Amazon shuts Meta's Muse agent out by holding shoppers to its Conditions of Use

Muse runs each agent in what Meta calls "Muse Secure VM", a dedicated cloud virtual machine with its own browser ^[16]. Where a service has no API, Meta's launch post says, "the agent can use the service through a browser the way you would." ^[17] Amazon has no shopping API for outside agents, so on Amazon, Muse clicks ^[18].

Amazon answered inside that browser session, with two layers and no lawsuit ^[3]. The popup ends its sentence with "to which our customers have agreed" ^[2]. Behind it sits an anti-bot wall. The Register tested it on Monday by asking Muse to find "the best-reviewed ergonomic office chair" and add it to the cart ^[4]. Muse reported that Amazon "is showing an anti-bot wall that blocks automated browsers outright" and that "the browser couldn't even get to the search page" ^[4]. The write-up does not describe how the wall tells Muse's browser apart from a person's.

The popup's wording follows the Perplexity case. Amazon sued in November 2025 over the Comet browser's shopping assistant, under the federal Computer Fraud and Abuse Act and California's equivalent ^[6]. On March 10, 2026 a judge barred the agent from logged-in parts of the site ^[7]. Amazon asked for a rehearing of the appeal and was denied on September 10 ^[9]. The Muse block began on Sunday night, September 20 ^[25]. Under the appeals court's reasoning, the user is the party accessing the site ^[8]. The user is also the party who accepted the Conditions of Use, and the popup is addressed to them ^[23].

The credentials dispute is narrower than it looks. Meta built two controls. A separate agent, Sentinel, must approve anything Muse sends to the internet, and payments go through Stripe Link one-time card numbers ^[19]. On passwords, Meta says: "Muse has no visibility into people's passwords or payment methods. Any credentials a person shares go into secure storage, so Muse can use them without seeing them." ^[20] The dev.to author argues that Meta's claim and Amazon's can both be true: the password sits in storage on a computer Meta owns, and the agent holding the key promises never to look ^[10]. Sentinel and single-use cards are sound design. Neither one moves the stored password off Meta's hardware ^[10].

Muse closed its report to The Register this way: "I didn't push past it, since the notice says continuing would violate Amazon's terms." ^[11] The dev.to author calls stopping at a terms notice a design choice worth copying ^[12]. I agree, and I'd make it the default in any browsing agent. An agent that retried with a fresh browser profile would keep its user in a breach Amazon has just named in writing ^[2].

Amazon's stated rule is that third-party apps buying from other businesses "should operate openly and respect service provider decisions about whether or not to participate", as food delivery apps and online travel agencies do ^[21]. Amazon's own Buy for Me feature shops on other retailers' sites, and small Shopify merchants say it listed their catalogues without asking ^[24]. Amazon would presumably want its own agent judged by a different rule. Rufus, renamed Alexa for Shopping in May 2026, "helped over 300 million customers in 2025", according to Amazon ^[13]. The dev.to author also points to more than $68 billion a year in Amazon advertising, money that depends on a human looking at the page ^[14].