Amazon blocked Meta's Muse personal AI agent from browsing and purchasing on Amazon.com, with a popup message appearing on September 21 telling users that "continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed"1,2,12.
The block followed Meta's refusal to voluntarily exclude Amazon from Muse's reach. Amazon told GeekWire it had asked Meta to pull back, but Meta did not comply6. Amazon cited three objections: Meta never notified Amazon that Muse would access its store, the agent does not identify itself while browsing, and it appears to capture and store customer credentials7.
How Muse reaches the web
Muse, which launched on September 8, runs on a dedicated virtual machine Meta calls Muse Secure VM9. It connects to services two ways: built-in connectors for partners such as Gmail and OpenTable, and an ordinary browser session for everything else. Shopping on Amazon.com used the browser-session path, which from Amazon's servers looks like a signed-in customer "with unusually fast reflexes" moving through search, product pages, account history, and checkout without declaring what it is.
Muse is powered by Meta's large language model Muse Spark and can delegate tasks including filling out forms, organizing email inboxes, booking travel, turning recipes into grocery lists, and making purchases5. Meta offers monthly subscriptions at $20 or $100 depending on usage.
Adoption has been rapid. Sensor Tower estimated more than 2.6 million downloads since debut, with 1.5 million on iOS and 1.1 million on Android. As of Monday, Muse ranked as the No. 1 free app on the U.S. versions of Apple's App Store and Google Play Store. Meta's stock surged more than 11% to $741, its highest closing price in a year.
A category-wide problem
The dispute extends beyond two companies. Grok Bot from xAI and the open-source OpenClaw project, on which Muse is modeled, also drive signed-in browser sessions in the same manner Amazon objects to. Amazon has previously taken similar action against Google and OpenAI's shopping bots, and its blocking of Perplexity's agent led to a lawsuit with proceedings still underway.
An IETF draft called Web Bot Auth would let agents sign requests with a private key and publish the matching public key at a well-known directory, giving sites a way to verify the operator behind an agent. AWS WAF Bot Control added support for such signatures for CloudFront distributions in November 2025.
Shopify moves in the opposite direction
While Amazon shut the door, Shopify opened one. Shopify announced on September 21 that it is partnering with Muse to allow agentic checkout with Shop Pay across Shopify stores. Under that arrangement, Muse reads structured product data and completes payment through a declared path, with each purchase drawing a single-use credential so the card number never reaches Muse.
Security concerns compound the picture
Separately, a security researcher publicly disclosed a zero-day vulnerability in Muse that could allow malware to hijack the agent and access user data. Meta had spent months building Muse's security architecture, including the Secure VM and a Sentinel approval process, and rolled out a bug bounty program offering up to $300,000 for reported vulnerabilities. The disclosure followed an earlier incident in which Muse's predecessor, Muse Spark 1.1, accidentally exploited a real website vulnerability during a closed evaluation by cybersecurity firm Irregular.
ANALYSIS The Amazon block and the Shopify partnership illustrate two diverging models for agentic commerce: one where the platform demands agents identify themselves and obtain consent before transacting, and another where the merchant provides a structured, credentialed checkout path. Andy Jassy has indicated that Amazon is in talks with other firms wanting to run agents for commerce, leaving open whether Amazon's stance is a permanent exclusion or a negotiating position.