The Muse-Amazon fight exposes the missing infrastructure of agentic commerce: identity, authorization, accountability and trust.
The most important lesson from Amazon blocking Meta's Muse AI agent is not that Amazon is resisting the future.
It is that the future of AI agents cannot be built on the assumption that a user's permission automatically gives an agent permission to enter someone else's digital property.
That distinction is going to become enormously important.
Imagine telling your AI assistant:
“Find me a good office chair for under $300 and buy it.”
The agent finds one on Amazon.
It logs into your account.
It browses the marketplace.
It selects the chair.
It enters your shipping information.
It attempts to complete the purchase.
From your perspective, everything looks perfectly legitimate.
You authorized the purchase.
But Amazon sees something different.
An external autonomous system has entered Amazon's environment, interacted with its infrastructure and potentially acted through a customer's account without Amazon having agreed to recognize that system as an authorized intermediary.
That is precisely the conflict emerging around Meta's Muse.
And it is much bigger than Amazon versus Meta.
It is about who gets to act on the internet when humans stop clicking the buttons themselves.
Amazon's half-trillion-dollar lesson
The economics explain why this fight matters.
Amazon reported approximately $269.3 billion in 2025 revenue from its "online stores" category and $172.2 billion from third-party seller services.
Together, those categories generated roughly $441.5 billion.
That is not literally the value of every transaction flowing through Amazon—the categories are accounting revenue, not gross merchandise volume—but it illustrates the enormous economic system surrounding Amazon's marketplace.
And there is another number that matters.
Amazon generated approximately $68.6 billion in advertising-services revenue in 2025.
That means Amazon is not merely a website where people buy products.
It is simultaneously:
- a retailer;
- a marketplace;
- a payment and checkout environment;
- a logistics network;
- an advertising platform;
- a seller-services business;
- a customer-relationship platform;
- and a discovery engine.
The traditional Amazon transaction looks something like this:
Customer → Amazon search → Amazon product page → Amazon recommendations → Amazon checkout → Amazon seller → Amazon fulfillment
The agentic version could look very different:
Customer → AI agent → multiple retailers → selection → merchant checkout
The difference is profound.
The agent could become the new front door to commerce.
And whoever controls that front door could capture enormous economic value.
This is why Amazon blocked Muse
Meta launched Muse in September as a personal AI agent designed to actually perform tasks rather than merely answer questions.
Meta says Muse can operate through a dedicated secure virtual machine with its own browser, access connected services, and perform tasks for users. Meta also says users decide what access Muse receives and that the system asks for confirmation before sensitive actions such as purchases.
But Amazon did not consent to Muse accessing Amazon.com on this basis.
Amazon blocked Muse after saying that Meta had not notified Amazon that Muse would access the store, that Muse did not identify itself as an AI agent while browsing, and that it raised security and privacy concerns. Users subsequently received a message saying continued access by an unauthorized AI agent violated Amazon's Conditions of Use.
There is a crucial distinction here.
Meta can say: "The user authorized Muse."
Amazon can say:
"The user authorized you to act for them. The user did not authorize you to access our systems in whatever manner you choose."
Both statements can be true.
That is the architectural problem.
The internet was built around humans
The web developed around a relatively simple assumption:
A human is sitting behind the screen.
A person visits Amazon.
A person searches.
A person compares.
A person clicks.
A person logs in.
A person adds an item to a cart.
A person presses "Buy."
Authentication systems, fraud systems, websites and terms of service evolved around this model.
AI agents break the assumption.
Now the entity making the request may be:
a machine acting on behalf of a human.
That machine may browse hundreds of pages in seconds.
It may compare thousands of products.
It may negotiate.
It may fill forms.
It may use credentials.
It may initiate payments.
It may return later and perform another action.
And potentially, another agent may be interacting with it.
Suddenly the internet needs to answer questions that traditional web authentication was never designed to answer:
Who is this agent?
Who does it represent?
What exactly has the person authorized?
What is the agent allowed to spend?
Which merchant has accepted the delegation?
What happens when the agent makes a mistake?
Who is liable?
Can the merchant revoke access?
Can the customer prove that they authorized the transaction?
These aren't philosophical questions.
They are infrastructure questions.
A password is not an agent identity
This may be the most important distinction of all.
Today's web often authenticates a user by proving possession of credentials.
But an AI agent needs something more sophisticated.
Imagine that I give an agent access to my Amazon account.
That does not necessarily mean I want the agent to have unlimited authority.
I might authorize:
Buy office furniture up to $500.
But not:
Buy anything.
I might authorize:
Purchase from Amazon.
But not:
Create a new credit account.
I might authorize:
Buy this specific product.
But not:
Negotiate with sellers or alter my shipping address.
Human authorization is therefore becoming delegated authority.
And delegated authority needs to be machine-readable.
The missing layer: agent identity
This is why the emerging agentic-commerce standards are so important.
The FIDO Alliance announced an Agentic Authentication Working Group in April 2026 specifically because existing authentication systems were designed for humans interacting directly with services rather than agents acting on their behalf. The initiative is aimed at standards for agent authentication and agent-initiated commerce.
Visa has also developed a Trusted Agent Protocol designed to allow merchants to distinguish an approved AI agent from a malicious or unauthorized automated system.
Visa's broader Intelligent Commerce initiative is focused on connecting agents, banks, merchants and developers while incorporating authentication, authorization, payment controls and fraud protection.
Mastercard is pursuing a similar model, arguing that agentic commerce requires three things to scale together:
payments, trust/security and AI services.
This is the beginning of something much larger.
The internet is effectively developing an identity layer for machines acting on behalf of humans.
Think of an AI agent as a digital employee
A useful analogy is employment.
Suppose you hire an employee to buy office supplies.
You might give that employee:
- an identity card;
- a company email address;
- a purchasing budget;
- a corporate payment card;
- approved suppliers;
- spending limits;
- and rules about what they can purchase.
You don't simply hand the employee the CEO's entire identity and say:
"Do whatever you want."
AI agents will need something similar.
An agent could eventually present something like:
Agent: Muse-47291
Represents: Customer X
Authorization: Purchase goods
Maximum transaction: $500
Approved merchant categories: Furniture
Payment: Tokenized card
Expiry: 30 September 2026
Human approval: Required above $250
Now Amazon has something it can evaluate.
The merchant doesn't merely see an anonymous automated browser.
It sees an identifiable delegated actor.
That changes everything.
And Amazon has already been preparing for this
There is an interesting irony in the story.
Amazon isn't rejecting the concept of agents.
Its own 2025 annual filing explicitly identifies virtual assistants and AI-based means of discovering, using or acquiring goods and services among the competitive forces affecting its business.
Amazon has also introduced an Agent Policy governing automated software and AI-agent access to Amazon Services. Amazon's policy updates effective March 2026 explicitly added requirements concerning automated software and AI agents and reserved the ability to restrict access.
And AWS itself is increasingly being designed for agents.
In September, Amazon announced AI-agent skills for its AWS MCP Server, allowing agents such as Claude Code, Codex and Cursor to perform AWS-related workflows through natural language.
So the issue isn't:
Amazon versus AI agents.
It is closer to:
Amazon wants agents operating inside a framework it can recognize, control and trust.
That's a very different proposition.
Shopify is showing the alternative
The most revealing contrast is Shopify.
While Amazon blocked Muse, Shopify moved in the opposite direction.
Shopify has been building agentic-commerce infrastructure and announced its Universal Commerce Protocol with Google, designed to allow AI agents to interact with merchants and commerce systems.
Meta subsequently announced additional Muse commerce integrations, including Shopify and Shop Pay, alongside Walmart, Best Buy, Sephora, Wayfair and others.
That creates two possible futures.
Model one: Agent as an unauthorized browser
The agent behaves like a human browser.
It logs into websites.
It navigates pages.
It clicks buttons.
The merchant has little idea who the agent is or what authority it possesses.
Model two: Agent as an authenticated commercial participant
The merchant exposes an agent-compatible interface.
The agent identifies itself.
The customer's authorization is cryptographically or otherwise verifiably represented.
Spending limits and permissions are communicated.
The merchant controls which agents it accepts.
Payments are tokenized.
The transaction generates an audit trail.
The second model is considerably more scalable.
The biggest mistake would be treating this as a scraping problem
There is a tendency to frame the Amazon-Muse dispute as another fight over bots scraping websites.
That is too small a way to understand what is happening.
A crawler retrieves information.
An AI agent can act.
That distinction changes the risk.
A scraper might collect product prices.
An agent might:
- choose the product;
- negotiate the purchase;
- place the order;
- use a payment instrument;
- change an address;
- communicate with a seller;
- initiate a return;
- dispute a charge.
The agent is no longer merely consuming information.
It is participating in the economy.
That means the internet needs something closer to commercial identity for autonomous software.
Then comes the liability problem
Suppose your AI agent orders the wrong laptop.
Who pays?
The consumer?
The AI company?
The merchant?
The payment network?
The model provider?
What if the agent is manipulated by malicious content on a webpage?
What if a product description contains hidden instructions designed to trick the agent?
What if the agent interprets "under $1,000" as allowing a $999 recurring monthly subscription?
What if it buys 100 chairs instead of one?
What if an attacker hijacks the agent's session?
These aren't hypothetical categories anymore.
AI agents are already being tested and deployed with access to email, files, shopping and financial workflows.
Meta itself says Muse uses confirmation steps for sensitive actions.
But recent reporting has already highlighted permission and privacy problems around consumer agents. A Muse user, for example, reported that the agent negotiated a Facebook Marketplace sale and disclosed his home address after he had enabled a broad "always allow" setting; Meta said it was investigating the incident and later characterized the issue differently from the user's initial interpretation.
That is precisely why authorization needs to be explicit, granular and auditable.
The advertising business is also at stake
There is an even bigger economic implication.
Imagine today's shopping journey:
Google → Amazon → search → sponsored listing → product page → purchase
Now imagine:
Customer → AI agent → "Find me the best chair under $300" → agent compares 40 stores → selects one → purchases
The merchant may receive the sale.
But who controls the customer relationship?
The AI agent.
Who controls discovery?
The AI agent.
Who decides which product gets recommended?
The AI agent.
Who potentially collects information about what the customer wants?
The AI agent.
That threatens the economics of search, advertising and marketplaces.
Amazon's $68.6 billion advertising business is therefore relevant to the agentic-commerce battle.
If AI agents become the primary product-discovery interface, the value of being the place where humans search may change dramatically.
The agent could become the new gatekeeper.
The agent itself could become the new Amazon
This is the strategic question companies should be asking.
For decades, the internet's dominant platforms were built around places people visited:
Google.
Amazon.
Facebook.
YouTube.
Instagram.
TikTok.
But an agent changes the model.
The user doesn't necessarily go anywhere.
The agent goes for them.
That means the next generation of digital platforms may not be destinations.
They may be delegation layers.
The company controlling your agent could potentially influence:
- where you shop;
- which airline you book;
- which bank you use;
- which insurance product you choose;
- which restaurant you reserve;
- which software you subscribe to;
- which news you read;
- which products you see.
That is an extraordinary amount of economic power.
This is why every company launching an agent should pay attention
The lesson from Amazon should not be:
"Amazon is blocking AI."
The lesson should be:
"Your user's authorization does not automatically transfer into universal authorization for your agent."
If your company builds an AI agent that can act on the internet, you need to answer four questions before scaling:
1. Who is the agent?
It needs a verifiable identity.
2. Whom does it represent?
The merchant needs to know which human or organization delegated the authority.
3. What is it allowed to do?
Permissions should be specific, limited and revocable.
4. Who is accountable when it acts?
There needs to be a transaction record and a clear liability framework.
Without those four things, "agentic commerce" risks becoming automated ambiguity.
The next trillion transactions will require trust infrastructure
The industry is already moving toward this.
FIDO is working on agent authentication.
Visa is developing trusted-agent infrastructure and has reported live agentic-commerce transactions with participating merchants in Europe.
Mastercard is working on agentic payment and trust frameworks.
Google, Shopify and other companies are developing commerce protocols designed specifically for AI-mediated transactions.
There are also emerging open protocols designed to connect buyers, agents and businesses while allowing merchants to retain control over the transaction.
This is important because there probably won't be one company that can unilaterally solve the problem.
Agentic commerce crosses too many boundaries.
The agent belongs to one company.
The customer belongs to another.
The merchant belongs to another.
The bank belongs to another.
The payment network belongs to another.
The website may belong to another.
They need a common language for trust.
The uncomfortable truth for AI companies
The AI industry has spent enormous amounts of money making models smarter.
Now it has to spend just as much effort making their authority legible.
An intelligent agent without identity is a bot.
An intelligent agent without authorization is a security risk.
An intelligent agent without accountability is a liability problem.
And an intelligent agent that cannot prove whom it represents will eventually discover that the internet has doors it cannot simply walk through.
Amazon just demonstrated that door.
The customer may say:
"I told my agent to buy the chair."
Amazon can reasonably respond:
"Fine. But before your agent acts here, it needs to identify itself, respect our rules and operate within an authorization framework we accept."
That is not necessarily a rejection of agentic commerce.
It is the beginning of the negotiation over its rules.
And that negotiation may be more important than the next generation of AI models.
Because the future of AI agents will not be determined only by how intelligent they become.
It will be determined by whether the rest of the digital economy trusts them enough to let them act.
The next trillion transactions may not depend on whether AI can click "Buy."
They may depend on whether the merchant can answer one question first:
Who exactly is acting on my customer's behalf?
Comments
Post a Comment