Amazon moves its agent fight from hacking law to its own terms of service

Cache reads on Claude Opus 5.5 are 20 cents per million tokens, 60% below Opus 5, and Anthropic says cache reads make up the majority of what agentic and coding work costs ^[2][3]. Fresh input is $4 per million and output $20, both 20% below Opus 5 ^[1]. Work backwards from those cuts and Opus 5 was charging $5 and $25, with cache reads at 50 cents ^[1][2]. A cached token now costs a twentieth of a fresh input token ^[3].

So the compute to run a shopping agent through a retailer's pages keeps getting cheaper, even as access to those pages does not. As of Sunday night Amazon had cut Meta's new Muse agent off from shopping on Amazon.com on behalf of customers, after trying and failing to get Meta to exclude the site voluntarily ^[1].

Where the 40 percent comes from

Anthropic attributes its headline saving to two things: a lower price per token and fewer tokens per task, netting out to 40% less than Opus 5 on typical workloads at default settings ^[4][5]. The published prices bound the first half of that. A workload with no cache hits gets 20% off. A workload that is nothing but cache reads gets 60% ^[1][2]. For the price cuts alone to produce 40%, cache reads have to have been half of what the workload cost at Opus 5 prices ^[5]. Anthropic says cache reads are the majority of agentic and coding cost ^[3]. For those jobs, then, the price sheet clears 40% before a single token is saved.

Run it the other way. A workload with no caching at all needs 25% fewer tokens per task to land on the same 40%, since 0.8 times 0.75 is 0.6 ^[6]. Both readings fit what Anthropic published, and the company did not break the 40% into its two parts.

The fast tier is priced with less ambiguity: $8 per million input and $40 per million output in Claude Code and the Claude Platform, exactly double the standard rate, for up to 2.5 times the speed ^[6][4]. At standard pricing, Opus 5.5 generates output more than 30% faster than Opus 5 ^[7]. Anthropic says the model performs at the level of Claude Fable 5.1 on most work, while also cautioning that benchmark margins have become a less reliable guide at these capability levels and that in its own use the gap is narrower than the scores suggest ^[8][9]. One early tester completed a 680,000-line code migration in less than a day ^[10].

The ad business Amazon is protecting

Amazon generated more than $68 billion in advertising revenue last year, on a business the company says depends on people browsing its pages and seeing sponsored products ^[9]. An agent that does the browsing and the buying produces the transaction without producing the page view that inventory is sold against. Amazon also says Muse can reach account pages and order history when a customer prompts it to, and that because the agent does not identify itself, this amounts to an undisclosed third party moving through customer accounts, processing transactions and handling sensitive data without Amazon's knowledge or consent ^[2][12].

Amazon has done this repeatedly this year: it sued Perplexity over its Comet browser and moved to block shopping agents from Google and OpenAI ^[10].

Each company is a paying customer of the other. Amazon products have been purchasable inside Facebook and Instagram since 2023, and Meta signed a multibillion-dollar deal in April to run agentic AI workloads on Amazon's Graviton chips ^[8]. The GeekWire report does not say whether Muse itself runs on that capacity. Amazon is blocking an agent built by a customer of its chip business.

From hacking law to contract law

Amazon won a preliminary injunction against Perplexity in March and lost it on Aug. 4, when the Ninth Circuit ruled that the user, not the AI company, was the one accessing Amazon's computers under federal anti-hacking law; the court denied Amazon's petition for rehearing on Sept. 10, leaving claims built on contracts and terms of service open ^[11]. The message Muse users now see says: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed" ^[3].

The agreement Amazon is enforcing is the one it has with the shopper.

An Amazon spokesperson said, "We think it's fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate" ^[4], and, in the same statement, "Agentic third-party applications such as Muse have the same obligations, and we've requested that Meta remove Amazon from the experience" ^[5]. Amazon said Sunday night that it is in direct conversation with Meta about the issue, and declined to comment on whether it would consider legal action ^[16].

The credential dispute

Amazon says Muse appears to capture and store customer credentials, which it says could create privacy and security risks ^[2]. Meta has said previously that Muse "has no visibility into people's passwords or payment methods," and that credentials a user shares "go into secure storage, so Muse can use them without seeing them, including passwords a person types into the browser themselves" ^[6]. Meta did not immediately respond to GeekWire's request for comment Sunday night ^[7].

Meta describes Muse as running on a secure virtual machine with its own browser, checking with the user before sensitive actions such as sending an email or making a purchase, with a separate monitoring agent called Sentinel required to approve anything Muse sends to the internet ^[15]. Muse launched Sept. 8 as a multi-step personal agent connecting to email, calendar, payments, dining and shopping, free with paid subscription tiers, on iOS, Android, muse.ai and WhatsApp ^[14].

Of Amazon's three complaints, two are cheap for Meta to fix: tell Amazon, and have the agent identify itself when it browses ^[2]. The third is a factual disagreement about what the software does with a password.

Verified access at both ends

The same gating logic is showing up one layer down, on capability. Anthropic deployed Opus 5.5 with safeguards similar to those on Claude Fable 5.1 because the model is comparable to Claude Mythos 5.1 in biology and cybersecurity, opened its Life Sciences Verification Program to vetted organisations, and said it will expand its Cyber Verification Program so verified cybersecurity practitioners can use the model for their work ^[14]. External evaluators including Frontier Design and METR tested it before release ^[12]. On Anthropic's automated behavioural audit it scored better than any model the company has tested, and it is more resistant than Opus 5 to prompt injection ^[13].

Identity checks decide what the agent is allowed to do at the model. Identity checks are what Amazon says it wants at the merchant. Amazon pointed to food delivery apps and the restaurants they take orders for, and to online travel agencies and the airlines they book with, as services that buy on a customer's behalf, on commercial terms, with the merchant's agreement ^[13].

I think the negotiation is over a licensed channel for an identified agent, priced by whoever holds the account relationship with the shopper. The counter-argument is in the same court record. If the user is the party accessing the computer, as the Ninth Circuit found, a shopper with a capable agent may keep getting through, and Amazon's remaining levers are degrading the experience or suing the software supplier its own ad customers use ^[11]. A third path is duller and, given the Instagram storefront and the Graviton contract ^[8], quite likely: the two companies settle inside the relationship they already have and no public price ever appears.

The view would be wrong if Amazon published an identified-agent policy with no fee attached. That would make disclosure the point and not money. It would also be wrong if Meta shipped self-identification and got blocked anyway, because then the objection was the traffic. And if cheap tokens never convert into enough agent purchasing to be worth licensing, there is nothing to price; at $4 and $20 per million, with cache reads at 20 cents, that conversion is cheaper than it was one model ago ^[1][2].