Agentic Commerce Fight: Amazon Blocks Meta’s Muse

Amazon confirmed Sunday night that it has shut Meta’s Muse assistant out of shopping on Amazon.com, twelve days after the agent launched. The company says it asked Meta to exclude the retail site voluntarily and got nowhere. Shoppers using Muse now hit a popup instead of a checkout.

The dispute is narrow on its face and wide underneath. Agentic commerce only works if an AI agent may transact on a merchant’s site, and this fight decides who grants that permission. Every founder selling online has a stake in the answer.

What Amazon Did and Why It Matters for Agentic Commerce

Amazon raised three objections. Nobody at Meta warned the retailer that Muse would reach into its catalog. The agent stays anonymous as it moves through pages. And Amazon believes it holds onto shoppers’ login details after using them.

The blocking notice leans on contract language rather than anything stronger. Shoppers now see a message telling them an “unauthorized AI agent” breaches the terms they accepted. An Amazon spokesperson put the underlying principle plainly, saying software that buys from other businesses for a customer ought to announce what it is and honor a retailer’s choice about taking part.

Meta had not responded publicly as of Sunday night. Amazon said it is talking with Meta directly and declined to say whether it would sue.

The Credential Question at the Center

Meta’s own description puts Muse inside a locked-down virtual machine with a browser of its own. On the security question, Meta has said the agent cannot see a person’s passwords or card details at all. Anything a user hands over lands in protected storage, which the agent draws on without ever viewing the contents.

Before any consequential step, such as firing off an email or pushing a payment through, Muse stops and asks. A second system called Sentinel watches over it, and nothing leaves for the open web until Sentinel signs off.

Amazon’s concern is about disclosure rather than encryption. Because the agent never announces itself, Amazon argues that an unnamed outsider is walking through people’s accounts, pushing payments and reading purchase histories with no notice to the retailer. Merchants weighing their own exposure should treat this as a vendor risk management problem, not just a platform squabble.

Why the Ninth Circuit Ruling Still Matters

This is not Amazon’s first attempt to fence off its catalog. Over the past twelve months the retailer has pushed back on automated buyers from several directions, suing Perplexity over its Comet product, then acting to shut out comparable tools from Google and OpenAI.

The legal record cuts both ways. An early injunction in the Perplexity case went Amazon’s way in March. It did not survive the appeal. On August 4 the Ninth Circuit decided the person issuing the instruction, rather than the company supplying the agent, counts as the party reaching Amazon’s systems under federal anti-hacking law. A rehearing request failed on September 10.

That ruling closed one door and left another open. Claims grounded in contracts and terms of service survive, which explains why the Muse popup points at Amazon’s Conditions of Use and says nothing about hacking.

What This Means for Merchants and App Builders

Two groups should pay attention. If you sell through your own storefront, agents will eventually arrive at your checkout, and you need a position before they do. Decide now whether you want that traffic, and write the answer into your terms.

If you build software that acts for users, the operating lesson is disclosure. Amazon held up restaurant delivery apps and travel booking sites as the right model, since both purchase for a customer under an agreement the merchant signed. The retailer notes that its own Buy for Me tool declares what it is and gives brands a way out.

Sellers using cross-border structures face an extra layer, since the party of record on a transaction shapes liability. Teams already thinking about merchant of record arrangements will recognize the pattern.

Signals Worth Tracking Next Quarter

Watch the money first. Advertising brought Amazon north of $68 billion last year, and every dollar of it assumes a human is scrolling product pages and noticing sponsored slots. Agents skip that scrolling entirely. That threat explains the speed of this response better than any security concern does.

Watch the relationship second. These two companies are deeply tied together already, with Amazon listings sellable through Meta’s social apps going back to 2023 and a cloud agreement worth billions signed in April to host Meta’s agentic workloads. Partners this intertwined usually settle at a table rather than in a courtroom.

Watch adoption third. Meta shipped Muse on September 8 to handle errands that take several steps instead of answering single questions, wiring it into inboxes, calendars, payment methods, restaurant bookings and retail. The app costs nothing to start, runs on phones, the web and WhatsApp, and it topped Apple’s free chart in the United States inside seven days, beating ChatGPT.

Finally, watch how the ad platforms respond. Automated buying changes what a campaign is bidding for, and advertisers already adjusting to the Google Ads AI Max shift should expect more of the same.

Back in May the retailer put its own research-and-recommend assistant into Alexa, so it clearly has no objection to agents as a category. It objects to agents nobody cleared with it first. For founders the takeaway is short: decide who may buy from you, then put it in writing before somebody decides on your behalf.