On September 21, The Verge and GeekWire reported that Amazon has cut off Meta's personal AI agent Muse from shopping on its behalf on Amazon's website. Since Sunday evening local time, users who try to have Muse place orders on Amazon see a warning: "continued access by an unauthorized AI agent violates Amazon's Conditions of Use."
Why Amazon acted
Amazon's objections center on three points: Meta never told Amazon in advance that Muse would access its store; Muse does not identify itself as an agent while browsing; and Muse appears to collect and store user account credentials, which Amazon sees as a privacy and security risk. An Amazon spokesperson said: "If a third-party app shops on behalf of consumers at other merchants, it should operate transparently and respect the service provider's decision about whether to participate."
Amazon had previously asked Meta to voluntarily remove its site from Muse's available services, and moved to block it directly after talks went nowhere. The two sides are now in direct communication, though Amazon declined to comment on whether it will take legal action.
Meta's response: we can't see your credentials
Meta's answer: Muse cannot see users' passwords or payment information; credentials land in a secure vault that the agent can use but never read; payments go through Stripe's Link checkout service, which issues one-time card numbers for a single merchant and amount; Muse runs inside an isolated secure virtual machine, confirms with the user before sensitive actions, and a separate monitoring agent called Sentinel reviews every outbound network request.
The real core of the dispute is product design. Muse, which Meta launched on September 8 (/article/1973-meta-released-museai-personal-ai-assistant-integrating-browser-apps-and-backgrou), is positioned as a personal agent carrying out multi-step tasks across email, calendar, payments, dining, and shopping. Its design: where an online service offers a public API, connect with user credentials; where there is no API, the agent "uses the service through the browser, just like a person would." What Amazon blocked is exactly that second path — an undisclosed third party operating inside user accounts, processing transactions and touching sensitive data, without the platform's knowledge or permission.
Background: not Amazon's first move
Muse topped the US Apple App Store free chart within a week of launch, overtaking ChatGPT. Meanwhile Amazon has spent the past year keeping outside AI agents at bay: it sued over Perplexity's Comet browser, won a preliminary injunction in March, but saw it overturned on August 4 by the US Ninth Circuit — which held that under the federal anti-hacking law, the party accessing Amazon's systems is the user, not the AI company; on September 10 the rehearing request was denied too. The ruling left Amazon one path open: enforcing its contracts and terms of service. The current pop-up accuses nobody of hacking and cites the Conditions of Use directly — the battlefield has shifted to the question of platform authorization.
The relationship between the two companies adds irony: since 2023, users have been able to buy Amazon products directly inside Facebook and Instagram; and this April, Meta signed a multi-billion-dollar deal to run its agentic AI workloads on Amazon's cloud. Partnerships aside, the storefront gate is a separate matter.
What this means
Agentic commerce is moving from product demos into a platform-governance standoff. A user authorizing an agent to act for them is not the same as the platform authorizing that agent to enter accounts and checkout flows — that is the line Amazon has drawn.
The commercial stakes are just as real: Amazon's 2025 ad revenue topped $68 billion and depends on users actively browsing pages and viewing sponsored products. If agents take over search, price comparison, and checkout, users may never visit Amazon's pages at all, shaking the foundation of ads and recommendations. At the same time, Amazon is building its own Alexa for Shopping "Buy for Me," launched in May — the more capable outside agents become, the more incentive the platform has to keep transactions inside its own walled garden.
For developers, the practical takeaway: building a shopping agent is not just about whether it can click the buy button. It also depends on whether the target service offers an official API, whether it requires agents to identify themselves, and whether there is a fallback to human checkout when blocked. The industry is splitting: Google pushes a universal commerce protocol, OpenAI and Stripe build an agentic commerce protocol, while Amazon chooses to build walls first. In the short term, agent-driven shopping will increasingly live or die by platform permission.
