Amazon spent the weekend of September 20 doing something it's now done to four different companies in six months: it blocked an AI agent from shopping on its own site. This time the target was Meta's Muse, which had just become the #1 free app on the US App Store. Before Muse, it was Perplexity's Comet, OpenAI's shopping agent, and Google's. Same move, same popup, same legal theory. If you write software that touches the web on a user's behalf, this is the fight that decides whether your agent is legal.
The pattern, not the incident
Here's the popup users saw when they asked Muse to buy something on Amazon:
"Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed."
That's not a rate limiter. That's not a WAF rule. That's a ToS violation notice — Amazon enforcing a contract, not defending a perimeter. Which tells you immediately this isn't a technical problem Meta can engineer around. You can't out-header your way past a lawsuit.
Amazon's stated complaints about Muse, almost verbatim from the Perplexity playbook:
- No self-identification. Muse doesn't announce itself as a bot when it browses. It looks like a logged-in human clicking through checkout.
- Credential handling. Amazon claims Muse captures and stores customer credentials. Meta's counter: credentials go into secure storage the agent itself never sees, and it uses them without visibility into passwords or payment methods. Neither side has published anything you could audit, so take both claims as marketing until proven otherwise.
- Undisclosed transaction processing. The agent completes purchases as a third party Amazon never authorized and never gets a cut from.
Strip away the specifics and the real complaint is: you're checking out on my platform without paying my toll. Amazon's storefront and recommendation engine is the entire ad business. An agent that goes straight to "buy the cheapest 2TB SSD with 4+ stars" skips the sponsored listings, skips the upsell modules, skips everything that makes Amazon Amazon-shaped instead of a commodity API. This is a revenue fight wearing a security-concern costume.
The case law that actually matters: Amazon v. Perplexity
This is where it gets interesting for anyone building agents, not just anyone reading about them.
In March, Amazon got a preliminary injunction from a district court blocking Perplexity's Comet browser from touching password-protected Amazon pages — account, order history, checkout — under the Computer Fraud and Abuse Act. CFAA is the same statute that's criminalized scraping, credential sharing, and TOS violations for two decades. If that injunction held as precedent, "an AI agent acted on a logged-in user's behalf without the site's blessing" becomes potential federal computer fraud. That's an extinction-level ruling for every agentic browsing product on the market.
It didn't hold. In August, the Ninth Circuit reversed, 21 pages, unanimous panel:
The district court abused its discretion... it is the user who accesses Amazon's computers, using the Assistant as a tool.
Read that sentence again, because it's the load-bearing wall of the entire agentic-web legal theory right now: an agent acting under a human's authenticated session is the human accessing the site, not the agent. A tool doesn't commit the crime; the person wielding it does, and the person already had a valid login. CFAA's "unauthorized access" element requires access without authorization — and the user, logged in with their own credentials, is authorized.
That's a genuinely good outcome if you build agents. It's also not over — Amazon can push for en banc rehearing or petition the Supreme Court, and the trademark and state-law claims survive untouched. Perplexity has since moved to dismiss the CFAA/CDAFA counts on the theory that the appellate ruling forecloses them outright. Nobody's declared final victory. But for six months, "logged-in agent = unauthorized computer access" was a live legal theory backed by an actual injunction, and now it isn't.
What's actually missing: a protocol, not a lawsuit
The reason this keeps happening company by company, lawsuit by lawsuit, is that there's no agreed handshake for "I am an AI agent, here's who I'm acting for, here's my scope." Every site has to guess from behavior, and every agent vendor has to guess whether guessing wrong gets them sued.
The closest thing to an answer is Cloudflare's Web Bot Auth — an emerging IETF draft built on HTTP Message Signatures (RFC 9421). The agent signs every request with an Ed25519 key, publishes the public key, the origin verifies the signature cryptographically. No user-agent string to spoof, no IP allowlist to get around — actual cryptographic proof of identity per request. Claude, ChatGPT, and Perplexity already support it on the crawling side; AWS WAF, Vercel, Shopify, and Akamai have it live at the edge. Visa's Trusted Agent Protocol and Mastercard Agent Pay are building their agentic-commerce auth on top of it.
Notice what's not in that adoption list: Amazon, as a Web Bot Auth relying party for commerce agents. The company running the biggest storefront on earth has every incentive to keep agent access ambiguous, because ambiguity is what lets it block on its own terms instead of a shared standard's terms. If Web Bot Auth (or something like it) becomes the default handshake for "authorized agent on behalf of authenticated user," Amazon loses the ability to say "you didn't identify yourself" — because the protocol would force identification as a precondition of the request even mattering.
The takeaway if you're building agents
- "The user is the one accessing the site" is your best legal ground right now, per the Ninth Circuit — but only while the agent operates strictly within a session the user actually authenticated. The moment your agent does something the user's login wouldn't have permitted on its own, you're back in CFAA territory.
- Self-identify or get treated as an adversary. Amazon's core complaint about every single one of these agents — Muse, Comet, OpenAI's, Google's — is that they don't announce themselves. Cryptographic bot auth exists specifically to solve this. If your agent looks indistinguishable from a human clicking buttons, expect to get blocked the moment you're popular enough to notice, the same week Muse hit #1 on the App Store.
- Credential custody is the next battleground. "We store it but can't see it" is Meta's defense and it's unverifiable from the outside. If you're building anything that holds a user's stored payment or login credentials on their behalf, publish how, because "trust us" is what got Amazon's lawyers involved in the first place.
- This isn't settled. Four platforms blocked in six months, one reversed injunction, zero adopted standards from the retailer side. If you're shipping an agentic shopping feature today, you're shipping into active litigation, not established law. Plan your architecture — and your legal budget — accordingly.
The web spent thirty years building robots.txt as a polite request bots could ignore. It's about to spend the next few building cryptographic proof-of-identity as a request they can't. Whether Amazon and friends adopt it or keep fighting it lawsuit by lawsuit is the real story here — Muse is just this month's headline.
Top comments (0)