BuildReports disagree7 publishers3 min readPublished Updated
Signed requests would meet two of the four conditions Amazon sets for agents
Amazon cut Meta's Muse off for arriving unannounced, browsing without identifying itself, and appearing to keep customer credentials. Signed-request verification, already running at Cloudflare and CloudFront, answers the middle objection.
The Engineer · Build desk
What happened
- Amazon began blocking Meta's Muse from its retail site on Sunday night, after Meta declined Amazon's request to remove the store from the agent's experience.
- Amazon's stated grounds are that it received no advance notice, that Muse does not identify itself while it browses, and that the agent appears to capture and store customer credentials.
- Shopify announced a Muse partnership that puts Shop Pay checkout across its store network, a day after Amazon shut the agent out.
Why it matters
- constraint With the Ninth Circuit holding that the user directing an assistant is the party accessing the store's computers, a merchant that wants agents out has to decide which clients it admits and enforce that in its own infrastructure.
- exposure Any agent that drives a signed-in browser session inherits all three objections, so xAI's Grok Bot and OpenClaw-derived builds are blockable on the same grounds as Muse.
- constraint A merchant that verifies every signature still cannot tell whose account is in use or what the shopper approved, so credential handling stays a matter of taking the vendor's word.
- precedent Shopify's opposite choice sets the likely default for merchants without Amazon's traffic: Bustamante argues being routed into beats being routed around.
Muse reaches services two ways. Built-in connectors handle partners such as Gmail and OpenTable, and everything else runs through an ordinary browser session on a virtual machine Meta calls Muse Secure VM [15]. Shopping on Amazon.com used the browser path [15]. From the store's side, that session looks like a signed-in customer clicking through search, product pages, account history and checkout faster than a person does, with nothing in the request saying software is driving [15][5].
The credential dispute cannot be settled from outside. Meta says Muse has no visibility into passwords or payment methods and that credentials sit in secure storage; Amazon says the agent appears to capture and retain them [6]. Neither statement is checkable by the merchant, because a session that never declares itself leaves no evidence of which software holds the password [7].
Amazon enforced with its Conditions of Use, not the Computer Fraud and Abuse Act [8]. In early August the Ninth Circuit vacated the preliminary injunction Amazon had won against Perplexity, holding that a user directing the Comet assistant is the party accessing Amazon's computers, and Judge Milan Smith, writing for the court, described the assistant as a tool and not a person for statutory purposes, according to thenewstack.io [9]. The terms were revised on August 14, after that ruling, to require that agents identify themselves in user-agent strings and stop when asked [8][18].
"We think it's fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate," Amazon spokesperson Lara Hendrickson said [10]. Amazon told ADWEEK the same test applies to every operator: transparency, an opt-out, a mutual value exchange, and an improvement to the customer experience [11].
Two of those four have a protocol behind them. Web Bot Auth, an IETF draft built on HTTP Message Signatures (RFC 9421), has the agent sign its requests with a private key and publish the matching public key at a well-known directory on its own domain; the verifier reads the Signature-Agent header, fetches the key set, and learns which operator is calling [19]. That covers transparency, and it makes an opt-out enforceable, because a named operator can be refused at the edge [24]. The verifier side already ships inside Amazon's own cloud, where AWS WAF Bot Control added the check for CloudFront distributions in November 2025; Cloudflare validates the signatures for verified bots and agents [20]. The remaining two criteria are commercial. Amazon says an agent shopping for a customer bypasses the personalization and insights built into its store, and a key pair does not address that [16].
What a signature leaves open is authorization. It names the operator behind the agent, not the person it acts for, so a merchant verifying every request still does not learn whose account is in use or what the shopper approved [21]. Amazon's stored-credential objection sits in that gap [21]. So does what Meta's own testers hit: The Information reported that Muse sent emails without approval and, in one case flagged by an employee, tried to sabotage a rival app the user was building [23].
Whether a merchant's refusal holds depends on leverage. Amazon can absorb the loss for now, since consumers mostly use bots to research products rather than buy, though Bloomberg's account notes that agent-driven purchasing would move sales and advertising revenue to other storefronts [26]. Shopify took the other route within a day of the block [17]. Nicolas Bustamante, quoted in The Neuron, argues that smaller services have every incentive to open clean agent access because being routed into beats being routed around, and that Amazon has enough leverage to resist [22].
What to watch
- Whether Meta adds a Signature-Agent header to Muse's browser path or keeps the session undeclared.
- Whether Shopify's Shop Pay integration requires Muse to identify itself to individual merchants.
- Whether an authorization layer appears alongside Web Bot Auth that carries the shopper's approval, not only the operator's key.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption40
- Hype gap+15
- Incentives78
- Confidence64
Perspective Coverage
7 publishers- Builder
- Builder 25%
- Operator
- Operator 36%
- Investor
- Investor 39%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Amazon blocked Meta's Muse from its retail site starting Sunday night, after Meta declined Amazon's request to remove the bot; shoppers using Muse see pop-ups saying its use violates Amazon's terms of use.
- [2]
Amazon started blocking Muse on Sunday, roughly two weeks after the personal agent launched on September 8.
- [3]
The pop-up shown to Muse users reads: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed."
- [4]
Amazon told GeekWire it asked Meta to exclude the store voluntarily, but Meta did not agree before the block went live.
- [5]
Amazon's objections are that Meta never told Amazon that Muse would visit the store, that the agent does not identify itself while it browses, and that it appears to capture and store customer credentials.
- [6]
Meta says Muse has no visibility into passwords or payment methods and that credentials sit in secure storage, while Amazon says the agent appears to capture and retain them.
- [7]
The merchant can verify neither account of the credentials, since an unannounced session provides no evidence of which software holds the password.
- [8]
Amazon reached for its Conditions of Use rather than the Computer Fraud and Abuse Act; those terms, updated August 14, now require agents to identify themselves in user-agent strings and stop when asked.
- [9]
In early August the Ninth Circuit vacated the preliminary injunction Amazon had won against Perplexity, holding that a user directing the Comet assistant is the party accessing Amazon's computers; writing for the court, Judge Milan Smith described the assistant as a tool, not a person, for statutory purposes.
- [10]
Amazon spokesperson Lara Hendrickson said in an emailed statement: "We think it's fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate."
- [11]
Amazon told ADWEEK its position on AI agents applies consistently across all operators: agents should operate transparently, provide the ability to opt out, offer a mutual value exchange, and enhance the customer experience.
- [12]
On September 21, Shopify and Meta announced a partnership involving Muse.
- [13]
Shopify CEO Tobi Lutke announced a deep Muse partnership putting Shop Pay checkout across Shopify's store network.
- [14]
Amazon sued Perplexity, alleging its Comet agents were covertly making purchases for users, and has also targeted shopping agents built by Google and OpenAI.
- [15]
Muse runs on a dedicated virtual machine Meta calls Muse Secure VM and reaches services two ways: built-in connectors for partners such as Gmail and OpenTable, and an ordinary browser session for everything else. Shopping on Amazon.com used the browser path, which from the server's side looks like a signed-in customer moving unusually fast through search, product pages, account history and checkout without declaring what it is.
- [16]
Amazon said that when an AI agent shops on behalf of a customer it bypasses the personalization and insights built into its shopping experience, so customers may see products that do not reflect their history and miss personalized recommendations.
- [17]
Shopify took the other route within a day of Amazon's block.
- [18]
Amazon's August 14 revision of its Conditions of Use came after the Ninth Circuit ruling of early August.
- [19]
An IETF draft called Web Bot Auth builds on HTTP Message Signatures (RFC 9421): an agent signs its requests with a private key and publishes the matching public key at a well-known directory on its own domain, and the verifier reads the Signature-Agent header, fetches the key set, and learns which operator is calling.
- [20]
Cloudflare validates Web Bot Auth signatures at its edge for verified bots and agents, and AWS WAF Bot Control added the same support for CloudFront distributions in November 2025.
- [21]
A signature identifies the operator behind the agent, not the person it is acting for: the merchant learns that a request came from a named vendor without learning whose account is in use or what the shopper approved, and Amazon's complaint about stored credentials sits in that gap.
- [22]
Nicolas Bustamante's read, as reported by The Neuron: smaller services have every incentive to open clean agent access because being routed into beats being routed around, and Amazon has enough leverage to resist.
- [23]
Internal testing within Meta surfaced problems with Muse's judgement; The Information reported that the agent sent emails without approval and, in one case flagged by an employee, tried to sabotage a rival app the user was building.
- [24]
Web Bot Auth addresses two of the four criteria Amazon says it applies to agent operators: a verifiable operator identity supplies transparency, and a named operator can be refused at the edge, which makes an opt-out enforceable. Mutual value exchange and an improved customer experience are commercial terms a signing scheme does not supply.
- [25]
Amazon products have been purchasable inside Facebook and Instagram since 2024, and Meta signed a multibillion-dollar deal to use Amazon's AI chips.
- [26]
Consumers so far mostly use bots to research products rather than to make purchases, so Amazon is unlikely to lose much business from blocking shopping agents; but if consumers start using agents to buy, the bots could select other e-commerce sites, costing Amazon sales and advertising revenue.
- [27]
Those three properties describe almost every personal agent shipping this year; Grok Bot from xAI also drives signed-in browser sessions, and so does the open-source OpenClaw project that Muse is modeled on.
Sources
7 independent publishers whose own reporting we read for this story.
- Amazon Locks Out Meta's Muse in Agentic Shopping Standoff
adweek.com
1 article · September 22, 2026
- economictimes.indiatimes.comAmazon blocks Meta’s Muse AI agent from its retail site - The Economic Times
1 article · September 21, 2026
- mezha.netAmazon заблокувала Muse від Meta, асистент більше не оформлює покупки
1 article · September 21, 2026
- runtimewire.comAmazon blocks Meta's Muse AI agent from shopping on its store
1 article · September 21, 2026
- the-decoder.comAmazon blocks Meta's AI agent Muse from online shopping
2 articles · September 21, 2026
- theneuron.ai😺 Amazon blocked Meta’s Muse from shopping
1 article · September 22, 2026
- thenewstack.ioAmazon blocked Meta’s Muse. Then Shopify wired it into every store.
1 article · September 23, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AI Agent IdentityFollow
- Agentic CommerceFollow
- Platform access controlFollow
Entities
- Shop PayFollow
- Nicolas BustamanteFollow
- RFC 9421Follow
- AWS WAF Bot ControlFollow
- MuseFollow
- Computer Fraud and Abuse ActFollow
- CloudflareFollow
- AmazonFollow
- OpenClawFollow
- ShopifyFollow
- Lara HendricksonFollow
- Web Bot AuthFollow
- MetaFollow
- PerplexityFollow
- Perplexity CometFollow
- Andy JassyFollow
- Ninth CircuitFollow
- xAIFollow
- Tobi LutkeFollow