In the week beginning September 20, Amazon started blocking Meta’s Muse assistant from its retail site, serving it a notice that continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which its customers have agreed.
Read that sentence again, because of who it is aimed at. Amazon is not asserting a right against Meta. It is asserting a right against its own shopper. That is a retreat to weaker ground, and Amazon retreated there because on August 4 the Ninth Circuit took the stronger ground away.
Meta launched Muse on September 8 in the United States and Canada, with autonomous email drafting, travel booking and purchasing, and 100 million free tokens a week. It reached the top of the US iOS free chart with roughly 730,000 downloads in five days. Bloomberg reported the block on September 21, and GeekWire laid out the technical and legal background. Amazon says Muse browses without identifying itself and captures and stores customer credentials. Meta says Muse has no visibility into passwords or payment methods and that credentials go into secure storage, where Muse can use them without seeing them. The underlying agreements are not public, so the credential dispute is two press statements rather than a settled fact.
The instrument changed in August
Amazon won a preliminary injunction against Perplexity’s Comet browser in March 2026 on the theory that an AI agent shopping on a user’s behalf is unauthorized access to Amazon’s computers. On August 4 the Ninth Circuit reversed, holding that under anti-hacking law the person doing the accessing is the user, not the company that built the agent. Amazon petitioned for rehearing and was denied on September 10. Ten days later it blocked Muse.
That sequence is the story. With a computer fraud claim, Amazon could sue the agent vendor, get an injunction, and set a precedent that binds everyone building in the category. Without one, its cause of action runs through a contract with the shopper, and the remedy for a shopper in breach is to close the shopper’s account. Amazon will not close the accounts of several hundred thousand people for using a popular Meta app, and everyone involved knows it.
What is left is technical blocking: fingerprint the traffic, serve the notice, wait for the other side to adapt. Amazon is very good at this and still has to win it again every week, against a counterparty with Meta’s engineering budget, on a site whose entire commercial purpose is to be easy for software to read.
The dispute is about who gets to be the customer
The credential argument looks like a security disagreement and mostly is not. Both statements can be accurate at once. Meta can hold credentials in a vault that its models never see, and Amazon can still be looking at a session it cannot attribute to a human being. What Meta holds either way is the ability to act as the shopper, and once a third party holds that, Amazon’s relationship with its own buyer runs through a company that sells advertising against the same attention.
Amazon made more than $68 billion in advertising revenue last year, close to a tenth of total revenue, and Forbes put that number next to the block on September 23. Sponsored placement is sold on the premise that a person scrolls a results page and forms a preference. An agent that queries, filters on price and delivery date, and returns one answer does not scroll, does not form preferences and cannot be influenced by a promoted tile. The advertising business does not degrade gracefully as agent share rises. It degrades in proportion.
Which makes the commercial relationship strange to look at. Amazon and Meta have run shopping integrations together since 2023, and Meta signed a multibillion-dollar deal in April to buy Amazon’s Graviton chips. Amazon is blocking a customer it also sells server capacity to.
Where this ends up
The binding constraint on agentic commerce is permission from the counterparty, and after August 4 that permission cannot be compelled through the courts and cannot be criminalized. Capability is not the limiting factor and has not been for a while. Muse can complete a purchase. The open question is whether the merchant on the other side accepts it, and that question now has only one kind of answer, which is a negotiated one.
Negotiated access has a price. Every platform that has been through this before, with screen scrapers, with aggregators, with search crawlers, ended in the same place: an authenticated channel, identification requirements, rate limits, and a commercial term that replaces the revenue the unauthenticated traffic was eroding. Amazon is better positioned to sell that product than anyone else. It has the catalog, the fulfillment network, the payment relationship and a decade of experience pricing access to its own demand.
The falsifiable version, with a date attached. By September 2027, Amazon will offer a registered third-party agent channel with mandatory agent identification and a commercial term, and Meta will either be on it or will have signed an equivalent bilateral deal. If Amazon is still running this on traffic fingerprinting and a Conditions of Use notice twelve months from now, I am wrong, and blocking is a more durable strategy than I believe it to be.
If you are building agents that transact against sites you do not own, the planning assumption follows from the same reasoning. Unauthenticated agent access to major commerce platforms is a window that closes on commercial terms rather than legal ones. Build for the day you have to identify yourself and pay, because the alternative you are relying on is a blocking war you are not a party to.
Amazon argued for a year that agents were breaking in. It lost that argument in August, which means the only question left is what it charges them at the door.
If you are working through an AI initiative and want a second technical opinion, or you want to talk through any of this, connect with me on LinkedIn or see the production side at coreagenticgroup.com.
