Amazon blocks Meta's Muse agent: the web still can't tell an authorized agent from a bot

By El Ecosistema Startup · October 18, 2026.

Amazon has blocked Muse, Meta's AI agent, when it tried to complete a purchase in its store. It now shows a warning to anyone who tries: according to the company, continued access by an unauthorized AI agent violates its terms of use. The story was published by GeekWire and picked up by Yahoo Finance.

The figure that explains the harshness of the response: according to the article, Amazon brought in more than $68 billion in advertising last year. That business depends on a person browsing the site and seeing sponsored listings. An agent that buys without looking at ads leaves that money on the table.

According to Amazon, before the block it asked Meta to exclude its site from Muse's reach. Its argument is that third-party apps that shop on a customer's behalf should operate openly and respect each seller's decision. It compares this with delivery apps and online travel agencies, which work under agreements with merchants. Meta counters that Muse does not see users' passwords or payment methods. According to GeekWire's report, the agent runs on a dedicated virtual machine in Meta's cloud, uses single-use cards generated with Link by Stripe and has a monitoring system, Sentinel, that controls which actions it can take on the internet.

The two companies are partners. According to Yahoo Finance, Amazon products have been available to buy inside Facebook and Instagram since 2023, and in April Meta closed a deal to run AI workloads on Amazon's cloud.

Amazon is not the only one blocking agents. According to the original report from MaisTecnologia, several airlines block external agents from searching and booking flights. Banks such as JPMorgan Chase, Bank of America and Citigroup restrict bot access to customer accounts, officially citing security and fraud prevention. According to the article, Amazon had already taken legal action against Perplexity over its Comet browser and had targeted shopping agents from Google and OpenAI.

The technical problem compounds the economic one. According to the original report, there is no universal standard to confirm that an agent is acting with the user's permission. Services such as Cloudflare, which filter a huge share of web traffic, struggle to tell a legitimate agent from a malicious bot. The result is CAPTCHAs, dropped sessions and interrupted payments. Cloudflare Radar measured that bots accounted for 60.6% of requests for HTML content in the seven days before August 10, 2026, versus 39.4% human traffic (figure cited by Search Engine Journal).

The industry is starting to respond. According to Search Engine Journal, on August 4 Cloudflare unveiled Cloudflare Wallets, which let agents hold funds and pay for what they consume, and cloudflare.pay, an optional identifier that tells the merchant which account the agent represents. Identity relies on Web Bot Auth (identity registration with a key pair) and payments on the x402 protocol, which now sits under the Linux Foundation with Visa, Mastercard, American Express, Google, Shopify and Stripe among its members.

There is also a fight over costs. According to The Verge, OpenAI unveiled Dots, an agent that runs on its own cloud computer, but limited it to Pro plans at $100 a month. Muse, by contrast, comes included with a Meta account, even on a free tier. Meta can subsidize it because its core business is not selling compute.

Our take: this clash confirms that the bottleneck for agentic AI is no longer capability but trust. An agent can compare, decide and pay, but the web was designed for humans who look at ads, and each platform defends its revenue model with the tools it has: terms of use and blocking. That Amazon is doing this to a partner suggests the issue is structural, not a one-off rivalry.

Amazon's argument is partly reasonable: no one should be able to operate in its store without an agreement. But there is a catch. If every site decides to shut the door by default, users lose the ability to delegate tedious tasks to an assistant of their own. The travel-agency analogy is useful, but the difference is that here the agent acts on the customer's behalf, not as a commercial intermediary. That legal distinction will remain contested.

In general, this fits a pattern we see in agent governance: the design question is no longer what the agent can do, but who is accountable for what it does and who audits it. Action logs, limited credentials and verifiable identity are not bureaucracy: they are the infrastructure that will allow doors to open with safeguards. Standards such as Web Bot Auth and x402 point in that direction, although their adoption is still a work in progress.

Who wins and who loses in the short term: the winners are platforms with their own inventory and companies selling agent identity and traceability; the losers are general-purpose agents, which will depend on bilateral agreements. For consumers, the immediate result is more friction: the agent researches and prepares, but the person handles the login and payment.

In the long term, optimism remains reasonable. If identity and machine-to-machine payments are solved, agents will be able to handle much of the everyday administrative load, freeing up human time. But getting there requires web businesses to move from blocking to negotiating, and someone to set clear rules before the conflict ends up in court case by case.