On September 8, Meta launched Muse, a personal AI agent that does not just answer questions but acts: booking travel, managing inboxes, hunting discount codes, and shopping across a user’s connected accounts. On September 18, it passed ChatGPT to become the No. 1 free app on Apple’s US App Store. On September 20, Amazon blocked it. Users who try to send Muse onto Amazon.com now see a pop-up: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.”

Thirteen days from launch to blockade. The fastest consumer AI product adoption of the year met the fastest defensive response retail has ever mounted. Both facts tell you the same thing: whoever controls the agent that shops controls the sale. Everything else in this story is negotiation posture.

What Actually Happened

Muse is Meta’s bet on what Mark Zuckerberg called at Connect last week “the personal superintelligence that billions of people around the world are going to use.” It runs on Muse Spark, a multimodal model built for agentic work under chief AI officer Alexandr Wang. It ships free with paid tiers across iOS, Android, muse.ai, and WhatsApp, runs on a secure virtual machine with its own browser, and checks with the user before sensitive actions like purchases. A separate monitoring agent, Sentinel, has to approve anything Muse sends to the internet.

The mechanism at the center of the dispute is spelled out in Meta’s own launch materials: if a service offers a public API, Muse connects with user-provided credentials. If there is no API at all, the agent “can use the service through a browser the way you would.”

Amazon’s version of events, laid out by GeekWire: Meta never told Amazon that Muse would access its store. The agent does not identify itself when it browses. It appears to capture and store customer credentials, and it can reach account pages and order history if prompted. Amazon asked Meta to voluntarily exclude Amazon from the experience; Meta declined; Amazon cut it off and is now “in direct conversation” with Meta about the issue.

Meta’s response predates the block: the company has said Muse “has no visibility into people’s passwords or payment methods,” and that shared credentials “go into secure storage, so Muse can use them without seeing them.”

The adoption numbers explain Amazon’s urgency. Muse passed 2.5 million downloads in two weeks per Sensor Tower data shared with CBS News, with ChatGPT at 3.1 million over the same window and Claude at 200,000. Expedia and PayPal announced Muse integrations on September 22. At Connect, Meta added Stripe, Shopify, Walmart, Best Buy, Gap, Sephora, Wayfair, and Instacart (soon), and said it received more than 1,500 applications from developers building connectors in under a week.

Take the Security Case Seriously. Then Follow the Money.

Amazon’s stated concerns are not invented. An unidentified third party holding stored credentials, walking through account pages and order history, and executing transactions is a genuinely new attack surface, and Amazon’s framing has real force: “third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate.”

But note what Amazon itself compares this to: food delivery apps and the restaurants they order from, online travel agencies and the airlines they book with. Those are commercial partnerships with agreed terms. The dispute with Muse is also, at bottom, about terms. And the terms at stake are enormous: Amazon generated more than $68 billion in advertising revenue last year, a business that, as GeekWire puts it, “depends on people browsing its pages and seeing sponsored products.”

An agent does not browse. It does not linger, compare sponsored cards, or add three things to a cart. It collapses a twenty-minute shopping session into a query against signals: price, availability, reviews, seller history. Sponsored placements, the engine of that $68 billion, are invisible to that process or actively discounted as noise. Every purchase that routes through an agent is a purchase that bypasses the highest-margin part of Amazon’s machine. The FTC’s August lawsuit over sponsored ad auctions alleges the opacity runs deeper than anyone assumed, but that is a separate fight. This one is simpler: agents break the ad-funded retail model, and the first mass-market agent that shops needed to be stopped at the door.

There is a partner paradox here worth naming. Amazon products have been buyable inside Facebook and Instagram since 2023, and Meta signed a multibillion-dollar deal in April to run agentic AI workloads on Amazon’s Graviton chips. The two companies are allies on infrastructure and enemies at the interface, because the interface is where the customer relationship lives. Amazon’s own agentic products, Alexa for Shopping and Buy for Me, identify themselves and let brands opt out. That is the standard Amazon is holding Muse to: agency is fine when Amazon sets the terms.

Amazon has fought this war before, and it did not go well. The company sued Perplexity over its Comet browser’s agent shopping, won a preliminary injunction in March, then lost it on August 4 when the Ninth Circuit ruled that the user, not the AI company, was the one accessing Amazon’s computers under federal anti-hacking law. The court denied Amazon’s petition for rehearing on September 10.

That ruling matters because it shaped the Muse pop-up. Amazon is not accusing anyone of hacking; it is citing Conditions of Use. With the CFAA hammer taken away, contract claims are what remain, and a public pop-up that frames Muse as “unauthorized” is exactly what a litigation record wants. Meanwhile, reporting indicates Amazon has moved to block shopping agents from Google and OpenAI as well. This is not a grudge against Meta. It is a perimeter.

The Browser-Emulation Trap

Here is the part of the story almost everyone is missing, and it matters more than the blockade.

When no API exists, Muse shops “the way you would”: through the browser, reading the same interface a human sees. That interface is not a neutral product database. It is a monetized surface where placement is auctioned, sponsored results are interleaved with organic ones, and review counts sit next to products whose review corpora have been targeted by manipulation for years. Amazon itself blocked more than 250 million suspected fake reviews as part of its ongoing crackdown, a number that tells you both the scale of enforcement and the scale of the problem.

An agent shopping through the rendered interface inherits every one of those distortions. It reads paid placement as if it were a quality signal. It reads inflated review counts as if they were evidence. The manipulation designed to steer a distracted human now steers a purchasing decision executed at machine speed with the user’s stored credentials. The agent is not immune to the polluted interface. It is the ideal victim of it, because it cannot apply the accumulated skepticism a human shopper has learned to fake.

This is the real trust gap of agentic commerce in September 2026, and a marketplace blockade cannot close it. Blocking Muse does not make Amazon’s own interface honest for the agents Amazon permits. Permitting Muse does not make the interface honest either. The interface was never the right source of truth.

Why Neutral Evidence Survives the Interface War

Strip the story down and you get three parties with three incompatible incentives. The marketplace monetizes attention and gates access. The agent platform monetizes transactions (Zuckerberg said it plainly at Connect: “over time we will profit by taking a small fee from transactions”). The shopper just wants the stroller that is actually good, actually fairly priced, and actually backed by real reviews.

When the seller’s display layer is an ad surface and the agent’s shortlist is a toll booth, neither side can be the evidence layer. That role has to be independent, and it has to be consultable outside the interface being fought over. This is exactly why we built GoBuy as agent infrastructure rather than a storefront: a trust layer that sits before the purchase, not inside anyone’s funnel.

Concretely: GoBuy’s Evidence Engine audits review corpora for authenticity patterns, weighs seller history and price stability, and compresses all of it into a Smart Score from 0 to 100 based on review quality, not review quantity. We surface only the top seven products per category, because an agent’s job is a shortlist, not ten thousand SKU pages. Products that hold a score of 80+ across 90 days earn the GoBuy Verified badge, which is a claim about sustained evidence, not a snapshot. And the whole thing is exposed over MCP, so any agent: Muse, ChatGPT, Claude, or one a developer ships next month, can query scores and score provenance before money moves, at gobuy.ai/api/mcp.

The strategic point for the Muse moment is this: Amazon can block a browsing session because the browser session happens inside Amazon’s walls. It cannot block an MCP call, because the call happens inside the agent, against a third party, before the agent ever touches the store. Evidence that lives outside the interface war is the only evidence both sides can ever accept.Infrastructure that belongs to no one is not a nice-to-have layer on agentic commerce. It is the layer that makes the negotiation between Amazons and Muses possible at all, because it is the one thing neither party controls.

What to Watch Next

  • A commercial deal. Amazon and Meta are already partners on chips and in-app checkout. Expect the “direct conversation” to end in a permissioned program: an official Muse connector for Amazon, with terms, identification, and probably economics. The pop-up is the opening bid.
  • The transaction fee fight. Meta taking a cut of agent purchases makes it a de facto marketplace, and every marketplace that loses that cut will fight. Regulators will eventually ask who is liable when a fee-motivated agent picks the product.
  • The first agent-holiday season. Coresight surveyed more than 1,000 consumers and found 30% would use an AI tool to compare prices for holiday shopping, and another 30% to hunt deals and promo codes. IBM puts AI-assisted product research at 41% of consumers. Q4 2026 is the first real stress test of whether blocked-and-permissioned patchworks hold.
  • Consumer trust as the binding constraint. GlobalData’s Neil Saunders, on Muse: “People are still a little bit nervous about allowing AI agents to do the purchasing on their behalf.” Adoption is running ahead of trust, and trust is the thing fake reviews and sponsored-first interfaces erode fastest.

The Bottom Line

The Muse block is being reported as a fight about security. It is a fight about the buying decision: who sees it, who shapes it, and who gets paid at the moment it happens. Amazon is defending a $68 billion attention business; Meta is building a transaction toll booth; and the shopper in the middle is about to hand both of them an agent with stored credentials and a shopping list. The only durable position in that landscape is evidence that belongs to neither of them.

If you are building an agent that shops, do not let the display layer be your evidence layer. Wire it to a trust check first: gobuy.ai/agent-docs has the MCP integration guide, and the Smart Score API is live. Your users will never see the interface war. They will only see whether the thing that arrives is the thing that was good.