Why Amazon Blocked Muse: The Agent Identity Fight Explained

Last updated: October 14, 2026

Twelve days after Meta launched its Muse personal AI agent, Amazon locked it out. Anyone who sent Muse to buy something on Amazon.com started seeing a pop-up: continued access by an unauthorised AI agent violates Amazon’s Conditions of Use. What followed is the clearest example yet of the problem no one building AI agents has solved: when an agent acts on your behalf across the web, the websites it needs have to let it in — and they don’t necessarily have to. As Liz Hughes wrote in TechTarget on 9 October 2026, Meta is already discovering that the systems an agent needs to use “don’t necessarily have to let it in”.

Quick answer: Amazon blocked Meta's Muse agent on 20 Sept 2026 over agent identity. What Amazon claims, what Meta says, and what it means when you send Muse shopping.

What happened between Amazon and Muse?

Meta launched Muse, its personal AI agent, on 8 September 2026 in the US. The agent runs a real Chrome browser in the cloud and can browse products, complete purchases, book travel and manage schedules on a user’s behalf. It became the top free iPhone app in the US within a week of launch, according to GeekWire reporting cited by tech-insider.org.

On the night of Sunday, 20 September 2026 — roughly 12 days after launch — Amazon began blocking Muse from completing purchases on Amazon.com. Shoppers who sent Muse to buy something saw a pop-up warning that continued access by an unauthorised AI agent violates Amazon’s Conditions of Use. Amazon says it first asked Meta to voluntarily remove Amazon.com from the Muse shopping experience; Meta declined. On 21 September, Meta pushed back narrowly, saying Muse provides a complete audit trail of its actions — but the company has not issued a detailed public statement explaining why it declined Amazon’s request, according to reporting summarised by tech-insider.org.

Neither company has published its own announcement about the block. Twenty-two days on, as Forkast’s analysis put it, a Terms of Use clause is doing the adjudicating — “an identity adjudication with nothing verifiable underneath”.

Why Amazon says it blocked Muse: three claims

Amazon’s stated objections are specific. Here’s each one, beside Meta’s response — and a note on who could actually verify it.

Amazon’s claim Meta’s response Can anyone check?
Meta never told Amazon that Muse would access its store or arranged access in advance. Amazon says third-party apps making purchases for customers should “operate openly and respect a service provider’s decision on whether to participate” — the way food-delivery apps and travel agencies coordinate with merchants (Amazon spokesperson Lara Hendrickson, via GeekWire). No detailed public response to this point. Only the two companies know what was discussed.
Muse does not identify itself as an automated agent while browsing. An undisclosed third party is therefore moving through customer accounts, in Amazon’s framing. Meta says Muse provides a complete audit trail of its actions (Sept 21 statement). Meta has not explained its broader approach to agent identification publicly. Independent security firms can observe behaviour — see Cequence below.
Muse appears to capture and store customer login credentials, with access to order history and account pages when a user asks — a privacy and security risk (Amazon, via WSJ). Meta says Muse has no visibility into passwords or payment methods; credentials go into secure storage the agent can use without reading, the agent runs in a dedicated virtual machine, and it asks for permission before purchases (Meta spokesman, via WSJ; Muse generates a one-time card number per transaction). No outside party can verify either claim. This is the crux of the Forkast “nothing verifiable” point.

Two things are worth separating here. First, this is a dispute about agent identity and access, not about whether the underlying shopping task is legal: after the Ninth Circuit ruled in August 2026 that the customer — not Perplexity — was the party accessing Amazon’s computers, Amazon’s move has shifted toward contracts and terms of service rather than anti-hacking law, as tipsheet.ai noted.

How Muse moves through the web unnoticed

Amazon’s middle claim — that Muse doesn’t identify itself — is the one independent researchers have actually tested. Cequence Security published findings on 8 October 2026, based on traffic analysis across its customers in financial services, retail, travel and software from 1 to 24 September:

Cequence’s finding is reported fact (PR Newswire, 8 October 2026); it also happens to be the product launch vehicle for Cequence’s “Agent Trust” service, which verifies agents that present an identity and flags those that don’t — so read the vendor’s framing with that in mind.

It’s not just Amazon: who lets agents in, and who locks the door

The WSJ’s October 2026 reporting on agentic shopping shows Amazon is one end of a spectrum, not an outlier:

Retailer Stance on shopping agents
Amazon Blocked Muse (and agents from OpenAI, Google, Anthropic and Perplexity, per Billions Network research). Four conditions for any outside agent: operate transparently, allow opt-out, offer mutual value exchange, improve the customer experience.
Shopify Took the opposite approach: partnered with Meta so Muse purchases can go through Shop Pay (TechTarget, 9 Oct 2026).
eBay Barred agents — including shopping agents — from accessing or acting on its platform without express permission, in January 2026 (WSJ).
Kohl’s Prevents agentic purchases (WSJ).
Tapestry (Coach, Kate Spade) Allows agents to browse but not complete purchases, citing fraud and “inventory hoarding” concerns — while optimising systems to allow agents at checkout later (WSJ).
Chewy, Neiman Marcus Block certain agents, per Billions Network (WSJ).

Notice the pattern: nobody objects to agents browsing. The fight is over agents transacting — completing purchases, holding inventory, moving money. And underneath the stated reasons, there’s an economic one: Amazon earned more than $68 billion in advertising revenue last year from shoppers browsing its pages, per the WSJ piece, and an agent can move from request to purchase without showing a single sponsored listing. tipsheet.ai makes the same point: the dispute may be “less about matching on model quality than about commercial terms”.

Why agents can’t just announce themselves

The obvious fix — have the agent say “I’m an AI acting on this customer’s behalf” — doesn’t exist as a universal standard yet. Cequence’s Agent Trust is one vendor’s answer: verify agents that present an identity, catch the ones that don’t. Another is in the works: Meta and Sierra’s Personal Agent Protocol (codenamed Poppy), an agent sign-in standard we covered earlier this month — the industry’s attempt to give agents verifiable identity across the web. Read our explainer on Meta Muse’s privacy dossiers for the other half of the identity problem: what the agent remembers about you and everyone you mention.

Until a standard sticks, every agent-retailer pair is a bilateral negotiation — which is exactly what the Amazon-Muse fight is: a negotiation conducted through a pop-up.

What this means the next time you send Muse shopping

Practical takeaways, based only on what’s been reported and confirmed:

  1. Expect some sites to refuse. If Muse suddenly can’t complete a task on a big retailer, it may be a block like Amazon’s, not a bug. Check the site’s agent policy before assuming the assistant failed.
  2. Prefer partnered integrations. Where Meta has arranged access — like Shopify’s Shop Pay partnership — the agent acts with the merchant’s knowledge. That’s the arrangement Amazon says Muse skipped.
  3. Check the audit trail. Meta’s main public defence is that Muse provides a complete audit trail. Use it: verify what the agent clicked, what it entered, and what it bought.
  4. Approve before it pays. Meta says Muse asks permission before purchases and generates a one-time card number per transaction. Keep that approval step on — never let an agent buy on standing authority.
  5. Treat credential claims as unverified on both sides. Amazon says Muse captures and stores customer logins; Meta says it can’t see them. No outsider can check. Minimise what you hand any agent: use guest checkout or virtual cards where you can.

The bigger picture: access is the new gate

The Amazon–Muse standoff is best read as the opening round of a longer fight over agent access, not a one-off spat. The technology to act on your behalf works — Cequence’s data shows Muse reaching half of studied enterprises in two weeks. The unresolved part is commercial and contractual: who gets to act inside whose storefront, on what terms, and identified how.

Three things to watch: whether Meta publishes the fuller safety report it has promised (pending since the Muse Wonder launch); whether agent-identity standards like Poppy get real retailer adoption; and whether Amazon’s four conditions — transparency, opt-out, value exchange, better customer experience — become the template other retailers copy. If they do, the agent era won’t be decided by which model is smartest, but by which agent gets let through the door.

Frequently asked questions

Can I still use Muse to shop on Amazon?

No. Amazon blocked Muse from completing purchases on Amazon.com on 20 September 2026. Users who try see a pop-up saying continued access by an unauthorised AI agent violates Amazon’s Conditions of Use. Amazon says it asked Meta to remove Amazon from the Muse experience first; Meta declined.

Can Muse shop on other websites?

It depends on the retailer. Shopify partnered with Meta to support Muse purchases through Shop Pay. But Amazon also blocks shopping agents from OpenAI, Google, Anthropic and Perplexity; eBay barred agents without express permission in January 2026; Kohl’s prevents agentic purchases; Tapestry lets agents browse but not buy. Check before you delegate.

Does Muse store my passwords?

Amazon claims Muse appears to capture and store customer login credentials. Meta denies it, saying Muse has no visibility into passwords or payment methods and that credentials go into secure storage the agent can use without reading. No independent party has verified either claim — treat both as claims, not facts.

Why don’t retailers just welcome shopping agents?

Some do — Shopify sees agents as future customers. Others cite fraud, inventory hoarding (bots filling carts without buying), loss of ad revenue, and the lack of a standard way for an agent to identify itself. Tapestry calls preparing for agents a “no-regret investment” even while blocking purchases today.

What is Cequence Agent Trust?

A security capability launched 8 October 2026 that verifies AI agents which present an identity and flags traffic from agents that don’t. Cequence built it after finding Muse traffic at more than half of its studied customers without those businesses knowing — detected through behavioural analysis, not self-identification.

Sources and methodology

Claims in this article rest on: Liz Hughes, TechTarget, “Prompt: AI agents are running into the limits of access” (9 Oct 2026); Cequence Security PR Newswire release via Channel News Asia (8 Oct 2026); Forkast analysis of the Amazon–Muse dispute (Oct 2026); and WSJ reporting on retailers’ agentic-shopping stances (Oct 2026). Quotations are brief excerpts attributed to their publications. Meta and Amazon positions are as reported by these outlets; where neither company’s claim is independently verifiable, the article says so. Verification date: 14 October 2026. This piece was desk-researched from published reporting — no hands-on testing of Muse or Amazon’s block was performed.

Have a burning question about this topic?
Feel free to email us at contact@openaimaster.ai — we are happy to help!