Amazon blocks Meta's Muse while Shopify embraces it: a lesson in agent infrastructure

Amazon restricted Meta's newly launched Muse AI agent from browsing and making purchases on its platform in mid-September, just two weeks after the assistant debuted. Shoppers attempting to use Muse to shop received a notification that the unauthorized agent violated Amazon's terms. Meanwhile, Shopify moved in the opposite direction, integrating Muse directly into its merchant platform the very next day—a stark reversal that reflects deeper architectural and business model tensions in how companies should handle agent-based commerce.

The technical flashpoint#

Muse operates from a secure virtual machine that Meta maintains. When accessing most services, it drives a standard browser session without announcing itself as an automated agent. That anonymous approach is what triggered Amazon's response. The retailer told industry observers it had asked Meta to exclude Amazon voluntarily before deploying the restrictions.

The underlying issue runs deeper than a single shopping transaction. From Amazon's perspective, an agent browsing while logged in appears indistinguishable from a regular customer—yet it moves with unusual speed, accesses account history, and potentially captures credentials for reuse. The arrangement raises questions about data handling that neither Amazon nor Meta can easily settle from the outside, since an unannounced session generates no verifiable record of which system holds sensitive information.

Amazon cited violations of its updated terms of service, which now mandate that agents identify themselves and honor requests to stop. However, the company did not invoke stronger legal weapons. A significant Ninth Circuit ruling from August had weakened Amazon's legal position by determining that when a user directs an AI assistant, that user—not the AI system—is the party accessing a website's computers. That decision essentially made blocking at the infrastructure level more reliable than litigation.

The infrastructure already exists—but isn't adopted yet#

Solving agent identity and access control at scale doesn't require inventing new technology. Platform operators have managed similar trust problems internally for years using service meshes, where no workload is trusted by default and every request carries verifiable identity information. The same pattern can apply to agent traffic on the open internet.

An emerging IETF specification called Web Bot Auth, built on HTTP Message Signatures, enables agents to cryptographically sign their requests. An agent publishes its public key at a well-known directory, and receiving systems can verify which organization is making the call. Cloudflare already validates these signatures at its edge, and AWS added support for CloudFront in late 2025. The mechanism clearly identifies the operator behind an agent without exposing which specific customer account is in use—leaving authorization decisions in the merchant's hands.