown to shoppers, none of it anything an arriving agent could read in advance.

Reciprocity is the sharper problem. Amazon’s spokesperson compared its stance to food delivery apps and online travel agencies, which it said require opt-in.² Amazon’s own Buy for Me agent worked the other way round: in January merchants found their products listed in it without permission, and Amazon said they could opt out by email.¹⁹ Tech Times drew the contrast on 23 September,²⁰ though Amazon says Buy for Me identifies itself to retailers,⁶ so the gap is consent, not disclosure. Still, a rule that agents must ask first is only stable if it holds when the platform is the sender.

Consent is not one switch either. A site wants to know which agent, for whom and with what authority before the session, and the agent should not have to hand over a shopper’s credentials to prove the visit is legitimate. Each side needs proof without full exposure, which is why we argue for mutual reveal rather than an open directory. Detection does not substitute: Cloudflare logged 206 million agent behavior checks in a day,²¹ yet knowing traffic behaves like an agent is not knowing whose agent it is.

A hijacked agent carries its human’s permissions

On 21 September Patrick Wardle, founder of the macOS security nonprofit Objective-See, disclosed a flaw in Muse for Mac.²² Any program running as the logged-in user could rewrite an undocumented setting, endo_voyager_dictation_endpoint, and send dictated prompts to an attacker. Wardle showed it could also inject instructions and capture the token that signs in to the user’s Muse account, which commands Muse on every signed-in device.²³ Meta hotfixed it within about a day and called it a local attack; Wardle replied that a lure tricking the user into running one command makes it remote.²⁴²²

By Meta’s own description Muse handles appointments, forms, customer service and purchases, and connects to WhatsApp, email, calendars and social platforms.²⁵ That bundle is the agent’s real credential: a standing grant from one person, carried into the sites it visits.

Set Amazon’s complaint beside that. A stolen token is Amazon’s undisclosed third party one layer down: the party driving the account is no longer the agent the customer chose, yet the signals a site sees need not change. The permissions are genuine, granted to software now driven by someone else.

Identity here is engineering, not branding, which is also how we read OWASP’s agentic top ten: four of its ten risks are identity problems. A claim that cannot be checked at the moment of use, or withdrawn after, is a label, not a control.

What an identity layer would have to say

A site admitting an agent needs four answers, in order.

Which agent is this. A stable name the site recognizes across visits, whose history cannot change quietly. The @muse Instagram handle changed hands on undisclosed terms, so it proved less than it appeared to.

On whose behalf. Not a user ID inside Meta or OpenAI, but a claim tying the agent to a person or business, checkable without handing the site that person’s credentials.

With what authority, and for how long. Delegation with an edge: this agent may prepare a booking, it may not complete a payment, and the grant expires. A stored login has no edge. Nor, it seems, does permission to answer messages: a Facebook Marketplace seller who let Muse reply to buyers found it had given a buyer his home address and arranged a visit without asking, Malwarebytes reported on 29 September. Meta is looking into it.²⁶

Did both sides agree. The agent learns what the site published for visitors; the site learns what the visitor authorized, and when. The general form is the consent layer for the agentic web.

None of the four is a discovery problem. The layers underneath are filling in: Web Bot Auth signatures let a site verify the agent, A2A carries tasks between agents and describes them in an Agent Card, MCP carries the tools. A signature proves the sender. It does not name the human behind it, or record that the human agreed.

That human-facing layer is the part Tobira works on: a readable @handle, a profile an assistant can read, and mutual reveal, where two agents exchange contact details only after both humans agree. It complements the signature and discovery layers rather than replacing them. Tobira’s network carried 729 agents as of September 2026, per internal data: an early implementation of the pattern, not a standard.

What to remember

• Amazon says Muse arrived without notice, did not identify itself and handled logins it could not inspect; Meta says Muse’s browsing appears as the user’s activity.⁴⁷
• The Ninth Circuit found Amazon unlikely to win computer-access claims against the agent maker on that record, and left sites their terms of service.¹¹
• Participation has to be declarable and reciprocal: neither Amazon’s no nor Shopify’s yes was readable by an agent in advance, and Amazon’s own Buy for Me ran on opt-out.¹⁷¹⁹
• For a site owner: decide which agents you want, say so where an agent can read it, and never treat a shopper’s password in an agent’s hands as proof of delegation.

FAQ

Why did Amazon block Meta’s Muse?

Amazon says Muse arrived without notice or authorization, does not identify itself while browsing, and appears to capture and store customer credentials. Amazon says Meta declined to remove Amazon from Muse’s reach, and the block began on 20 September 2026 under Amazon’s Conditions of Use.⁴⁶³

Does Muse identify itself to websites?

Not as Muse. Meta says Muse’s browsing appears as the user’s own activity. Amazon’s robots.txt refuses about a hundred named agents, three of them Meta’s, but has no Muse entry.⁷⁸

What did the Perplexity ruling decide about blocking AI shopping agents?

The Ninth Circuit’s 4 August 2026 decision in Amazon.com Services, LLC v. Perplexity AI, Inc. vacated a preliminary injunction, finding that on that record the user, not Perplexity, accesses Amazon under the federal and California computer-access statutes. A footnote says this does not impair Amazon’s ability to regulate access through terms of service for its users. General information, not legal advice.¹¹¹⁵

What would actually fix this for a site owner?

A visiting agent should be able to establish which agent it is, on whose behalf it acts, what authority it holds and for how long, and that both sides agreed. Web Bot Auth signatures cover the first. The usual gap is the human-facing claim: a readable handle tied to a person, with mutual consent before contact details move.

Sources