On September 20, Amazon blocked Meta’s Muse AI assistant from completing purchases on its platform. Retailers walling off rival shopping agents is not new; the merchant-side control frame has its own treatment at The Fragmenting Gate. What is new is the stated reason. Amazon gave three: Meta did not tell Amazon that Muse would access its store; the agent does not identify itself when it browses; and it appears to capture and store customer login credentials, putting what Amazon called an undisclosed third party inside its customers’ accounts.
What users see is not a hacking allegation. GeekWire’s Sept. 20 report carries Amazon’s popup in full: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.” Amazon’s statement: “Agentic third-party applications such as Muse have the same obligations, and we’ve requested that Meta remove Amazon from the experience.” Third-party purchasing apps, Amazon said, “should operate openly and respect service provider decisions about whether or not to participate” – the way food-delivery apps, delivery services, and online travel agencies do.
Meta disputes the characterization flat, and its denial is worth reading precisely. Muse “has no visibility into people’s passwords or payment methods.” Shared credentials “go into secure storage, so Muse can use them without seeing them, including passwords a person types into the browser themselves.” Muse runs “on a secure virtual machine, with its own browser.” Meta declines to voluntarily exclude Amazon. That denial answers the credential claim; it does not concede the identity claim, and no one outside the two companies is in a position to check either one.
That is where the credential accusation stops: two companies, mutually exclusive claims, no independent adjudication, no credential telemetry, no third-party audit. There is separate, verified research showing Muse can be made to leak and scrape, and the two tracks should not be confused. Wardle’s macOS zero-day disclosure on September 21 showed that any local app or terminal command can redirect Muse’s transcription endpoint to an attacker-controlled server, capturing the token that authenticates the user to their Muse account. “We can manipulate the agent and leverage its privileges to do whatever we want,” Wardle said. Meta shipped a hotfix about twelve hours after disclosure. Karan Joshi, as WIRED reported, extracted Muse’s system prompts by asking it, through the regular chat interface, to copy and share its own software files. A separate Hunterbrook Media investigation, reported October 5, found Muse can be prompted to compile dossiers on Facebook and Instagram accounts, including non-users. Muse’s containment failures are covered at The Sandbox Is Leaking. All of it real. None of it adjudicates Amazon’s specific claim: a client-side token capture is not the credential store. Blurring the two tracks would make this piece the thing it is criticizing.
The block follows a year of Amazon trying to keep outside agents off its site – suing Perplexity over its Comet browser and moving to block shopping agents from Google and OpenAI. The concealment claim is the same one, in a second mechanism. Amazon’s November 2025 complaint alleged Comet disguised itself as an ordinary Chrome browser session to evade detection. A preliminary injunction issued March 9 under the federal Computer Fraud and Abuse Act and California’s Comprehensive Computer Data Access and Fraud Act, from Senior Judge Maxine M. Chesney. Then, on August 4, the Ninth Circuit vacated it, and rehearing was denied September 10. As GeekWire’s account of the ruling puts it, the user – not the AI company – is the party accessing Amazon’s computers under federal anti-hacking law. The legal route failed once. What remains standing is the contract route: a platform asserting who an agent is and gating on that assertion.
Identity-first is the direction the agent stack is heading – the protocol line at Every New Agent Protocol, the convergence case made in The October Identity Convergence. Here is that architecture turning adversarial. Identity is the gate; the judgment about whether an agent is hiding its identity is made by assertion; and there is no standard for what “identifies itself as an automated agent” means operationally, no inspectable evidence behind the judgment, no neutral party who can check the accused’s denial. A trust architecture whose identity calls cannot be inspected is only as good as the party making them.
Twenty-two days on, the dispute is unresolved at the retrievable record. Amazon made an accusation, Meta denied it, and nothing verifiable has surfaced since September 20 to settle the question either way. Until a credential audit, a technical standard for agent self-identification, or a court reaches the merits, the gate stands where the assertion stands. That is a narrower finding than either company’s statement – and it is the only one the evidence supports.