Amazon blocks Meta's agent and brings forward the key question of the next decade: who authorizes AI?

By Gulte · September 26, 2026.

Meta unveiled Muse this month, an assistant the company itself prefers to call a "personal AI agent" rather than simply a chatbot. The difference is not cosmetic: according to Meta, Muse can browse the web, fill in forms, send emails, book travel and make purchases, and it keeps working on a task even if the user has closed the app. It is the leap from "ask it and you decide" to "tell it what you want and it decides the steps."

That leap has already collided with commercial reality. On September 20, Amazon blocked Muse's access to Amazon.com, claiming that Meta had not sought permission for the agent to shop on its platform. Amazon argued that any third-party application that buys on a customer's behalf must operate transparently and respect the terms of the retailer whose service it uses.

Meta's own security team also acknowledges a specific risk in connecting email: an inbox accumulates one-time passwords, password reset links and direct access links to other accounts — in other words, it is the recovery mechanism for almost any of a person's online services. Muse filters those messages so the agent cannot use them to impersonate the user on other sites, as Meta itself explains.

The Indian case illustrates how far this could go if it extends to payments. NPCI (National Payments Corporation of India, the body that operates UPI, the instant payment system that already handles a large share of the country's digital transactions) was working on an "agentic payments" framework: a Unified Agent Protocol that would allow an AI to execute small, routine purchases without the user approving each transaction, with identity verification, spending limits and fund delegation rules, as Reuters reported. NPCI has put that protocol on hold while it resolves regulatory and security questions, according to Business Standard. India also has the DPDP law (Digital Personal Data Protection Act, its personal data protection framework) focused on consent, minimization and traceability, but designed for data, not for deciding who is liable when an agent goes beyond what it was authorized to do.

Our take is that Amazon's veto is not a simple spat between two tech companies: it is the first visible skirmish in a dispute that has been taking shape in the agentic AI industry for months. The game is not necessarily won with the most capable model, but by whoever controls the "plumbing" that model has to pass through in order to act: checkout, identity, account access. Amazon has a legitimate argument about security and terms-of-use compliance, but also a very direct interest in not letting a competitor's agent come between the retailer and the customer, capturing that relationship. Both things are true at once, and it is best not to reduce the episode to just one of them.

The second reading has to do with security, and here Muse's design is revealing for what it unwittingly confesses: filtering out one-time passwords and recovery links is a sensible mitigation, but it is one company's patch, not an industry standard. Every company that launches an agent with email access will have to solve the same problem on its own, by its own criteria, until there is a shared norm on what kind of access implies what kind of risk. That is where the original article's proposal makes sense: not every "authorization" should be binary; reading, recommending, sending, buying and transferring money are five different levels of risk and should require five different levels of confirmation and logging.

The third point, and the one that connects with something we keep repeating at Zendoric, is that agentic AI governance is being built through incidents, not through anticipatory design: a block from Amazon here, a regulatory pause from NPCI there. It is a pattern we already saw with California's regulation on chatbots and minors: regulate behavior and the chain of authorization, not technical capability in the abstract. It works, but it leaves gaps in the meantime, and those gaps —who authorized what, how far, and who is liable if the agent errs or is manipulated by a malicious website— are exactly the ones that today have no answer in India or in any other market.

In the short term, that friction is real and will slow the adoption of agents with broad permissions: neither retailers nor regulators are going to hand over control of money and digital identity without verifiable guarantees, and they are right to resist. But if it is resolved —with graduated permission layers, spending limits, auditing and clear liability— delegating the administrative tasks of daily life to an AI (paying bills, booking tickets, handling paperwork) is precisely the kind of friction that disappears in the society of abundance this technology points toward: less human time spent on domestic bureaucracy, more free time for what really matters. The agent that shops for you is not the underlying problem; the problem is that no one has yet written the rules on who gives it permission.