Build2 publishers3 min readPublished Updated
Amazon shuts Meta's Muse agent out by holding shoppers to its Conditions of Use
Amazon is blocking Meta's Muse agent with a Conditions of Use popup and a bot wall, ten days after the Ninth Circuit refused to rehear its Perplexity case. Agent builders now have to plan for stores that refuse entry through their own terms, whatever the user asked for.
The Engineer · Build desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- On August 4 the Ninth Circuit vacated Amazon's injunction against Perplexity's Comet, ruling that the user, not the AI company, is the one accessing Amazon's computers.
- The appeals ruling left contract and terms-of-service claims open, and Amazon's popup against Muse uses exactly those claims.
- Amazon says it asked Meta to remove Amazon from the Muse experience before blocking it, and Meta did not.
- Amazon told GeekWire that Meta never said Muse would shop there, that Muse does not identify itself, and that it appears to capture and store customer credentials.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint A user's instruction no longer decides whether an agent gets into a store, because the store can hold that same user to terms the court left untouched.
- decision Teams building browsing agents have to define what the agent does when it meets a terms notice. Muse stops and reports, so its user does not keep breaching terms they have just been warned about.
- exposure Keeping user credentials on the agent maker's own machines gives a store grounds to object, even when the agent is designed never to read them.
- precedent If more retailers copy the popup-and-wall pattern, an agent can only shop at the stores that have agreed to let it in.
Muse runs each agent in what Meta calls "Muse Secure VM", a dedicated cloud virtual machine with its own browser [6]. Where a service has no API, Meta's launch post says, "the agent can use the service through a browser the way you would." [7] Amazon has no shopping API for outside agents, so on Amazon, Muse clicks [8].
Amazon answered inside that browser session, with two layers and no lawsuit [3]. The popup ends its sentence with "to which our customers have agreed" [2]. Behind it sits an anti-bot wall. The Register tested it on Monday by asking Muse to find "the best-reviewed ergonomic office chair" and add it to the cart [5]. Muse reported that Amazon "is showing an anti-bot wall that blocks automated browsers outright" and that "the browser couldn't even get to the search page" [5]. The write-up does not describe how the wall tells Muse's browser apart from a person's.
The popup's wording follows the Perplexity case. Amazon sued in November 2025 over the Comet browser's shopping assistant, under the federal Computer Fraud and Abuse Act and California's equivalent [13]. On March 10, 2026 a judge barred the agent from logged-in parts of the site [14]. Amazon asked for a rehearing of the appeal and was denied on September 10 [16]. The Muse block began on Sunday night, September 20 [1]. Under the appeals court's reasoning, the user is the party accessing the site [15]. The user is also the party who accepted the Conditions of Use, and the popup is addressed to them [18].
The credentials dispute is narrower than it looks. Meta built two controls. A separate agent, Sentinel, must approve anything Muse sends to the internet, and payments go through Stripe Link one-time card numbers [9]. On passwords, Meta says: "Muse has no visibility into people's passwords or payment methods. Any credentials a person shares go into secure storage, so Muse can use them without seeing them." [10] The dev.to author argues that Meta's claim and Amazon's can both be true: the password sits in storage on a computer Meta owns, and the agent holding the key promises never to look [19]. Sentinel and single-use cards are sound design. Neither one moves the stored password off Meta's hardware [19].
Muse closed its report to The Register this way: "I didn't push past it, since the notice says continuing would violate Amazon's terms." [20] The dev.to author calls stopping at a terms notice a design choice worth copying [21]. I agree, and I'd make it the default in any browsing agent. An agent that retried with a fresh browser profile would keep its user in a breach Amazon has just named in writing [2].
Amazon's stated rule is that third-party apps buying from other businesses "should operate openly and respect service provider decisions about whether or not to participate", as food delivery apps and online travel agencies do [12]. Amazon's own Buy for Me feature shops on other retailers' sites, and small Shopify merchants say it listed their catalogues without asking [22]. Amazon would presumably want its own agent judged by a different rule. Rufus, renamed Alexa for Shopping in May 2026, "helped over 300 million customers in 2025", according to Amazon [23]. The dev.to author also points to more than $68 billion a year in Amazon advertising, money that depends on a human looking at the page [24].
What to watch
- Whether Amazon files a contract or terms-of-service claim against Meta, the route the Ninth Circuit left open.
- Whether Meta makes Muse identify itself to stores or negotiates participation with Amazon instead of routing around the wall.
- Whether Shopify merchants who object to Buy for Me get the same right to refuse that Amazon is asserting against Muse.