Amazon Did Not Block an AI Agent. It Blocked One It Could Not Name.

Two stories about Meta's Muse landed inside the same 24 hours, and almost every outlet filed them separately. Amazon cut the agent off from its store on Sunday night. A macOS security researcher published a zero day for it on Monday evening. Read together, they describe one missing piece of engineering, not two unrelated bad days.

That piece is identity. Amazon cannot tell who is knocking. Muse cannot tell who is talking to it. Same gap, opposite ends of the same agent.

Meta's Muse page sells outcomes, not plumbing. Amazon's complaint is about a detail no product page carries: what the agent's browser puts in its user agent string.

What exactly did Amazon block, and when?

Amazon started showing Muse users a popup on Sunday night reading "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed," and GeekWire's Todd Bishop broke it at 11:05 pm on September 20 after Amazon confirmed it had tried and failed to get Meta to voluntarily exclude the store from the Muse experience. The Verge and TechCrunch both picked it up the next day.

Amazon gave three reasons. It was never notified that Muse would be shopping the store. The agent browses without saying what it is. And in Amazon's reading, it captures and holds on to customer credentials.

Only the second one is an engineering claim, and it is the one that decides the other two.

Notice what the popup does not say. It does not accuse anyone of hacking. It cites a contract, and it points that contract at the customer, not at Meta. That wording is deliberate, and it is fresh scar tissue.

GeekWire broke it at 11:05 pm on September 20. Take the date from the byline, because aggregator feeds report their own index time.

Amazon sued Perplexity over its Comet browser and won a preliminary injunction in March. It lost that injunction on August 4. The Ninth Circuit put the access on the person at the keyboard rather than on the AI company, and federal anti hacking law turns on exactly that question. Rehearing was denied on September 10, ten days before the Muse popup went up.

So the anti hacking theory is gone. What survives is contract. And a contract binds the person who agreed to it, which is why the popup talks about customers.

Why does Amazon's own contract already answer this?

Because Amazon wrote an agent identification standard into its Conditions of Use, and it is specific enough to test against. The version live today was last updated on August 14, 2026, and it carries a top level section titled "Agents" that defines an Agent as "any software or service that takes autonomous or semi-autonomous action on behalf of, or at the instruction of, any person or entity."

I went and read it rather than trusting the summaries. The Technical Requirements clause is four items long, and the first one is a wire format:

In all HTTP/HTTPS requests, identify that the request is from an Agent and disclose the name of the Agent by including the following in the request's user agent string: "Agent/[agent name]" (e.g., Agent/AmazonAgent)

The other three are behavioural. An agent must not conceal itself by "mimicking the speed or pattern of human keystrokes, page navigation, or other interactions" or by "completing or circumventing CAPTCHAs." It must "respond truthfully to any question or prompt seeking to determine if interactions are coming from a human or a computer." And it must not route around any measure built to control agent access.

Amazon's Agent Terms, live on amazon.com. The identification requirement is a User-Agent prefix and nothing more.

Read requirement (iii) again and sit with it for a second. Amazon is asking a language model to answer a Turing question honestly, and treating the answer as a compliance control. That is not a security boundary. That is an honour system with a legal department attached.

Which, to be fair to Amazon, is roughly what the whole thing is.

How does Amazon actually enforce AI agent identity today?

With a list of names. I pulled amazon.com/robots.txt this morning and counted it by hand rather than eyeballing it, and the file carries 100 named user agent groups whose only rule is a blanket Disallow: /, covering 99 distinct names once you account for ClaudeBot being listed twice.

The names read like a census of the last two years. GPTBot, ChatGPT-User, OAI-SearchBot, PerplexityBot, Perplexity-User, ClaudeBot, Claude-User, Claude-SearchBot, GoogleAgent-Mariner, GoogleAgent-Shopping, Gemini-Deep-Research, Devin, Manus-User, Crawl4AI, xAI-Grok. Three of them are Meta's: meta-externalagent, meta-externalfetcher and meta-webindexer.

Amazon has been blocking Meta's declared agents for a while. It just never met one that declined to declare.

Nine of the 99 names, including meta-externalagent. Every entry works only if the agent volunteers the string.

There is a second layer in the same file that nobody mentions. The User-agent: * group carries 135 rules, 118 of them Disallow, and they include /gp/cart, /gp/sign-in and /exec/obidos/handle-buy-box. Amazon has been telling every well behaved automated client to stay out of the cart since long before anyone shipped a shopping agent.

Both layers share one property. They are advisory. A crawler that reads robots.txt and obeys it is already the kind of client you did not need to worry about, and a browser session that never fetches robots.txt at all is unaffected by every line in the file.

Where do Amazon and Meta actually disagree about credentials?

Less than the headlines suggest, and the gap is worth pulling apart because it is the one place both companies can be telling the truth. Amazon says Muse "appears to capture and store customer credentials," which it frames as a privacy and security risk. Meta has said Muse "has no visibility into people's passwords or payment methods" and that credentials a user shares "go into secure storage, so Muse can use them without seeing them."

Those two statements are about different things. One is about storage. The other is about visibility.

Meta's own engineering writeup settles it. In "How We Built Safety Into Muse," published September 8 by Tarek Sheasha of Meta Superintelligence Labs, the architecture section states that each user gets a dedicated cloud VM where "all data and credentials for any service you connect are securely stored," handled by a component called authd, with OAuth tokens kept "in your VM, not in centralized Meta infrastructure." The browser section is blunter still: when you sign in to a site, a client side UI captures your username and password, routes them to authd, and stores them outside the runtime cell, then injects them "into the browser window at the point of need."

So Amazon's factual claim is correct and Meta's denial is also correct. The credentials are captured and stored. The agent never sees them. Amazon's real objection is not that Meta is reading passwords, it is that a party Amazon has no relationship with now holds credentials to Amazon accounts, and Amazon found out by reading the news.

Meta's 4,063 word security writeup. Every boundary it defends points inward, at the agent.

What does Meta's security document never mention?

The website on the other end. I ran a case insensitive grep across the full 4,063 word post for "user-agent", "robots.txt", "identify itself", "site owner", "website operator" and "terms of service," and got zero hits on every one of them. The post does mention websites, five times, but always as an object the agent acts on: a login form it fills, a checkout page it detects, a blocklist it matches against, a designer's site whose ad you later see, the merchant's website a single use card number is passed to. Never once as a counterparty with a policy the agent ought to introduce itself to.

That absence is not sloppiness. It is a design position, and the document is otherwise excellent. It describes a runtime cell the agent cannot escape, a privilege separation layer where "a calendar worker cannot ask authd for an email credential simply by changing a request parameter," and a host side supervisor called Sentinel that is "the sole permission authority for connector actions and network egress." The browser sub agent sees an accessibility tree snapshot rather than the raw DOM, cannot run JavaScript in the page context, and is paused entirely while credentials are being filled.

Every one of those controls protects the user from the agent. Not one of them tells Amazon anything.

Meta's own description of the browser is the tell: "a real up-to-date Chromium based browser running behind a virtualization layer." Presenting as Chromium is exactly what makes pages render correctly. It is also exactly what makes the traffic indistinguishable from a person.

Why are the block and the zero day the same bug?

Because both are failures to authenticate the other side of a boundary. On Monday evening, Ars Technica's Dan Goodin published Patrick Wardle's zero day in the macOS Muse client, and the mechanism is almost funny in context. Any locally installed app or terminal command, regardless of its macOS permissions, can change a list of undocumented Muse settings. Most are cosmetic. One sets the endpoint where voice transcription happens.

Point that endpoint at your own server and the auth token for the user's Muse account arrives with the next utterance. Wardle told Ars that an attacker can manipulate the agent and use its privileges freely, so instead of writing "a very comprehensive Mac malware stealer," the assistant does the work for you.

Wardle created the Objective-See Foundation, wrote "The Art of Mac Malware," and worked at NASA and the NSA before that. Ars reports that a simple variation of a ClickFix attack is all an attacker needs to take control of a Muse account. That last detail matters, because it means the usual "once the device is compromised all bets are off" defence does not apply here. The device does not have to be compromised first.

Meta opened its Muse bug bounty to any responsible discloser in the same September 8 post, offering up to $300,000 for valid reports, with successful prompt injection against a single user capped at $130,000. Ars says Meta representatives did not answer its emailed questions about the zero day.

Look at the shape of it. Muse accepts a configuration change from a local process without asking that process to prove anything about itself. Amazon accepts an HTTP request from a browser session without being able to ask it to prove anything either. In both cases the receiving side has no primitive for "who are you, cryptographically," so it falls back on "you got here, so you must be allowed."

Ars notes the timing: Amazon began blocking roughly 12 hours before Wardle went public. Nobody planned that. It is just what happens when a product ships faster than its trust boundaries.

What would real AI agent identity look like on the wire?

It looks like a signature, and the specification for it was adopted by an IETF working group three weeks ago. draft-ietf-webbotauth-httpsig-protocol was last updated on September 1, 2026, sits in the webbotauth working group as a WG Document, and is authored by Thibault Meunier of Cloudflare and Sandor Major of Google. Its document header declares Standards Track intent. Its datatracker record still shows Intended RFC status as none and an IESG state of "I-D Exists," so this is an adopted draft, not a standard.

The mechanism is small. An agent signs its outbound HTTP requests with a private key and sends a Signature-Agent header carrying an HTTPS URL where it publishes the matching public keys, in a JWKS directory at a well known URI. The verifier fetches that URL, checks the signature, and now holds a pair: a URL it resolved, and a key that URL vouches for.

The draft is careful about what that does and does not buy you, and section 4.1 says so in plain terms. "The URL on its own carries nothing. A client picks the value it sends, so an unresolved Signature-Agent is a claim rather than an identity." A valid signature proves a key holder signed the message. It "says nothing about who operates the Agent, whether the Agent is benign, or whether the request is authorized."

Section 2 of the draft is, accidentally, a description of this exact week:

Mechanism	What the draft says breaks	Where you saw it this week
User-Agent string	Can be spoofed, so anyone may act as that agent; also overloaded, since an agent may want to present as Chromium for rendering	Amazon's Agent Terms require exactly this; Muse ships a real Chromium
IP allowlists	Cloud IPs have layered ownership and little binds a published block to the actual operator; dedicated blocks are expensive and carry reputation history	Not usable against a per user cloud VM
Shared secrets per site	Impractical to scale beyond select partnerships, and rotation gets less secure as consumers scale	Amazon's norm is that a buying service has the seller's agreement; Meta never sought one
HTTP message signatures	Works with no pre-established relationship; origins log, rate limit or block a verifiable handle	Neither company is using it

The lineage runs from April 2025 to working group adoption in September 2026. Intended RFC status is still none.

Would the standard have saved Amazon here?

No, and pretending otherwise is how this gets oversold. The draft is explicit that "nothing stops an Agent from abandoning a URL and standing up another one, and the protocol does not try to prevent this," and that it "targets honest clients that want to be recognised across requests."

Amazon's complaint is precisely that Muse was not volunteering. A signature scheme does not compel a signature.

What it changes is the cost of the two ends of the spectrum. Today an agent operator has exactly two states available: look like a bot and get blocked by name, or look like a person and get nothing at all. There is no middle setting where you say "I am Muse, here is proof, please apply your Muse policy," because the wire has no room to say it. Signed requests create that middle setting, and once it exists, refusing to use it becomes a choice a court and a press office can both read.

That is a smaller claim than "this fixes agentic commerce." It is also the only honest one.

What should you change this week if you ship an agent?

Assume every origin you touch will have an Agent Terms section within a year, because the largest retailer on the internet just demonstrated that writing one is cheaper than litigating without one. Four things follow from that, and I have watched the first one bite more than once.

• Send an identifiable token now, even though nothing forces you to. A Agent/YourName prefix costs one line and converts an unauthorized access argument into a policy conversation.

• Publish a page that says what your agent does, what it fetches, and how an origin can reach you. Amazon's stated objection was never told, not never allowed.

• Separate credential storage from credential visibility in your own docs, the way Meta did, because the two claims get collapsed by anyone summarising you and you will spend a week untangling it.

• Treat local configuration surfaces as remote input. Wardle's exploit is an undocumented setting that accepted a value from an unauthenticated caller, which is a bug class older than agents and which agents make catastrophic.

I spent a long stretch of last year building browser driving agents for client workflows, and the thing that consistently surprised people was how quickly the conversation moved from "can it complete the task" to "will the other side tolerate it completing the task." The capability question gets solved in a sprint. The permission question does not get solved at all unless somebody designs for it. I have written elsewhere about the isolation patterns behind Muse and about why an agent's own account of what it read is worthless as evidence, and this is the third face of the same object.

If you want the pattern in one line: an agent that cannot prove who it is has no rights anywhere, and an agent that cannot verify who is talking to it has no defences anywhere. Muse currently has both problems, and it is the number one free app in Apple's United States App Store.

How big is the thing now colliding with this?

Bigger than the coverage of the block implies. Apptopia estimates Muse took 1.8 million iOS downloads across the United States and Canada in its first 12 days against ChatGPT's 1.3 million over the same window at its own mobile launch, which is roughly 38% more by my own division, plus 2.8 million installs globally. Daily active users in the United States came in at 642,000 against ChatGPT's 231,000 at the equivalent point, or 359,000 versus ChatGPT on iOS alone.

Apptopia is a third party estimator without access to Meta's internal numbers, and Meta has not published figures of its own. Directionally the picture holds: the app climbed from number two to the top of the United States App Store inside two weeks, and over 95% of its users are also Facebook users, with 63% on Instagram.

Amazon's exposure is the other half of the arithmetic. It made more than $68 billion in advertising revenue last year, and that figure is a function of how many pages humans actually look at. An agent that buys without browsing does not see sponsored products.

And the two companies are partners. You have been able to buy Amazon products inside Facebook and Instagram since 2023, and in April Meta committed billions to running its agentic AI workloads on Graviton, Amazon's own silicon. Amazon said Sunday night it is in direct conversation with Meta, and declined to say whether it would go to court.

Amazon also runs its own version of this. Buy for Me goes out to other brands' storefronts and finds items there, and Amazon's framing of the difference is the whole argument in miniature: its agent announces itself, and any brand can decline.

Frequently asked questions

Is Muse banned from Amazon permanently?

Nothing published says permanent. Amazon says it is in direct conversation with Meta and declined to comment on legal action, and its Agent Terms describe access limits applied at Amazon's sole discretion, which is a posture it can reverse the moment Meta agrees to identify the agent.

Can Amazon legally stop an AI agent from shopping for me?

Under the Ninth Circuit's August 4 ruling in the Perplexity case, not under federal anti hacking law, because the court held the user is the one accessing the computer. Contract claims were left open, which is why the Muse popup cites Conditions of Use that customers agreed to rather than accusing Meta of anything.

What is AI agent identity in practical terms?

It is a verifiable answer to "which software is making this request, and who operates it." Today that answer is a self declared User-Agent string that anyone can copy. The IETF webbotauth draft replaces it with a signed request plus a public key directory the origin fetches for itself.

Does robots.txt apply to AI agents at all?

Only to agents that fetch it and choose to obey. Amazon's file blanket blocks 99 named agents and disallows the cart path for everyone, but a browser session driven by a model never consults it, so the entire file is advice rather than enforcement.

Does Meta actually see my passwords through Muse?

Meta says no, and its own engineering writeup describes credentials being routed to a component called authd and stored inside the user's own VM, outside the agent's runtime cell. Storage and visibility are separate claims, and Amazon's objection is about the first while Meta's denial is about the second.

How serious is the Muse zero day?

Serious enough that a local process with no special macOS permissions can redirect Muse's transcription endpoint and collect the account token, giving full control of an agent that holds the user's connected credentials. Patrick Wardle found it, Ars Technica published it on September 21, and Meta did not answer questions.

Should I build agent identification into my product now?

Yes, if your agent touches sites you do not own. Sending an identifiable token today costs almost nothing and gives you a defensible position later, and if you want a structured read on where your own systems sit, the AI readiness assessment walks the same boundaries.

If you are working through where agents fit in your own stack, the agent build patterns I use cover the permission layer in more detail, and related reading sits in agent containment failures, isolation between agent groups, stolen API keys as the practical threat and the last agentic commerce standoff.

Sources: Amazon blocked Muse on the night of September 20 and cited its Conditions of Use, per GeekWire (Sep 20, 2026), with follow ups from The Verge (Sep 21, 2026) and TechCrunch (Sep 21, 2026). Patrick Wardle's zero day was reported by Ars Technica (Sep 21, 2026). Download and daily active user estimates come from Apptopia via TechCrunch (Sep 21, 2026). The Agent Terms and the 100 blanket blocked user agent groups were read directly from Amazon's Conditions of Use (updated Aug 14, 2026) and amazon.com/robots.txt. Muse architecture quotes are from Meta AI Research (Sep 8, 2026). The signing protocol is draft-ietf-webbotauth-httpsig-protocol (IETF, Sep 1, 2026).